From d996e95e2e788730d45bff4ddec6a518c1e522ec Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 29 Jul 2024 11:32:01 +0530
Subject: [PATCH 01/40] add gateway and gatewayclass support

---
 adapter/config/default_config.go              |    2 +
 adapter/config/types.go                       |    5 +-
 adapter/go.mod                                |   26 +-
 adapter/go.sum                                |   30 +-
 adapter/internal/adapter/adapter.go           |   79 +-
 .../internal/oasparser/envoyconf/constants.go |    1 -
 .../internal/operator/constants/constants.go  |    3 +
 .../controllers/dp/tokenissuer_controller.go  |   10 +-
 .../internal/operator/gateway-api/address.go  |   49 +
 .../gateway-api/bootstrap/bootstrap.go        |  226 ++
 .../gateway-api/bootstrap/bootstrap.yaml.tpl  |  191 ++
 .../gateway-api/bootstrap/bootstrap_test.go   |  128 +
 .../bootstrap/testdata/merge/default.in.yaml  |   13 +
 .../bootstrap/testdata/merge/default.out.yaml |  118 +
 .../testdata/merge/stats_sinks.in.yaml        |   34 +
 .../testdata/merge/stats_sinks.out.yaml       |  140 ++
 .../testdata/render/custom-stats-matcher.yaml |  112 +
 .../testdata/render/disable-prometheus.yaml   |  101 +
 .../testdata/render/enable-prometheus.yaml    |  101 +
 .../testdata/render/otel-metrics.yaml         |  126 +
 .../internal/operator/gateway-api/contexts.go |  453 ++++
 .../operator/gateway-api/crypto/certgen.go    |  321 +++
 .../gateway-api/crypto/certgen_test.go        |  174 ++
 .../gateway-api/envoy/shutdown_manager.go     |  238 ++
 .../internal/operator/gateway-api/filters.go  |  792 ++++++
 .../internal/operator/gateway-api/helpers.go  |  461 ++++
 .../operator/gateway-api/helpers_v1alpha2.go  |  205 ++
 .../infrastructure/kubernetes/infra.go        |  135 +
 .../infrastructure/kubernetes/infra_client.go |   89 +
 .../kubernetes/infra_resource.go              |  209 ++
 .../kubernetes/proxy/resource.go              |  728 ++++++
 .../kubernetes/proxy/resource_provider.go     |  351 +++
 .../proxy/resource_provider_test.go           |  989 ++++++++
 .../kubernetes/proxy/resource_test.go         |   56 +
 .../proxy/testdata/configmap/default.yaml     |   14 +
 .../testdata/configmap/with-annotations.yaml  |   17 +
 .../proxy/testdata/deployments/bootstrap.yaml |  296 +++
 .../testdata/deployments/component-level.yaml |  297 +++
 .../proxy/testdata/deployments/custom.yaml    |  311 +++
 .../custom_with_initcontainers.yaml           |  328 +++
 .../testdata/deployments/default-env.yaml     |  310 +++
 .../proxy/testdata/deployments/default.yaml   |  296 +++
 .../deployments/disable-prometheus.yaml       |  264 ++
 .../testdata/deployments/extension-env.yaml   |  313 +++
 .../override-labels-and-annotations.yaml      |  307 +++
 .../deployments/patch-deployment.yaml         |  297 +++
 .../deployments/shutdown-manager.yaml         |  309 +++
 .../proxy/testdata/deployments/volumes.yaml   |  313 +++
 .../deployments/with-annotations.yaml         |  301 +++
 .../deployments/with-concurrency.yaml         |  297 +++
 .../testdata/deployments/with-extra-args.yaml |  298 +++
 .../deployments/with-image-pull-secrets.yaml  |  299 +++
 .../deployments/with-node-selector.yaml       |  299 +++
 .../with-topology-spread-constraints.yaml     |  305 +++
 .../kubernetes/proxy/testdata/hpa/custom.yaml |   28 +
 .../proxy/testdata/hpa/default.yaml           |   21 +
 .../proxy/testdata/hpa/with-annotations.yaml  |   24 +
 .../testdata/serviceaccount/default.yaml      |   11 +
 .../serviceaccount/with-annotations.yaml      |   14 +
 .../services/clusterIP-custom-addresses.yaml  |   32 +
 .../proxy/testdata/services/custom.yaml       |   31 +
 .../proxy/testdata/services/default.yaml      |   30 +
 .../services/override-annotations.yaml        |   37 +
 .../testdata/services/patch-service.yaml      |   30 +
 .../testdata/services/with-annotations.yaml   |   33 +
 .../kubernetes/proxy_configmap_test.go        |  187 ++
 .../kubernetes/proxy_deployment_test.go       |  162 ++
 .../infrastructure/kubernetes/proxy_infra.go  |   55 +
 .../kubernetes/proxy_infra_test.go            |  180 ++
 .../kubernetes/proxy_service_test.go          |   60 +
 .../kubernetes/resource/resource.go           |  131 +
 .../kubernetes/resource/resource_test.go      |  553 ++++
 .../gateway-api/infrastructure/manager.go     |   57 +
 .../internal/operator/gateway-api/ir/infra.go |  274 ++
 .../operator/gateway-api/ir/infra_test.go     |  263 ++
 .../operator/gateway-api/ir/protocol.go       |   44 +
 .../internal/operator/gateway-api/ir/xds.go   | 1749 +++++++++++++
 .../operator/gateway-api/ir/xds_test.go       | 1438 +++++++++++
 .../gateway-api/ir/zz_generated.deepcopy.go   | 2221 +++++++++++++++++
 .../internal/operator/gateway-api/listener.go |  191 ++
 .../provider/kubernetes/controller.go         |  744 ++++++
 .../provider/kubernetes/helpers.go            |  151 ++
 .../provider/kubernetes/indexers.go           |  399 +++
 .../provider/kubernetes/kubernetes.go         |  112 +
 .../provider/kubernetes/predicates.go         |  262 ++
 .../provider/kubernetes/predicates_test.go    |   89 +
 .../gateway-api/provider/kubernetes/routes.go |  189 ++
 .../gateway-api/provider/kubernetes/status.go |  137 +
 .../gateway-api/provider/kubernetes/store.go  |   93 +
 .../provider/kubernetes/store_test.go         |  111 +
 .../operator/gateway-api/provider/scheme.go   |   70 +
 .../internal/operator/gateway-api/resource.go |  168 ++
 .../internal/operator/gateway-api/route.go    | 1340 ++++++++++
 .../internal/operator/gateway-api/secrets.go  |  153 ++
 .../operator/gateway-api/secrets_test.go      |  114 +
 adapter/internal/operator/gateway-api/sort.go |  124 +
 .../testdata/backendtlspolicy-ca-only.in.yaml |  137 +
 .../backendtlspolicy-ca-only.out.yaml         |  169 ++
 .../backendtlspolicy-default-ns.in.yaml       |  137 +
 .../backendtlspolicy-default-ns.out.yaml      |  168 ++
 .../backendtlspolicy-invalid-ca.in.yaml       |  119 +
 .../backendtlspolicy-invalid-ca.out.yaml      |  164 ++
 ...backendtlspolicy-system-truststore.in.yaml |  105 +
 ...ackendtlspolicy-system-truststore.out.yaml |  163 ++
 ...ndtlspolicy-without-referencegrant.in.yaml |  134 +
 ...dtlspolicy-without-referencegrant.out.yaml |  165 ++
 ...kendtrafficpolicy-override-replace.in.yaml |   89 +
 ...endtrafficpolicy-override-replace.out.yaml |  271 ++
 ...endtrafficpolicy-status-conditions.in.yaml |  207 ++
 ...ndtrafficpolicy-status-conditions.out.yaml |  621 +++++
 ...afficpolicy-status-fault-injection.in.yaml |  135 +
 ...fficpolicy-status-fault-injection.out.yaml |  430 ++++
 ...cpolicy-with-circuitbreakers-error.in.yaml |  123 +
 ...policy-with-circuitbreakers-error.out.yaml |  394 +++
 ...trafficpolicy-with-circuitbreakers.in.yaml |   99 +
 ...rafficpolicy-with-circuitbreakers.out.yaml |  328 +++
 ...kendtrafficpolicy-with-healthcheck.in.yaml |  239 ++
 ...endtrafficpolicy-with-healthcheck.out.yaml |  648 +++++
 ...endtrafficpolicy-with-loadbalancer.in.yaml |  142 ++
 ...ndtrafficpolicy-with-loadbalancer.out.yaml |  443 ++++
 ...atelimit-default-route-level-limit.in.yaml |   71 +
 ...telimit-default-route-level-limit.out.yaml |  213 ++
 ...local-ratelimit-invalid-limit-unit.in.yaml |   74 +
 ...ocal-ratelimit-invalid-limit-unit.out.yaml |  186 ++
 ...local-ratelimit-invalid-match-type.in.yaml |   71 +
 ...ocal-ratelimit-invalid-match-type.out.yaml |  182 ++
 ...nvalid-multiple-route-level-limits.in.yaml |   77 +
 ...valid-multiple-route-level-limits.out.yaml |  189 ++
 ...trafficpolicy-with-local-ratelimit.in.yaml |   74 +
 ...rafficpolicy-with-local-ratelimit.out.yaml |  216 ++
 ...ndtrafficpolicy-with-proxyprotocol.in.yaml |   91 +
 ...dtrafficpolicy-with-proxyprotocol.out.yaml |  312 +++
 ...olicy-with-ratelimit-invalid-regex.in.yaml |   56 +
 ...licy-with-ratelimit-invalid-regex.out.yaml |  164 ++
 ...ackendtrafficpolicy-with-ratelimit.in.yaml |  111 +
 ...ckendtrafficpolicy-with-ratelimit.out.yaml |  352 +++
 .../backendtrafficpolicy-with-retries.in.yaml |  110 +
 ...backendtrafficpolicy-with-retries.out.yaml |  350 +++
 ...policy-with-same-prefix-httproutes.in.yaml |   70 +
 ...olicy-with-same-prefix-httproutes.out.yaml |  224 ++
 ...endtrafficpolicy-with-tcpkeepalive.in.yaml |   95 +
 ...ndtrafficpolicy-with-tcpkeepalive.out.yaml |  320 +++
 ...ndtrafficpolicy-with-timeout-error.in.yaml |   49 +
 ...dtrafficpolicy-with-timeout-error.out.yaml |  155 ++
 .../backendtrafficpolicy-with-timeout.in.yaml |   99 +
 ...backendtrafficpolicy-with-timeout.out.yaml |  328 +++
 .../testdata/disable-accesslog.in.yaml        |   73 +
 .../testdata/disable-accesslog.out.yaml       |  130 +
 .../envoypatchpolicy-cross-ns-target.in.yaml  |   35 +
 .../envoypatchpolicy-cross-ns-target.out.yaml |   83 +
 ...tchpolicy-invalid-feature-disabled.in.yaml |   43 +
 ...chpolicy-invalid-feature-disabled.out.yaml |   92 +
 ...invalid-target-kind-merge-gateways.in.yaml |   43 +
 ...nvalid-target-kind-merge-gateways.out.yaml |   94 +
 ...voypatchpolicy-invalid-target-kind.in.yaml |   35 +
 ...oypatchpolicy-invalid-target-kind.out.yaml |   84 +
 ...licy-no-status-for-unknown-gateway.in.yaml |   13 +
 ...icy-no-status-for-unknown-gateway.out.yaml |    2 +
 ...oypatchpolicy-valid-merge-gateways.in.yaml |   64 +
 ...ypatchpolicy-valid-merge-gateways.out.yaml |  115 +
 .../testdata/envoypatchpolicy-valid.in.yaml   |   56 +
 .../testdata/envoypatchpolicy-valid.out.yaml  |  105 +
 ...roxy-accesslog-file-json-no-format.in.yaml |   79 +
 ...oxy-accesslog-file-json-no-format.out.yaml |  137 +
 .../envoyproxy-accesslog-file-json.in.yaml    |   82 +
 .../envoyproxy-accesslog-file-json.out.yaml   |  145 ++
 ...nvoyproxy-accesslog-with-bad-sinks.in.yaml |   80 +
 ...voyproxy-accesslog-with-bad-sinks.out.yaml |  138 +
 .../testdata/envoyproxy-accesslog.in.yaml     |   87 +
 .../testdata/envoyproxy-accesslog.out.yaml    |  156 ++
 .../testdata/envoyproxy-valid.in.yaml         |   70 +
 .../testdata/envoyproxy-valid.out.yaml        |  130 +
 ...ith-extension-filter-invalid-group.in.yaml |   50 +
 ...th-extension-filter-invalid-group.out.yaml |  120 +
 ...with-non-matching-extension-filter.in.yaml |   50 +
 ...ith-non-matching-extension-filter.out.yaml |  118 +
 ...-with-unsupported-extension-filter.in.yaml |   50 +
 ...with-unsupported-extension-filter.out.yaml |  118 +
 ...proute-with-valid-extension-filter.in.yaml |   50 +
 ...route-with-valid-extension-filter.out.yaml |  147 ++
 ...e-namespace-with-allowed-httproute.in.yaml |   63 +
 ...-namespace-with-allowed-httproute.out.yaml |  127 +
 ...amespace-with-disallowed-httproute.in.yaml |   32 +
 ...mespace-with-disallowed-httproute.out.yaml |  107 +
 .../testdata/gateway-infrastructure.in.yaml   |   76 +
 .../testdata/gateway-infrastructure.out.yaml  |  150 ++
 ...eway-with-addresses-with-ipaddress.in.yaml |   19 +
 ...way-with-addresses-with-ipaddress.out.yaml |   67 +
 ...nvalid-allowed-namespaces-selector.in.yaml |   38 +
 ...valid-allowed-namespaces-selector.out.yaml |   92 +
 ...-with-invalid-allowed-routes-group.in.yaml |   35 +
 ...with-invalid-allowed-routes-group.out.yaml |   83 +
 ...-allowed-routes-kind-and-supported.in.yaml |   37 +
 ...allowed-routes-kind-and-supported.out.yaml |   85 +
 ...r-with-invalid-allowed-routes-kind.in.yaml |   35 +
 ...-with-invalid-allowed-routes-kind.out.yaml |   83 +
 ...ith-invalid-allowed-tls-route-kind.in.yaml |   35 +
 ...th-invalid-allowed-tls-route-kind.out.yaml |   83 +
 ...invalid-multiple-tls-configuration.in.yaml |   66 +
 ...nvalid-multiple-tls-configuration.out.yaml |   98 +
 ...lid-tls-configuration-invalid-mode.in.yaml |   47 +
 ...id-tls-configuration-invalid-mode.out.yaml |   91 +
 ...-configuration-no-certificate-refs.in.yaml |   44 +
 ...configuration-no-certificate-refs.out.yaml |   86 +
 ...tion-no-valid-certificate-for-fqdn.in.yaml |   47 +
 ...ion-no-valid-certificate-for-fqdn.out.yaml |   93 +
 ...onfiguration-secret-does-not-exist.in.yaml |   36 +
 ...nfiguration-secret-does-not-exist.out.yaml |   90 +
 ...guration-secret-in-other-namespace.in.yaml |   47 +
 ...uration-secret-in-other-namespace.out.yaml |   92 +
 ...-configuration-secret-is-not-valid.in.yaml |   45 +
 ...configuration-secret-is-not-valid.out.yaml |   90 +
 ...issing-allowed-namespaces-selector.in.yaml |   32 +
 ...ssing-allowed-namespaces-selector.out.yaml |   85 +
 ...th-listener-with-tcp-with-hostname.in.yaml |   16 +
 ...h-listener-with-tcp-with-hostname.out.yaml |   48 +
 ...proute-with-mismatch-port-protocol.in.yaml |   29 +
 ...route-with-mismatch-port-protocol.out.yaml |   92 +
 ...th-tcproute-with-multiple-backends.in.yaml |   33 +
 ...h-tcproute-with-multiple-backends.out.yaml |   96 +
 ...-with-tcproute-with-multiple-rules.in.yaml |   34 +
 ...with-tcproute-with-multiple-rules.out.yaml |   97 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   61 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  139 ++
 ...with-tls-terminate-and-passthrough.in.yaml |   70 +
 ...ith-tls-terminate-and-passthrough.out.yaml |  225 ++
 ...th-listener-with-udp-with-hostname.in.yaml |   16 +
 ...h-listener-with-udp-with-hostname.out.yaml |   48 +
 ...proute-with-mismatch-port-protocol.in.yaml |   29 +
 ...route-with-mismatch-port-protocol.out.yaml |   92 +
 ...th-udproute-with-multiple-backends.in.yaml |   33 +
 ...h-udproute-with-multiple-backends.out.yaml |   96 +
 ...-with-udproute-with-multiple-rules.in.yaml |   34 +
 ...with-udproute-with-multiple-rules.out.yaml |   97 +
 ...h-listener-with-unmatched-tcproute.in.yaml |   29 +
 ...-listener-with-unmatched-tcproute.out.yaml |   60 +
 ...h-listener-with-unmatched-udproute.in.yaml |   29 +
 ...-listener-with-unmatched-udproute.out.yaml |   60 +
 ...listener-with-unsupported-protocol.in.yaml |   32 +
 ...istener-with-unsupported-protocol.out.yaml |   85 +
 ...with-same-algorithm-different-fqdn.in.yaml |   56 +
 ...ith-same-algorithm-different-fqdn.out.yaml |  144 ++
 ...h-valid-multiple-tls-configuration.in.yaml |   56 +
 ...-valid-multiple-tls-configuration.out.yaml |  144 ++
 ...tener-with-valid-tls-configuration.in.yaml |   46 +
 ...ener-with-valid-tls-configuration.out.yaml |  138 +
 ...-with-preexisting-status-condition.in.yaml |   55 +
 ...with-preexisting-status-condition.out.yaml |  127 +
 ...e-listener-with-multiple-tcproutes.in.yaml |   42 +
 ...-listener-with-multiple-tcproutes.out.yaml |  137 +
 ...e-listener-with-multiple-udproutes.in.yaml |   42 +
 ...-listener-with-multiple-udproutes.out.yaml |  136 +
 ...ateway-with-stale-status-condition.in.yaml |   69 +
 ...teway-with-stale-status-condition.out.yaml |  138 +
 ...-listeners-on-same-tcp-or-tls-port.in.yaml |   35 +
 ...listeners-on-same-tcp-or-tls-port.out.yaml |  135 +
 ...ith-two-listeners-on-same-udp-port.in.yaml |   35 +
 ...th-two-listeners-on-same-udp-port.out.yaml |  132 +
 ...nd-tlsroute-same-hostname-and-port.in.yaml |   56 +
 ...d-tlsroute-same-hostname-and-port.out.yaml |  152 ++
 ...listeners-with-multiple-httproutes.in.yaml |   56 +
 ...isteners-with-multiple-httproutes.out.yaml |  266 ++
 ...teners-with-same-port-and-hostname.in.yaml |   40 +
 ...eners-with-same-port-and-hostname.out.yaml |  120 +
 ...ame-port-and-incompatible-protocol.in.yaml |   40 +
 ...me-port-and-incompatible-protocol.out.yaml |  120 +
 ...s-with-same-port-http-tcp-protocol.in.yaml |   53 +
 ...-with-same-port-http-tcp-protocol.out.yaml |  208 ++
 ...s-with-same-port-http-udp-protocol.in.yaml |   53 +
 ...-with-same-port-http-udp-protocol.out.yaml |  207 ++
 ...rs-with-tcproutes-with-sectionname.in.yaml |   50 +
 ...s-with-tcproutes-with-sectionname.out.yaml |  188 ++
 ...with-tcproutes-without-sectionname.in.yaml |   48 +
 ...ith-tcproutes-without-sectionname.out.yaml |  184 ++
 ...rs-with-udproutes-with-sectionname.in.yaml |   50 +
 ...s-with-udproutes-with-sectionname.out.yaml |  186 ++
 ...with-udproutes-without-sectionname.in.yaml |   48 +
 ...ith-udproutes-without-sectionname.out.yaml |  182 ++
 .../grpcroute-with-empty-backends.in.yaml     |   31 +
 .../grpcroute-with-empty-backends.out.yaml    |  120 +
 .../grpcroute-with-header-match.in.yaml       |   35 +
 .../grpcroute-with-header-match.out.yaml      |  131 +
 ...oute-with-method-and-service-match.in.yaml |   39 +
 ...ute-with-method-and-service-match.out.yaml |  154 ++
 .../grpcroute-with-method-match.in.yaml       |   37 +
 .../grpcroute-with-method-match.out.yaml      |  152 ++
 ...route-with-request-header-modifier.in.yaml |   36 +
 ...oute-with-request-header-modifier.out.yaml |  132 +
 .../grpcroute-with-service-match.in.yaml      |   37 +
 .../grpcroute-with-service-match.out.yaml     |  152 ++
 ...ndtrafficpolicy-with-timeout-error.in.yaml |   54 +
 ...dtrafficpolicy-with-timeout-error.out.yaml |  169 ++
 ...-backendtrafficpolicy-with-timeout.in.yaml |  100 +
 ...backendtrafficpolicy-with-timeout.out.yaml |  329 +++
 ...eway-with-more-different-listeners.in.yaml |   82 +
 ...way-with-more-different-listeners.out.yaml |  590 +++++
 ...ing-to-gateway-with-more-listeners.in.yaml |   82 +
 ...ng-to-gateway-with-more-listeners.out.yaml |  541 ++++
 ...two-listeners-with-different-ports.in.yaml |   52 +
 ...wo-listeners-with-different-ports.out.yaml |  203 ++
 ...hing-to-gateway-with-two-listeners.in.yaml |   40 +
 ...ing-to-gateway-with-two-listeners.out.yaml |  187 ++
 .../httproute-attaching-to-gateway.in.yaml    |   32 +
 .../httproute-attaching-to-gateway.out.yaml   |  127 +
 ...ttaching-to-listener-matching-port.in.yaml |   34 +
 ...taching-to-listener-matching-port.out.yaml |  131 +
 ...ener-on-gateway-with-two-listeners.in.yaml |   41 +
 ...ner-on-gateway-with-two-listeners.out.yaml |  169 ++
 ...port-backendrefs-diff-address-type.in.yaml |   99 +
 ...ort-backendrefs-diff-address-type.out.yaml |  141 ++
 ...port-backendrefs-same-address-type.in.yaml |   99 +
 ...ort-backendrefs-same-address-type.out.yaml |  141 ++
 ...mport-backendref-fqdn-address-type.in.yaml |   66 +
 ...port-backendref-fqdn-address-type.out.yaml |  131 +
 ...port-backendref-mixed-address-type.in.yaml |   83 +
 ...ort-backendref-mixed-address-type.out.yaml |  133 +
 ...ener-with-serviceimport-backendref.in.yaml |   66 +
 ...ner-with-serviceimport-backendref.out.yaml |  131 +
 .../httproute-attaching-to-listener.in.yaml   |   33 +
 .../httproute-attaching-to-listener.out.yaml  |  129 +
 .../httproute-backend-request-timeout.in.yaml |   35 +
 ...httproute-backend-request-timeout.out.yaml |  134 +
 ...hing-to-listener-non-matching-port.in.yaml |   34 +
 ...ing-to-listener-non-matching-port.out.yaml |  110 +
 .../httproute-request-timeout.in.yaml         |   35 +
 .../httproute-request-timeout.out.yaml        |  134 +
 ...with-empty-backends-and-no-filters.in.yaml |   29 +
 ...ith-empty-backends-and-no-filters.out.yaml |  117 +
 ...h-multiple-backends-and-no-weights.in.yaml |   36 +
 ...-multiple-backends-and-no-weights.out.yaml |  143 ++
 ...with-multiple-backends-and-weights.in.yaml |   42 +
 ...ith-multiple-backends-and-weights.out.yaml |  149 ++
 ...ther-namespace-allowed-by-refgrant.in.yaml |   79 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  129 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   81 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  131 +
 .../httproute-with-empty-matches.in.yaml      |   31 +
 .../httproute-with-empty-matches.out.yaml     |  122 +
 ...ter-duplicate-add-multiple-filters.in.yaml |   52 +
 ...er-duplicate-add-multiple-filters.out.yaml |  157 ++
 ...-with-header-filter-duplicate-adds.in.yaml |   61 +
 ...with-header-filter-duplicate-adds.out.yaml |  173 ++
 ...-duplicate-remove-multiple-filters.in.yaml |   48 +
 ...duplicate-remove-multiple-filters.out.yaml |  147 ++
 ...th-header-filter-duplicate-removes.in.yaml |   42 +
 ...h-header-filter-duplicate-removes.out.yaml |  140 ++
 ...-header-filter-empty-header-values.in.yaml |   46 +
 ...header-filter-empty-header-values.out.yaml |  148 ++
 ...e-with-header-filter-empty-headers.in.yaml |   48 +
 ...-with-header-filter-empty-headers.out.yaml |  123 +
 ...with-header-filter-invalid-headers.in.yaml |   48 +
 ...ith-header-filter-invalid-headers.out.yaml |  124 +
 ...oute-with-header-filter-no-headers.in.yaml |   42 +
 ...ute-with-header-filter-no-headers.out.yaml |  135 +
 ...ith-header-filter-no-valid-headers.in.yaml |   42 +
 ...th-header-filter-no-valid-headers.out.yaml |  119 +
 ...ttproute-with-header-filter-remove.in.yaml |   43 +
 ...tproute-with-header-filter-remove.out.yaml |  143 ++
 ...-with-invalid-backend-ref-bad-port.in.yaml |   42 +
 ...with-invalid-backend-ref-bad-port.out.yaml |  121 +
 ...-invalid-backend-ref-invalid-group.in.yaml |   45 +
 ...invalid-backend-ref-invalid-group.out.yaml |  125 +
 ...h-invalid-backend-ref-invalid-kind.in.yaml |   35 +
 ...-invalid-backend-ref-invalid-kind.out.yaml |  122 +
 ...e-with-invalid-backend-ref-no-port.in.yaml |   41 +
 ...-with-invalid-backend-ref-no-port.out.yaml |  121 +
 ...alid-backend-ref-no-service.import.in.yaml |   35 +
 ...lid-backend-ref-no-service.import.out.yaml |  123 +
 ...ith-invalid-backend-ref-no-service.in.yaml |   33 +
 ...th-invalid-backend-ref-no-service.out.yaml |  121 +
 ...lid-backend-ref-unsupported-filter.in.yaml |   39 +
 ...id-backend-ref-unsupported-filter.out.yaml |  127 +
 ...alid-backendref-in-other-namespace.in.yaml |   44 +
 ...lid-backendref-in-other-namespace.out.yaml |  122 +
 .../httproute-with-invalid-regex.in.yaml      |   48 +
 .../httproute-with-invalid-regex.out.yaml     |  173 ++
 ...oute-with-mirror-filter-duplicates.in.yaml |   50 +
 ...ute-with-mirror-filter-duplicates.out.yaml |  162 ++
 ...proute-with-mirror-filter-multiple.in.yaml |   62 +
 ...route-with-mirror-filter-multiple.out.yaml |  186 ++
 ...with-mirror-filter-service-no-port.in.yaml |   42 +
 ...ith-mirror-filter-service-no-port.out.yaml |  139 ++
 ...th-mirror-filter-service-not-found.in.yaml |   43 +
 ...h-mirror-filter-service-not-found.out.yaml |  139 ++
 .../httproute-with-mirror-filter.in.yaml      |   43 +
 .../httproute-with-mirror-filter.out.yaml     |  148 ++
 ...-to-gateway-with-wildcard-hostname.in.yaml |   35 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  111 +
 ...ect-filter-full-path-replace-https.in.yaml |   41 +
 ...ct-filter-full-path-replace-https.out.yaml |  136 +
 ...oute-with-redirect-filter-hostname.in.yaml |   39 +
 ...ute-with-redirect-filter-hostname.out.yaml |  132 +
 ...edirect-filter-invalid-filter-type.in.yaml |   43 +
 ...direct-filter-invalid-filter-type.out.yaml |  118 +
 ...ith-redirect-filter-invalid-scheme.in.yaml |   38 +
 ...th-redirect-filter-invalid-scheme.out.yaml |  115 +
 ...ith-redirect-filter-invalid-status.in.yaml |   39 +
 ...th-redirect-filter-invalid-status.out.yaml |  114 +
 ...lter-prefix-replace-with-port-http.in.yaml |   42 +
 ...ter-prefix-replace-with-port-http.out.yaml |  137 +
 ...e-with-response-header-filter-adds.in.yaml |   57 +
 ...-with-response-header-filter-adds.out.yaml |  169 ++
 ...ter-duplicate-add-multiple-filters.in.yaml |   52 +
 ...er-duplicate-add-multiple-filters.out.yaml |  157 ++
 ...ponse-header-filter-duplicate-adds.in.yaml |   61 +
 ...onse-header-filter-duplicate-adds.out.yaml |  173 ++
 ...-duplicate-remove-multiple-filters.in.yaml |   48 +
 ...duplicate-remove-multiple-filters.out.yaml |  147 ++
 ...se-header-filter-duplicate-removes.in.yaml |   42 +
 ...e-header-filter-duplicate-removes.out.yaml |  140 ++
 ...-header-filter-empty-header-values.in.yaml |   46 +
 ...header-filter-empty-header-values.out.yaml |  148 ++
 ...sponse-header-filter-empty-headers.in.yaml |   48 +
 ...ponse-header-filter-empty-headers.out.yaml |  123 +
 ...onse-header-filter-invalid-headers.in.yaml |   48 +
 ...nse-header-filter-invalid-headers.out.yaml |  124 +
 ...-response-header-filter-no-headers.in.yaml |   42 +
 ...response-header-filter-no-headers.out.yaml |  135 +
 ...nse-header-filter-no-valid-headers.in.yaml |   42 +
 ...se-header-filter-no-valid-headers.out.yaml |  119 +
 ...with-response-header-filter-remove.in.yaml |   43 +
 ...ith-response-header-filter-remove.out.yaml |  143 ++
 ...-single-rule-with-exact-path-match.in.yaml |   33 +
 ...single-rule-with-exact-path-match.out.yaml |  128 +
 ...single-rule-with-http-method-match.in.yaml |   31 +
 ...ingle-rule-with-http-method-match.out.yaml |  126 +
 ...th-single-rule-with-multiple-rules.in.yaml |   63 +
 ...h-single-rule-with-multiple-rules.out.yaml |  134 +
 ...th-prefix-and-exact-header-matches.in.yaml |   37 +
 ...h-prefix-and-exact-header-matches.out.yaml |  139 ++
 ...me-invalid-backend-refs-no-service.in.yaml |   46 +
 ...e-invalid-backend-refs-no-service.out.yaml |  132 +
 ...-to-gateway-with-wildcard-hostname.in.yaml |   35 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  130 +
 ...-to-gateway-with-wildcard-hostname.in.yaml |   36 +
 ...to-gateway-with-wildcard-hostname.out.yaml |  150 ++
 ...rite-filter-full-path-replace-http.in.yaml |   42 +
 ...ite-filter-full-path-replace-http.out.yaml |  142 ++
 ...ite-filter-hostname-prefix-replace.in.yaml |   43 +
 ...te-filter-hostname-prefix-replace.out.yaml |  144 ++
 ...te-with-urlrewrite-filter-hostname.in.yaml |   40 +
 ...e-with-urlrewrite-filter-hostname.out.yaml |  138 +
 ...rewrite-filter-invalid-filter-type.in.yaml |   41 +
 ...ewrite-filter-invalid-filter-type.out.yaml |  138 +
 ...urlrewrite-filter-invalid-hostname.in.yaml |   43 +
 ...rlrewrite-filter-invalid-hostname.out.yaml |  122 +
 ...te-filter-invalid-multiple-filters.in.yaml |   48 +
 ...e-filter-invalid-multiple-filters.out.yaml |  124 +
 ...rlrewrite-filter-invalid-path-type.in.yaml |   43 +
 ...lrewrite-filter-invalid-path-type.out.yaml |  120 +
 ...ith-urlrewrite-filter-invalid-path.in.yaml |   43 +
 ...th-urlrewrite-filter-invalid-path.out.yaml |  119 +
 ...ith-urlrewrite-filter-missing-path.in.yaml |   41 +
 ...th-urlrewrite-filter-missing-path.out.yaml |  117 +
 ...rewrite-filter-prefix-replace-http.in.yaml |   42 +
 ...ewrite-filter-prefix-replace-http.out.yaml |  142 ++
 ...ing-to-gateway-with-unset-hostname.in.yaml |   34 +
 ...ng-to-gateway-with-unset-hostname.out.yaml |  129 +
 .../httproutes-with-multiple-matches.in.yaml  |  189 ++
 .../httproutes-with-multiple-matches.out.yaml |  436 ++++
 .../merge-invalid-multiple-gateways.in.yaml   |   34 +
 .../merge-invalid-multiple-gateways.out.yaml  |  147 ++
 ...ways-multiple-listeners-same-ports.in.yaml |   45 +
 ...ays-multiple-listeners-same-ports.out.yaml |  210 ++
 ...-multiple-gateways-multiple-routes.in.yaml |   81 +
 ...multiple-gateways-multiple-routes.out.yaml |  292 +++
 .../merge-valid-multiple-gateways.in.yaml     |   41 +
 .../merge-valid-multiple-gateways.out.yaml    |  174 ++
 ...ecuritypolicy-invalid-cross-ns-ref.in.yaml |   42 +
 ...curitypolicy-invalid-cross-ns-ref.out.yaml |  115 +
 ...tatus-for-unknown-gateway-or-route.in.yaml |   23 +
 ...atus-for-unknown-gateway-or-route.out.yaml |   31 +
 .../securitypolicy-override-replace.in.yaml   |  117 +
 .../securitypolicy-override-replace.out.yaml  |  338 +++
 .../securitypolicy-status-conditions.in.yaml  |  133 +
 .../securitypolicy-status-conditions.out.yaml |  436 ++++
 .../securitypolicy-with-basic-auth.in.yaml    |   58 +
 .../securitypolicy-with-basic-auth.out.yaml   |  166 ++
 .../testdata/securitypolicy-with-cors.in.yaml |  173 ++
 .../securitypolicy-with-cors.out.yaml         |  554 ++++
 ...h-extauth-invalid-no-matching-port.in.yaml |   65 +
 ...-extauth-invalid-no-matching-port.out.yaml |  167 ++
 ...olicy-with-extauth-invalid-no-port.in.yaml |   64 +
 ...licy-with-extauth-invalid-no-port.out.yaml |  167 ++
 ...extauth-invalid-no-reference-grant.in.yaml |   65 +
 ...xtauth-invalid-no-reference-grant.out.yaml |  168 ++
 ...cy-with-extauth-invalid-no-service.in.yaml |   56 +
 ...y-with-extauth-invalid-no-service.out.yaml |  167 ++
 ...with-extauth-with-backendtlspolicy.in.yaml |  231 ++
 ...ith-extauth-with-backendtlspolicy.out.yaml |  373 +++
 .../securitypolicy-with-extauth.in.yaml       |  165 ++
 .../securitypolicy-with-extauth.out.yaml      |  297 +++
 ...typolicy-with-jwt-and-invalid-oidc.in.yaml |  111 +
 ...ypolicy-with-jwt-and-invalid-oidc.out.yaml |  308 +++
 ...icy-with-jwt-with-custom-extractor.in.yaml |  126 +
 ...cy-with-jwt-with-custom-extractor.out.yaml |  382 +++
 .../testdata/securitypolicy-with-jwt.in.yaml  |  118 +
 .../testdata/securitypolicy-with-jwt.out.yaml |  366 +++
 ...itypolicy-with-oidc-invalid-issuer.in.yaml |   41 +
 ...typolicy-with-oidc-invalid-issuer.out.yaml |  108 +
 ...policy-with-oidc-invalid-secretref.in.yaml |  118 +
 ...olicy-with-oidc-invalid-secretref.out.yaml |  320 +++
 .../testdata/securitypolicy-with-oidc.in.yaml |  127 +
 .../securitypolicy-with-oidc.out.yaml         |  304 +++
 ...ateway-with-listener-tls-terminate.in.yaml |   46 +
 ...teway-with-listener-tls-terminate.out.yaml |  117 +
 .../gateway-api/testdata/tls/.gitignore       |    2 +
 .../testdata/tls/ecdsa-p256-cert.pem          |   11 +
 .../gateway-api/testdata/tls/ecdsa-p256.key   |    5 +
 .../testdata/tls/ecdsa-p384-cert.pem          |   12 +
 .../gateway-api/testdata/tls/ecdsa-p384.key   |    6 +
 .../gateway-api/testdata/tls/gen-certs.sh     |   31 +
 .../testdata/tls/invalid-key-type.key         |    3 +
 .../testdata/tls/malformed-cert.pem           |    3 +
 .../testdata/tls/malformed-ecdsa.key          |    3 +
 .../testdata/tls/malformed-encoding.pem       |    1 +
 .../testdata/tls/malformed-pkcs1.key          |    3 +
 .../testdata/tls/malformed-pkcs8.key          |    3 +
 .../gateway-api/testdata/tls/rsa-cert-san.pem |   19 +
 .../testdata/tls/rsa-cert-wildcard.pem        |   19 +
 .../gateway-api/testdata/tls/rsa-cert.pem     |   19 +
 .../testdata/tls/rsa-pkcs1-san.key            |   28 +
 .../testdata/tls/rsa-pkcs1-wildcard.key       |   28 +
 .../gateway-api/testdata/tls/rsa-pkcs1.key    |   28 +
 .../testdata/tls/rsa-pkcs8-san.key            |   28 +
 .../testdata/tls/rsa-pkcs8-wildcard.key       |   28 +
 .../gateway-api/testdata/tls/rsa-pkcs8.key    |   28 +
 .../tlsroute-attaching-to-gateway.in.yaml     |   32 +
 .../tlsroute-attaching-to-gateway.out.yaml    |  112 +
 .../testdata/tlsroute-multiple.in.yaml        |   48 +
 .../testdata/tlsroute-multiple.out.yaml       |  162 ++
 ...-attaching-to-gateway-with-no-mode.in.yaml |   29 +
 ...attaching-to-gateway-with-no-mode.out.yaml |   81 +
 ...ther-namespace-allowed-by-refgrant.in.yaml |   78 +
 ...her-namespace-allowed-by-refgrant.out.yaml |  113 +
 .../tlsroute-with-empty-hostname.in.yaml      |   31 +
 .../tlsroute-with-empty-hostname.out.yaml     |  111 +
 ...route-with-empty-listener-hostname.in.yaml |   33 +
 ...oute-with-empty-listener-hostname.out.yaml |  113 +
 ...ner-both-passthrough-and-cert-data.in.yaml |   44 +
 ...er-both-passthrough-and-cert-data.out.yaml |   86 +
 adapter/internal/operator/gateway-api/tls.go  |  149 ++
 .../internal/operator/gateway-api/tls_test.go |  236 ++
 .../operator/gateway-api/translator.go        |  292 +++
 .../gateway-api/translator/accesslog.go       |  277 ++
 .../gateway-api/translator/basicauth.go       |  149 ++
 .../gateway-api/translator/cluster.go         |  629 +++++
 .../operator/gateway-api/translator/cors.go   |  186 ++
 .../gateway-api/translator/extauth.go         |  300 +++
 .../operator/gateway-api/translator/fault.go  |  218 ++
 .../gateway-api/translator/httpfilters.go     |  243 ++
 .../gateway-api/translator/listener.go        |  691 +++++
 .../operator/gateway-api/translator/oidc.go   |  392 +++
 .../gateway-api/translator/proxy_protocol.go  |   70 +
 .../operator/gateway-api/translator/route.go  |  585 +++++
 .../gateway-api/translator/runner/runner.go   |  139 ++
 .../translator/runner/runner_test.go          |  199 ++
 .../gateway-api/translator/tcpkeepalive.go    |   82 +
 .../testdata/in/xds-ir/accesslog-invalid.yaml |   43 +
 .../testdata/in/xds-ir/accesslog.yaml         |   44 +
 .../testdata/in/xds-ir/basic-auth.yaml        |   22 +
 .../testdata/in/xds-ir/circuit-breaker.yaml   |   24 +
 .../testdata/in/xds-ir/client-timeout.yaml    |   22 +
 .../translator/testdata/in/xds-ir/cors.yaml   |   39 +
 .../translator/testdata/in/xds-ir/empty.yaml  |    0
 .../testdata/in/xds-ir/ext-auth.yaml          |   61 +
 .../testdata/in/xds-ir/fault-injection.yaml   |   83 +
 .../testdata/in/xds-ir/health-check.yaml      |  124 +
 .../in/xds-ir/http-route-direct-response.yaml |   22 +
 .../in/xds-ir/http-route-dns-cluster.yaml     |   26 +
 .../in/xds-ir/http-route-invalid.yaml         |   28 +
 .../testdata/in/xds-ir/http-route-mirror.yaml |   24 +
 .../xds-ir/http-route-multiple-matches.yaml   |   86 +
 .../xds-ir/http-route-multiple-mirrors.yaml   |   28 +
 .../in/xds-ir/http-route-partial-invalid.yaml |   46 +
 .../in/xds-ir/http-route-redirect.yaml        |   52 +
 .../testdata/in/xds-ir/http-route-regex.yaml  |   28 +
 .../in/xds-ir/http-route-request-headers.yaml |   38 +
 .../http-route-response-add-headers.yaml      |   35 +
 ...ttp-route-response-add-remove-headers.yaml |   38 +
 .../http-route-response-remove-headers.yaml   |   22 +
 ...tp-route-rewrite-root-path-url-prefix.yaml |   27 +
 .../http-route-rewrite-url-fullpath.yaml      |   24 +
 .../xds-ir/http-route-rewrite-url-host.yaml   |   28 +
 .../xds-ir/http-route-rewrite-url-prefix.yaml |   27 +
 .../in/xds-ir/http-route-timeout.yaml         |   47 +
 .../xds-ir/http-route-weighted-backend.yaml   |   31 +
 .../http-route-weighted-invalid-backend.yaml  |   21 +
 ...http-route-with-tls-system-truststore.yaml |   32 +
 ...p-route-with-tlsbundle-multiple-certs.yaml |   86 +
 .../in/xds-ir/http-route-with-tlsbundle.yaml  |   34 +
 .../testdata/in/xds-ir/http-route.yaml        |   28 +
 .../in/xds-ir/http1-preserve-case.yaml        |   40 +
 .../testdata/in/xds-ir/http1-trailers.yaml    |   20 +
 .../translator/testdata/in/xds-ir/http10.yaml |   21 +
 .../testdata/in/xds-ir/http2-route.yaml       |   30 +
 .../translator/testdata/in/xds-ir/http3.yaml  |   34 +
 .../jsonpatch-add-op-without-value.yaml       |   45 +
 .../in/xds-ir/jsonpatch-invalid-listener.yaml |   37 +
 .../in/xds-ir/jsonpatch-invalid-patch.yaml    |   26 +
 .../testdata/in/xds-ir/jsonpatch-invalid.yaml |   41 +
 .../in/xds-ir/jsonpatch-missing-resource.yaml |   26 +
 .../xds-ir/jsonpatch-move-op-with-value.yaml  |   48 +
 .../in/xds-ir/jwt-custom-extractor.yaml       |   36 +
 .../jwt-multi-route-multi-provider.yaml       |   72 +
 .../jwt-multi-route-single-provider.yaml      |   52 +
 .../testdata/in/xds-ir/jwt-ratelimit.yaml     |   72 +
 .../xds-ir/jwt-single-route-single-match.yaml |   28 +
 .../in/xds-ir/listener-proxy-protocol.yaml    |   32 +
 .../in/xds-ir/listener-tcp-keepalive.yaml     |   66 +
 .../testdata/in/xds-ir/load-balancer.yaml     |   75 +
 .../testdata/in/xds-ir/local-ratelimit.yaml   |   84 +
 .../in/xds-ir/metrics-virtual-host.yaml       |   21 +
 .../in/xds-ir/mixed-tls-jwt-authn.yaml        |   35 +
 ...ners-same-port-with-different-filters.yaml |  119 +
 .../xds-ir/multiple-listeners-same-port.yaml  |  116 +
 .../multiple-simple-tcp-route-same-port.yaml  |   56 +
 .../testdata/in/xds-ir/mutual-tls.yaml        |   34 +
 .../translator/testdata/in/xds-ir/oidc.yaml   |   58 +
 .../testdata/in/xds-ir/path-settings.yaml     |   18 +
 .../in/xds-ir/proxy-protocol-upstream.yaml    |   20 +
 .../in/xds-ir/retry-partial-invalid.yaml      |   54 +
 .../testdata/in/xds-ir/simple-tls.yaml        |   31 +
 .../in/xds-ir/suppress-envoy-headers.yaml     |   33 +
 .../testdata/in/xds-ir/tcp-route-complex.yaml |   18 +
 .../in/xds-ir/tcp-route-invalid-endpoint.yaml |   11 +
 .../testdata/in/xds-ir/tcp-route-invalid.yaml |   12 +
 .../testdata/in/xds-ir/tcp-route-simple.yaml  |   12 +
 .../in/xds-ir/tcp-route-tls-terminate.yaml    |   18 +
 .../in/xds-ir/tcp-route-weighted-backend.yaml |   29 +
 .../testdata/in/xds-ir/timeout.yaml           |   24 +
 .../in/xds-ir/tls-route-passthrough.yaml      |   30 +
 .../tls-with-ciphers-versions-alpn.yaml       |   50 +
 .../testdata/in/xds-ir/tracing-invalid.yaml   |   43 +
 .../testdata/in/xds-ir/tracing.yaml           |   43 +
 .../testdata/in/xds-ir/udp-route-invalid.yaml |   10 +
 .../testdata/in/xds-ir/udp-route.yaml         |   12 +
 .../in/xds-ir/upstream-tcpkeepalive.yaml      |   22 +
 .../out/xds-ir/accesslog.clusters.yaml        |   49 +
 .../out/xds-ir/accesslog.endpoints.yaml       |   12 +
 .../out/xds-ir/accesslog.listeners.yaml       |  143 ++
 .../testdata/out/xds-ir/accesslog.routes.yaml |   14 +
 .../out/xds-ir/basic-auth.clusters.yaml       |   17 +
 .../out/xds-ir/basic-auth.endpoints.yaml      |   12 +
 .../out/xds-ir/basic-auth.listeners.yaml      |   39 +
 .../out/xds-ir/basic-auth.routes.yaml         |   18 +
 .../out/xds-ir/circuit-breaker.clusters.yaml  |   27 +
 .../out/xds-ir/circuit-breaker.endpoints.yaml |   12 +
 .../out/xds-ir/circuit-breaker.listeners.yaml |   33 +
 .../out/xds-ir/circuit-breaker.routes.yaml    |   14 +
 .../out/xds-ir/client-timeout.clusters.yaml   |   17 +
 .../out/xds-ir/client-timeout.endpoints.yaml  |   12 +
 .../out/xds-ir/client-timeout.listeners.yaml  |   34 +
 .../out/xds-ir/client-timeout.routes.yaml     |   14 +
 .../testdata/out/xds-ir/cors.clusters.yaml    |   17 +
 .../testdata/out/xds-ir/cors.endpoints.yaml   |   12 +
 .../testdata/out/xds-ir/cors.listeners.yaml   |   36 +
 .../testdata/out/xds-ir/cors.routes.yaml      |   26 +
 .../testdata/out/xds-ir/empty.clusters.yaml   |    1 +
 .../testdata/out/xds-ir/empty.endpoints.yaml  |    1 +
 .../testdata/out/xds-ir/empty.listeners.yaml  |    1 +
 .../testdata/out/xds-ir/empty.routes.yaml     |    1 +
 .../out/xds-ir/ext-auth.clusters.yaml         |   73 +
 .../out/xds-ir/ext-auth.endpoints.yaml        |   48 +
 .../out/xds-ir/ext-auth.listeners.yaml        |   63 +
 .../testdata/out/xds-ir/ext-auth.routes.yaml  |   29 +
 .../out/xds-ir/fault-injection.clusters.yaml  |   85 +
 .../out/xds-ir/fault-injection.endpoints.yaml |   60 +
 .../out/xds-ir/fault-injection.listeners.yaml |   36 +
 .../out/xds-ir/fault-injection.routes.yaml    |   84 +
 .../out/xds-ir/health-check.clusters.yaml     |  141 ++
 .../out/xds-ir/health-check.endpoints.yaml    |   48 +
 .../out/xds-ir/health-check.listeners.yaml    |   33 +
 .../out/xds-ir/health-check.routes.yaml       |   35 +
 .../http-route-direct-response.clusters.yaml  |   17 +
 .../http-route-direct-response.endpoints.yaml |   12 +
 .../http-route-direct-response.listeners.yaml |   33 +
 .../http-route-direct-response.routes.yaml    |   14 +
 .../http-route-dns-cluster.clusters.yaml      |   33 +
 .../http-route-dns-cluster.endpoints.yaml     |    1 +
 .../http-route-dns-cluster.listeners.yaml     |   33 +
 .../xds-ir/http-route-dns-cluster.routes.yaml |   18 +
 .../xds-ir/http-route-mirror.clusters.yaml    |   17 +
 .../xds-ir/http-route-mirror.endpoints.yaml   |   12 +
 .../xds-ir/http-route-mirror.listeners.yaml   |   33 +
 .../out/xds-ir/http-route-mirror.routes.yaml  |   14 +
 .../http-route-multiple-matches.clusters.yaml |  119 +
 ...http-route-multiple-matches.endpoints.yaml |   84 +
 ...http-route-multiple-matches.listeners.yaml |   33 +
 .../http-route-multiple-matches.routes.yaml   |   80 +
 .../http-route-multiple-mirrors.clusters.yaml |   51 +
 ...http-route-multiple-mirrors.endpoints.yaml |   36 +
 ...http-route-multiple-mirrors.listeners.yaml |   33 +
 .../http-route-multiple-mirrors.routes.yaml   |   17 +
 .../http-route-partial-invalid.clusters.yaml  |   17 +
 .../http-route-partial-invalid.endpoints.yaml |   12 +
 .../http-route-partial-invalid.listeners.yaml |   33 +
 .../http-route-partial-invalid.routes.yaml    |   43 +
 .../xds-ir/http-route-redirect.clusters.yaml  |   17 +
 .../xds-ir/http-route-redirect.endpoints.yaml |   12 +
 .../xds-ir/http-route-redirect.listeners.yaml |   33 +
 .../xds-ir/http-route-redirect.routes.yaml    |   32 +
 .../out/xds-ir/http-route-regex.clusters.yaml |   17 +
 .../xds-ir/http-route-regex.endpoints.yaml    |   12 +
 .../xds-ir/http-route-regex.listeners.yaml    |   33 +
 .../out/xds-ir/http-route-regex.routes.yaml   |   25 +
 .../http-route-request-headers.clusters.yaml  |   17 +
 .../http-route-request-headers.endpoints.yaml |   12 +
 .../http-route-request-headers.listeners.yaml |   33 +
 .../http-route-request-headers.routes.yaml    |   36 +
 ...p-route-response-add-headers.clusters.yaml |   17 +
 ...-route-response-add-headers.endpoints.yaml |   12 +
 ...-route-response-add-headers.listeners.yaml |   33 +
 ...ttp-route-response-add-headers.routes.yaml |   33 +
 ...-response-add-remove-headers.clusters.yaml |   17 +
 ...response-add-remove-headers.endpoints.yaml |   12 +
 ...response-add-remove-headers.listeners.yaml |   33 +
 ...te-response-add-remove-headers.routes.yaml |   36 +
 ...oute-response-remove-headers.clusters.yaml |   17 +
 ...ute-response-remove-headers.endpoints.yaml |   12 +
 ...ute-response-remove-headers.listeners.yaml |   33 +
 ...-route-response-remove-headers.routes.yaml |   17 +
 ...rewrite-root-path-url-prefix.clusters.yaml |   17 +
 ...ewrite-root-path-url-prefix.endpoints.yaml |   12 +
 ...ewrite-root-path-url-prefix.listeners.yaml |   33 +
 ...e-rewrite-root-path-url-prefix.routes.yaml |   22 +
 ...p-route-rewrite-url-fullpath.clusters.yaml |   17 +
 ...-route-rewrite-url-fullpath.endpoints.yaml |   12 +
 ...-route-rewrite-url-fullpath.listeners.yaml |   33 +
 ...ttp-route-rewrite-url-fullpath.routes.yaml |   18 +
 .../http-route-rewrite-url-host.clusters.yaml |   17 +
 ...http-route-rewrite-url-host.endpoints.yaml |   12 +
 ...http-route-rewrite-url-host.listeners.yaml |   33 +
 .../http-route-rewrite-url-host.routes.yaml   |   21 +
 ...ttp-route-rewrite-url-prefix.clusters.yaml |   17 +
 ...tp-route-rewrite-url-prefix.endpoints.yaml |   12 +
 ...tp-route-rewrite-url-prefix.listeners.yaml |   33 +
 .../http-route-rewrite-url-prefix.routes.yaml |   19 +
 .../xds-ir/http-route-timeout.clusters.yaml   |   51 +
 .../xds-ir/http-route-timeout.endpoints.yaml  |   36 +
 .../xds-ir/http-route-timeout.listeners.yaml  |   33 +
 .../out/xds-ir/http-route-timeout.routes.yaml |   38 +
 .../http-route-weighted-backend.clusters.yaml |   17 +
 ...http-route-weighted-backend.endpoints.yaml |   42 +
 ...http-route-weighted-backend.listeners.yaml |   33 +
 .../http-route-weighted-backend.routes.yaml   |   14 +
 ...ute-weighted-invalid-backend.clusters.yaml |   17 +
 ...te-weighted-invalid-backend.endpoints.yaml |   12 +
 ...te-weighted-invalid-backend.listeners.yaml |   33 +
 ...route-weighted-invalid-backend.routes.yaml |   20 +
 ...oute-with-stripped-host-port.clusters.yaml |   13 +
 ...ute-with-stripped-host-port.listeners.yaml |   30 +
 ...e-with-tls-system-truststore.clusters.yaml |   30 +
 ...-with-tls-system-truststore.endpoints.yaml |   16 +
 ...-with-tls-system-truststore.listeners.yaml |   33 +
 ...ute-with-tls-system-truststore.routes.yaml |   14 +
 ...te-with-tls-system-truststore.secrets.yaml |    1 +
 ...ith-tlsbundle-multiple-certs.clusters.yaml |   94 +
 ...th-tlsbundle-multiple-certs.endpoints.yaml |   56 +
 ...th-tlsbundle-multiple-certs.listeners.yaml |   66 +
 ...-with-tlsbundle-multiple-certs.routes.yaml |   28 +
 ...with-tlsbundle-multiple-certs.secrets.yaml |   12 +
 .../http-route-with-tlsbundle.clusters.yaml   |   32 +
 .../http-route-with-tlsbundle.endpoints.yaml  |   16 +
 .../http-route-with-tlsbundle.listeners.yaml  |   33 +
 .../http-route-with-tlsbundle.routes.yaml     |   14 +
 .../http-route-with-tlsbundle.secrets.yaml    |    4 +
 .../out/xds-ir/http-route.clusters.yaml       |   17 +
 .../out/xds-ir/http-route.endpoints.yaml      |   12 +
 .../out/xds-ir/http-route.listeners.yaml      |   33 +
 .../out/xds-ir/http-route.routes.yaml         |   25 +
 .../xds-ir/http1-preserve-case.clusters.yaml  |   55 +
 .../xds-ir/http1-preserve-case.endpoints.yaml |   24 +
 .../xds-ir/http1-preserve-case.listeners.yaml |   79 +
 .../xds-ir/http1-preserve-case.routes.yaml    |   28 +
 .../out/xds-ir/http1-trailers.clusters.yaml   |   23 +
 .../out/xds-ir/http1-trailers.endpoints.yaml  |   12 +
 .../out/xds-ir/http1-trailers.listeners.yaml  |   35 +
 .../out/xds-ir/http1-trailers.routes.yaml     |   14 +
 .../testdata/out/xds-ir/http10.clusters.yaml  |   24 +
 .../testdata/out/xds-ir/http10.endpoints.yaml |   12 +
 .../testdata/out/xds-ir/http10.listeners.yaml |   36 +
 .../testdata/out/xds-ir/http10.routes.yaml    |   14 +
 .../out/xds-ir/http2-route.clusters.yaml      |   22 +
 .../out/xds-ir/http2-route.endpoints.yaml     |   12 +
 .../out/xds-ir/http2-route.listeners.yaml     |   41 +
 .../out/xds-ir/http2-route.routes.yaml        |   22 +
 .../testdata/out/xds-ir/http3.clusters.yaml   |   17 +
 .../testdata/out/xds-ir/http3.endpoints.yaml  |   12 +
 .../testdata/out/xds-ir/http3.listeners.yaml  |   99 +
 .../testdata/out/xds-ir/http3.routes.yaml     |   19 +
 .../testdata/out/xds-ir/http3.secrets.yaml    |    6 +
 ...onpatch-add-op-without-value.clusters.yaml |   17 +
 ...npatch-add-op-without-value.endpoints.yaml |   12 +
 ...d-op-without-value.envoypatchpolicies.yaml |    9 +
 ...npatch-add-op-without-value.listeners.yaml |   50 +
 ...jsonpatch-add-op-without-value.routes.yaml |   18 +
 .../jsonpatch-invalid-patch.clusters.yaml     |   17 +
 .../jsonpatch-invalid-patch.endpoints.yaml    |   12 +
 .../jsonpatch-invalid-patch.listeners.yaml    |   33 +
 .../jsonpatch-invalid-patch.routes.yaml       |   18 +
 .../jsonpatch-missing-resource.clusters.yaml  |   17 +
 .../jsonpatch-missing-resource.endpoints.yaml |   12 +
 ...h-missing-resource.envoypatchpolicies.yaml |   10 +
 .../jsonpatch-missing-resource.listeners.yaml |   33 +
 .../jsonpatch-missing-resource.routes.yaml    |   18 +
 ...jsonpatch-move-op-with-value.clusters.yaml |   17 +
 ...sonpatch-move-op-with-value.endpoints.yaml |   12 +
 ...move-op-with-value.envoypatchpolicies.yaml |    9 +
 ...sonpatch-move-op-with-value.listeners.yaml |   50 +
 .../jsonpatch-move-op-with-value.routes.yaml  |   18 +
 .../out/xds-ir/jsonpatch.clusters.yaml        |   17 +
 .../out/xds-ir/jsonpatch.endpoints.yaml       |   12 +
 .../xds-ir/jsonpatch.envoypatchpolicies.yaml  |    9 +
 .../out/xds-ir/jsonpatch.listeners.yaml       |   50 +
 .../testdata/out/xds-ir/jsonpatch.routes.yaml |   18 +
 .../out/xds-ir/jsonpatch.secrets.yaml         |   16 +
 .../listener-proxy-protocol.clusters.yaml     |   17 +
 .../listener-proxy-protocol.endpoints.yaml    |   12 +
 .../listener-proxy-protocol.listeners.yaml    |   60 +
 .../listener-proxy-protocol.routes.yaml       |   14 +
 .../listener-tcp-keepalive.clusters.yaml      |   68 +
 .../listener-tcp-keepalive.endpoints.yaml     |   48 +
 .../listener-tcp-keepalive.listeners.yaml     |  137 +
 .../xds-ir/listener-tcp-keepalive.routes.yaml |   28 +
 .../out/xds-ir/load-balancer.clusters.yaml    |  106 +
 .../out/xds-ir/load-balancer.endpoints.yaml   |   72 +
 .../out/xds-ir/load-balancer.listeners.yaml   |   33 +
 .../out/xds-ir/load-balancer.routes.yaml      |   52 +
 .../xds-ir/metrics-virtual-host.clusters.yaml |   17 +
 .../metrics-virtual-host.endpoints.yaml       |   12 +
 .../metrics-virtual-host.listeners.yaml       |   33 +
 .../xds-ir/metrics-virtual-host.routes.yaml   |   20 +
 .../xds-ir/mixed-tls-jwt-authn.clusters.yaml  |   45 +
 .../xds-ir/mixed-tls-jwt-authn.endpoints.yaml |   11 +
 .../xds-ir/mixed-tls-jwt-authn.listeners.yaml |   67 +
 .../xds-ir/mixed-tls-jwt-authn.routes.yaml    |   16 +
 .../xds-ir/mixed-tls-jwt-authn.secrets.yaml   |    6 +
 ...-port-with-different-filters.clusters.yaml |  104 +
 ...port-with-different-filters.endpoints.yaml |   48 +
 ...port-with-different-filters.listeners.yaml |  156 ++
 ...me-port-with-different-filters.routes.yaml |   54 +
 ...multiple-listeners-same-port.clusters.yaml |  102 +
 ...ultiple-listeners-same-port.endpoints.yaml |   72 +
 ...ultiple-listeners-same-port.listeners.yaml |  138 +
 .../multiple-listeners-same-port.routes.yaml  |   53 +
 .../multiple-listeners-same-port.secrets.yaml |   12 +
 ...e-simple-tcp-route-same-port.clusters.yaml |   85 +
 ...-simple-tcp-route-same-port.endpoints.yaml |   90 +
 ...-simple-tcp-route-same-port.listeners.yaml |   38 +
 ...ple-simple-tcp-route-same-port.routes.yaml |    1 +
 .../out/xds-ir/mutual-tls.clusters.yaml       |   17 +
 .../out/xds-ir/mutual-tls.endpoints.yaml      |   12 +
 .../out/xds-ir/mutual-tls.listeners.yaml      |   56 +
 .../out/xds-ir/mutual-tls.routes.yaml         |   14 +
 .../out/xds-ir/mutual-tls.secrets.yaml        |   16 +
 .../testdata/out/xds-ir/oidc.clusters.yaml    |  106 +
 .../testdata/out/xds-ir/oidc.endpoints.yaml   |   24 +
 .../testdata/out/xds-ir/oidc.listeners.yaml   |  115 +
 .../testdata/out/xds-ir/oidc.routes.yaml      |   29 +
 .../out/xds-ir/path-settings.clusters.yaml    |   17 +
 .../out/xds-ir/path-settings.endpoints.yaml   |   12 +
 .../out/xds-ir/path-settings.listeners.yaml   |   32 +
 .../out/xds-ir/path-settings.routes.yaml      |   14 +
 .../proxy-protocol-upstream.clusters.yaml     |   27 +
 .../proxy-protocol-upstream.endpoints.yaml    |   12 +
 .../proxy-protocol-upstream.listeners.yaml    |   33 +
 .../proxy-protocol-upstream.routes.yaml       |   14 +
 .../retry-partial-invalid.clusters.yaml       |   17 +
 .../retry-partial-invalid.endpoints.yaml      |   12 +
 .../retry-partial-invalid.listeners.yaml      |   33 +
 .../xds-ir/retry-partial-invalid.routes.yaml  |   53 +
 .../out/xds-ir/simple-tls.clusters.yaml       |   17 +
 .../out/xds-ir/simple-tls.endpoints.yaml      |   12 +
 .../out/xds-ir/simple-tls.listeners.yaml      |   50 +
 .../out/xds-ir/simple-tls.routes.yaml         |   14 +
 .../out/xds-ir/simple-tls.secrets.yaml        |   12 +
 .../suppress-envoy-headers.clusters.yaml      |   17 +
 .../suppress-envoy-headers.endpoints.yaml     |   12 +
 .../suppress-envoy-headers.listeners.yaml     |   56 +
 .../xds-ir/suppress-envoy-headers.routes.yaml |   14 +
 .../xds-ir/tcp-route-complex.clusters.yaml    |   17 +
 .../xds-ir/tcp-route-complex.endpoints.yaml   |   18 +
 .../xds-ir/tcp-route-complex.listeners.yaml   |   23 +
 .../out/xds-ir/tcp-route-complex.routes.yaml  |    1 +
 .../out/xds-ir/tcp-route-simple.clusters.yaml |   17 +
 .../xds-ir/tcp-route-simple.endpoints.yaml    |   18 +
 .../xds-ir/tcp-route-simple.listeners.yaml    |   14 +
 .../out/xds-ir/tcp-route-simple.routes.yaml   |    1 +
 .../tcp-route-tls-terminate.clusters.yaml     |   17 +
 .../tcp-route-tls-terminate.endpoints.yaml    |   18 +
 .../tcp-route-tls-terminate.listeners.yaml    |   27 +
 .../tcp-route-tls-terminate.routes.yaml       |    1 +
 .../tcp-route-weighted-backend.clusters.yaml  |   17 +
 .../tcp-route-weighted-backend.endpoints.yaml |   42 +
 .../tcp-route-weighted-backend.listeners.yaml |   23 +
 .../tcp-route-weighted-backend.routes.yaml    |    1 +
 .../testdata/out/xds-ir/timeout.clusters.yaml |   25 +
 .../out/xds-ir/timeout.endpoints.yaml         |   12 +
 .../out/xds-ir/timeout.listeners.yaml         |   33 +
 .../testdata/out/xds-ir/timeout.routes.yaml   |   14 +
 .../tls-route-passthrough.clusters.yaml       |   44 +
 .../tls-route-passthrough.endpoints.yaml      |   18 +
 .../tls-route-passthrough.listeners.yaml      |   42 +
 .../xds-ir/tls-route-passthrough.routes.yaml  |    1 +
 ...s-with-ciphers-versions-alpn.clusters.yaml |   17 +
 ...-with-ciphers-versions-alpn.endpoints.yaml |   12 +
 ...-with-ciphers-versions-alpn.listeners.yaml |   77 +
 ...tls-with-ciphers-versions-alpn.routes.yaml |   14 +
 .../testdata/out/xds-ir/tracing.clusters.yaml |   49 +
 .../out/xds-ir/tracing.endpoints.yaml         |   12 +
 .../out/xds-ir/tracing.listeners.yaml         |   62 +
 .../testdata/out/xds-ir/tracing.routes.yaml   |   14 +
 .../out/xds-ir/udp-route.clusters.yaml        |   17 +
 .../out/xds-ir/udp-route.endpoints.yaml       |   18 +
 .../out/xds-ir/udp-route.listeners.yaml       |   18 +
 .../testdata/out/xds-ir/udp-route.routes.yaml |    1 +
 .../upstream-tcpkeepalive.clusters.yaml       |   22 +
 .../upstream-tcpkeepalive.endpoints.yaml      |   12 +
 .../upstream-tcpkeepalive.listeners.yaml      |   33 +
 .../xds-ir/upstream-tcpkeepalive.routes.yaml  |   14 +
 .../gateway-api/translator/tracing.go         |  160 ++
 .../gateway-api/translator/translator.go      |  744 ++++++
 .../gateway-api/translator/translator_test.go |  556 +++++
 .../operator/gateway-api/translator/utils.go  |  135 +
 .../operator/gateway-api/types/tls_types.go   |  145 ++
 .../v1alpha1/accesslogging_types.go           |  136 +
 .../v1alpha1/envoyproxy_helpers.go            |  150 ++
 .../v1alpha1/envoyproxy_metric_types.go       |   88 +
 .../gateway-api/v1alpha1/envoyproxy_types.go  |  278 +++
 .../gateway-api/v1alpha1/groupversion_info.go |   42 +
 .../gateway-api/v1alpha1/keepalive_types.go   |   50 +
 .../v1alpha1/kubernetes_helpers.go            |  216 ++
 .../gateway-api/v1alpha1/retry_types.go       |  129 +
 .../gateway-api/v1alpha1/shared_types.go      |  447 ++++
 .../gateway-api/v1alpha1/timeout_types.go     |   80 +
 .../gateway-api/v1alpha1/tls_types.go         |  149 ++
 .../gateway-api/v1alpha1/tracing_types.go     |  125 +
 .../v1alpha1/zz_generated.deepcopy.go         | 1159 +++++++++
 .../internal/operator/gateway-api/validate.go |  916 +++++++
 .../operator/gateway-api/version/version.go   |   97 +
 .../gateway-api/xds/cache/snapshotcache.go    |  333 +++
 .../gateway-api/xds/filters/wellknown.go      |   64 +
 .../operator/gateway-api/xds/runner/runner.go |  187 ++
 .../gateway-api/xds/runner/runner_test.go     |  201 ++
 .../operator/gateway-api/xds/utils/utils.go   |   66 +
 .../gateway-api/zz_generated.deepcopy.go      |  213 ++
 .../operator/infrastructure/runner/runner.go  |  103 +
 adapter/internal/operator/message/types.go    |  106 +
 .../internal/operator/message/watchutil.go    |   71 +
 .../operator/message/watchutil_test.go        |   79 +
 .../provider-resources/runner/runner.go       |  249 ++
 .../provider/runner/provider_runner.go        |   69 +
 .../internal/operator/status/conditions.go    |  183 ++
 adapter/internal/operator/status/gateway.go   |  108 +
 .../internal/operator/status/gatewayclass.go  |   42 +
 adapter/internal/operator/status/status.go    |    3 +-
 .../synchronizer/zz_generated.deepcopy.go     |   13 +-
 .../internal/types/resourceversiontable.go    |  196 ++
 .../types/resourceversiontable_test.go        |  913 +++++++
 adapter/pkg/utils/file/file.go                |   44 +
 adapter/pkg/utils/misc/misc.go                |   73 +
 adapter/pkg/utils/misc/misc_test.go           |   50 +
 adapter/pkg/utils/protocov/protocov.go        |   55 +
 adapter/pkg/utils/regex/regex.go              |   36 +
 adapter/pkg/utils/regex/regex_test.go         |   51 +
 adapter/pkg/utils/stringutils/string_utils.go |   13 +
 .../utils/stringutils/string_utils_test.go    |   40 +
 adapter/revive.toml                           |    2 +-
 gateway/enforcer/Dockerfile                   |    2 +-
 helm-charts/Chart.lock                        |    6 +-
 helm-charts/Chart.yaml                        |    2 +-
 .../certificates/envoy-certificate.yaml       |   43 +
 .../adapter/adapter-deployment.yaml           |   10 +-
 .../adapter-grpc-probe-script-conf.yaml       |    2 +-
 .../gateway-runtime-autoscaller.yaml          |   50 -
 .../gateway-runtime/gateway-service.yaml      |   41 -
 .../gateway-components/log-conf.yaml          |    2 +
 .../serviceAccount/apk-cluster-role.yaml      |   15 +-
 979 files changed, 98320 insertions(+), 148 deletions(-)
 create mode 100644 adapter/internal/operator/gateway-api/address.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
 create mode 100644 adapter/internal/operator/gateway-api/contexts.go
 create mode 100644 adapter/internal/operator/gateway-api/crypto/certgen.go
 create mode 100644 adapter/internal/operator/gateway-api/crypto/certgen_test.go
 create mode 100644 adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
 create mode 100644 adapter/internal/operator/gateway-api/filters.go
 create mode 100644 adapter/internal/operator/gateway-api/helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/helpers_v1alpha2.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
 create mode 100644 adapter/internal/operator/gateway-api/infrastructure/manager.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/infra.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/infra_test.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/protocol.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/xds.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/xds_test.go
 create mode 100644 adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/gateway-api/listener.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/status.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/store.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
 create mode 100644 adapter/internal/operator/gateway-api/provider/scheme.go
 create mode 100644 adapter/internal/operator/gateway-api/resource.go
 create mode 100644 adapter/internal/operator/gateway-api/route.go
 create mode 100644 adapter/internal/operator/gateway-api/secrets.go
 create mode 100644 adapter/internal/operator/gateway-api/secrets_test.go
 create mode 100644 adapter/internal/operator/gateway-api/sort.go
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
 create mode 100755 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/.gitignore
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
 create mode 100755 adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
 create mode 100644 adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
 create mode 100644 adapter/internal/operator/gateway-api/tls.go
 create mode 100644 adapter/internal/operator/gateway-api/tls_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/accesslog.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/basicauth.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/cluster.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/cors.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/extauth.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/fault.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/httpfilters.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/listener.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/oidc.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/proxy_protocol.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/route.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/runner/runner.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/runner/runner_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
 create mode 100755 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
 create mode 100644 adapter/internal/operator/gateway-api/translator/tracing.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/translator.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/translator_test.go
 create mode 100644 adapter/internal/operator/gateway-api/translator/utils.go
 create mode 100644 adapter/internal/operator/gateway-api/types/tls_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
 create mode 100644 adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/gateway-api/validate.go
 create mode 100644 adapter/internal/operator/gateway-api/version/version.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/filters/wellknown.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/runner/runner.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/runner/runner_test.go
 create mode 100644 adapter/internal/operator/gateway-api/xds/utils/utils.go
 create mode 100644 adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
 create mode 100644 adapter/internal/operator/infrastructure/runner/runner.go
 create mode 100644 adapter/internal/operator/message/types.go
 create mode 100644 adapter/internal/operator/message/watchutil.go
 create mode 100644 adapter/internal/operator/message/watchutil_test.go
 create mode 100644 adapter/internal/operator/provider-resources/runner/runner.go
 create mode 100644 adapter/internal/operator/provider/runner/provider_runner.go
 create mode 100644 adapter/internal/operator/status/conditions.go
 create mode 100644 adapter/internal/operator/status/gateway.go
 create mode 100644 adapter/internal/operator/status/gatewayclass.go
 create mode 100644 adapter/internal/types/resourceversiontable.go
 create mode 100644 adapter/internal/types/resourceversiontable_test.go
 create mode 100644 adapter/pkg/utils/file/file.go
 create mode 100644 adapter/pkg/utils/misc/misc.go
 create mode 100644 adapter/pkg/utils/misc/misc_test.go
 create mode 100644 adapter/pkg/utils/protocov/protocov.go
 create mode 100644 adapter/pkg/utils/regex/regex.go
 create mode 100644 adapter/pkg/utils/regex/regex_test.go
 create mode 100644 helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
 delete mode 100644 helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
 delete mode 100644 helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index ac8691917..51bb47424 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -31,6 +31,7 @@ var defaultConfig = &Config{
 		Operator: operator{
 			Namespaces: nil,
 		},
+		Namespace:   "apk",
 		Environment: "Default",
 		Metrics: Metrics{
 			Enabled: false,
@@ -48,6 +49,7 @@ var defaultConfig = &Config{
 		},
 	},
 	Envoy: envoy{
+		Namespace:         "apk",
 		ListenerCodecType: "AUTO",
 		// todo(amali) move connect timeout to crd
 		ClusterTimeoutInSeconds:          20,
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 7b6c81740..329482ad9 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -93,6 +93,8 @@ type adapter struct {
 	Operator operator
 	// Environment of the Adapter
 	Environment string
+	// Namespace of the Adapter
+	Namespace string
 	// Metric represents configurations to expose/export go metrics
 	Metrics Metrics
 	// ControlPlane represents the connection configuration of ControlPlane
@@ -101,7 +103,8 @@ type adapter struct {
 
 // Envoy Listener Component related configurations.
 type envoy struct {
-
+	// Namespace of the envoyproxy gateway
+	Namespace string
 	// ListenerCodecType Default to AUTO where both http1 and http2 connections are handled
 	// It can be specifically set to either HTTP1 or HTTP2
 	ListenerCodecType string
diff --git a/adapter/go.mod b/adapter/go.mod
index bf720480f..89a85376c 100644
--- a/adapter/go.mod
+++ b/adapter/go.mod
@@ -3,24 +3,32 @@ module github.com/wso2/apk/adapter
 go 1.22
 
 require (
+	github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b
 	github.com/envoyproxy/go-control-plane v0.13.0
+	github.com/evanphx/json-patch v5.7.0+incompatible
 	github.com/fsnotify/fsnotify v1.7.0
 	github.com/golang/protobuf v1.5.4
+	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
 	github.com/onsi/ginkgo/v2 v2.14.0
 	github.com/onsi/gomega v1.30.0
 	github.com/pelletier/go-toml v1.9.5
-	github.com/prometheus/client_golang v1.18.0
-	github.com/sirupsen/logrus v1.9.0
+	github.com/prometheus/client_golang v1.19.0
+	github.com/sirupsen/logrus v1.9.3
+	github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7
 	github.com/wso2/apk/common-go-libs v0.0.0-20231208100153-24bee7b4bd81
+	go.opentelemetry.io/proto/otlp v1.0.0
 	golang.org/x/exp v0.0.0-20231206192017-f3f8817b8deb
 	google.golang.org/grpc v1.65.0
 	google.golang.org/protobuf v1.34.1
 	gopkg.in/yaml.v2 v2.4.0
 	k8s.io/api v0.29.2
+	k8s.io/apiextensions-apiserver v0.29.2
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e
 	sigs.k8s.io/controller-runtime v0.17.2
+	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
@@ -29,11 +37,10 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
@@ -44,7 +51,6 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
@@ -52,7 +58,6 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -61,7 +66,7 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
 	github.com/prometheus/client_model v0.6.0 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/common v0.48.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/shirou/gopsutil/v3 v3.24.2 // indirect
 	github.com/shoenig/go-m1cpu v0.1.6 // indirect
@@ -77,20 +82,17 @@ require (
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.1 // indirect
+	golang.org/x/tools v0.17.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.29.2 // indirect
 	k8s.io/component-base v0.29.2 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20231010175941-2dd684a91f00 // indirect
-	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
 )
 
 replace github.com/wso2/apk/adapter => ../adapter
@@ -100,7 +102,7 @@ replace github.com/wso2/apk/common-go-libs => ../common-go-libs
 require (
 	github.com/ghodss/yaml v1.0.0
 	github.com/stretchr/testify v1.9.0
-	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/sys v0.20.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	sigs.k8s.io/gateway-api v1.0.0
 )
diff --git a/adapter/go.sum b/adapter/go.sum
index 5eaa7328c..889f4c2b8 100644
--- a/adapter/go.sum
+++ b/adapter/go.sum
@@ -19,6 +19,8 @@ github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMn
 github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b h1:ga8SEFjZ60pxLcmhnThWgvH2wg8376yUJmPhEH4H3kw=
 github.com/cncf/xds/go v0.0.0-20240423153145-555b57ec207b/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/datawire/dlib v1.3.0 h1:KkmyXU1kwm3oPBk1ypR70YbcOlEXWzEbx5RE0iRXTGk=
+github.com/datawire/dlib v1.3.0/go.mod h1:NiGDmetmbkBvtznpWSx6C0vA0s0LK9aHna3LJDqjruk=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
@@ -33,8 +35,8 @@ github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
 github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
-github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
@@ -94,8 +96,6 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
 github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -118,12 +118,12 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
+github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
@@ -137,8 +137,8 @@ github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFt
 github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg9SUEw2VQ=
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -153,6 +153,10 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/telepresenceio/telepresence/rpc/v2 v2.6.8 h1:q5V85LBT9bA/c4YPa/kMvJGyKZDgBPJTftlAMqJx7j4=
+github.com/telepresenceio/telepresence/rpc/v2 v2.6.8/go.mod h1:VlgfRoXaW6Tl8IZbHmMWhITne8HY09/wOFtABHGj3ic=
+github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7 h1:GMw3nEaOVyi+tNiGko5kAeRtoiEIpXNHmISyZ7fpw14=
+github.com/telepresenceio/watchable v0.0.0-20220726211108-9bb86f92afa7/go.mod h1:ihJ97e2gsd8GuzFF/I3B1qcik3XZLpXjumQifXi8Slg=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -163,6 +167,8 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
 github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/proto/otlp v1.0.0 h1:T0TX0tmXU8a3CbNXzEKGeU5mIVOdf0oykP+u2lIVU/I=
+go.opentelemetry.io/proto/otlp v1.0.0/go.mod h1:Sy6pihPLfYHkr3NkUbEhGHFhINUSI/v80hjKIs5JXpM=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
@@ -212,8 +218,8 @@ golang.org/x/tools v0.0.0-20190125232054-d66bd3c5d5a6/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
-golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 39f9c9be2..4b696d5e9 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -26,7 +26,12 @@ import (
 	xdsv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
 	enforcerCallbacks "github.com/wso2/apk/adapter/internal/discovery/xds/enforcercallbacks"
 	routercb "github.com/wso2/apk/adapter/internal/discovery/xds/routercallbacks"
-	"github.com/wso2/apk/adapter/internal/operator"
+	xdstranslatorrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/translator/runner"
+	xdsserverrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/runner"
+	infrarunner "github.com/wso2/apk/adapter/internal/operator/infrastructure/runner"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/provider-resources/runner"
+	providerrunner "github.com/wso2/apk/adapter/internal/operator/provider/runner"
 	apiservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/api"
 	configservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/config"
 	subscriptionservice "github.com/wso2/apk/adapter/pkg/discovery/api/wso2/discovery/service/subscription"
@@ -50,6 +55,7 @@ import (
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/keepalive"
+	ctrl "sigs.k8s.io/controller-runtime"
 )
 
 var (
@@ -70,7 +76,7 @@ const (
 func init() {
 	flag.BoolVar(&debug, "debug", true, "Use debug logging")
 	flag.BoolVar(&onlyLogging, "onlyLogging", false, "Only demo AccessLogging Service")
-	flag.UintVar(&port, "port", 18000, "Management server port")
+	flag.UintVar(&port, "port", 18001, "Management server port")
 	flag.UintVar(&alsPort, "als", 18090, "Accesslog server port")
 	flag.StringVar(&mode, "ads", ads, "Management server type (ads, xds, rest)")
 }
@@ -132,6 +138,72 @@ func runManagementServer(conf *config.Config, server xdsv3.Server, enforcerServe
 
 }
 
+func SetupRunners(conf *config.Config) {
+	ctx := ctrl.SetupSignalHandler()
+	// start the operator
+	pResources := new(message.ProviderResources)
+	// Start the Provider Service
+	// It fetches the resources from the configured provider type
+	// and publishes it
+	// It also subscribes to status resources and once it receives
+	// a status resource back, it writes it out.
+	providerRunner := providerrunner.New(&providerrunner.Config{
+		ProviderResources: pResources,
+	})
+	if err := providerRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting provider service", err)
+	}
+
+	xdsIR := new(message.XdsIR)
+	infraIR := new(message.InfraIR)
+	// Start the GatewayAPI Translator Runner
+	// It subscribes to the provider resources, translates it to xDS IR
+	// and infra IR resources and publishes them.
+	gwRunner := runner.New(&runner.Config{
+		ProviderResources: pResources,
+		XdsIR:             xdsIR,
+		InfraIR:           infraIR,
+	})
+	if err := gwRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting translation service", err)
+	}
+
+	xds := new(message.Xds)
+	// Start the Xds Translator Service
+	// It subscribes to the xdsIR, translates it into xds Resources and publishes it.
+	xdsTranslatorRunner := xdstranslatorrunner.New(&xdstranslatorrunner.Config{
+		// Server:            *cfg,
+		XdsIR: xdsIR,
+		Xds:   xds,
+		// ExtensionManager:  extMgr,
+		ProviderResources: pResources,
+	})
+	if err := xdsTranslatorRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting xds translator service", err)
+	}
+
+	// Start the Infra Manager Runner
+	// It subscribes to the infraIR, translates it into Envoy Proxy infrastructure
+	// resources such as K8s deployment and services.
+	infraRunner := infrarunner.New(&infrarunner.Config{
+		InfraIR: infraIR,
+	})
+	if err := infraRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting infrastructure service", err)
+	}
+
+	// Start the xDS Server
+	// It subscribes to the xds Resources and configures the remote Envoy Proxy
+	// via the xDS Protocol.
+	xdsServerRunner := xdsserverrunner.New(&xdsserverrunner.Config{
+		// Server: *cfg,
+		Xds: xds,
+	})
+	if err := xdsServerRunner.Start(ctx); err != nil {
+		logger.LoggerAPKOperator.Error("Error while starting xds service", err)
+	}
+}
+
 // Run starts the XDS server and Rest API server.
 func Run(conf *config.Config) {
 	sig := make(chan os.Signal, 2)
@@ -180,7 +252,8 @@ func Run(conf *config.Config) {
 	// Set enforcer startup configs
 	xds.UpdateEnforcerConfig(conf)
 
-	go operator.InitOperator(conf.Adapter.Metrics)
+	// go operator.InitOperator(conf.Adapter.Metrics)
+	SetupRunners(conf)
 
 OUTER:
 	for {
diff --git a/adapter/internal/oasparser/envoyconf/constants.go b/adapter/internal/oasparser/envoyconf/constants.go
index 04a92f34a..621337699 100644
--- a/adapter/internal/oasparser/envoyconf/constants.go
+++ b/adapter/internal/oasparser/envoyconf/constants.go
@@ -22,7 +22,6 @@ const (
 	accessLoggerClusterName string = "access-logger"
 	grpcAccessLogLogName    string = "apk_access_logs"
 	tracingClusterName      string = "wso2_apk_trace"
-	extAuthzHTTPCluster     string = "ext_authz_http_cluster"
 	rateLimitClusterName    string = "ratelimit"
 )
 
diff --git a/adapter/internal/operator/constants/constants.go b/adapter/internal/operator/constants/constants.go
index 8e0927e66..5b11dba25 100644
--- a/adapter/internal/operator/constants/constants.go
+++ b/adapter/internal/operator/constants/constants.go
@@ -21,6 +21,7 @@ package constants
 const (
 	APIController          string = "APIController"
 	GatewayController      string = "GatewayController"
+	GatewayControllerNew   string = "GatewayControllerNew"
 	ApplicationController  string = "ApplicationController"
 	SubscriptionController string = "SubscriptionController"
 	TokenIssuerController  string = "TokenIssuerController"
@@ -39,8 +40,10 @@ const (
 	OperatorPodNamespaceDefaultValue string = "default"
 )
 
+// todo(amali) move to translators
 // CRD Kinds
 const (
+	GroupName          = "dp.wso2.com"
 	KindAuthentication = "Authentication"
 	KindAPI            = "API"
 	KindService        = "Service"
diff --git a/adapter/internal/operator/controllers/dp/tokenissuer_controller.go b/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
index 7f46e52ef..75517b4bd 100644
--- a/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
+++ b/adapter/internal/operator/controllers/dp/tokenissuer_controller.go
@@ -30,6 +30,8 @@ import (
 	"github.com/wso2/apk/adapter/pkg/logging"
 	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -38,10 +40,8 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/handler"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/predicate"
-	"sigs.k8s.io/controller-runtime/pkg/source"
-	corev1 "k8s.io/api/core/v1"
 	"sigs.k8s.io/controller-runtime/pkg/reconcile"
-	"k8s.io/apimachinery/pkg/fields"
+	"sigs.k8s.io/controller-runtime/pkg/source"
 )
 
 const (
@@ -139,7 +139,7 @@ func (r *TokenssuerReconciler) populateTokenReconcileRequestsForConfigMap(ctx co
 	})
 	requests := []reconcile.Request{}
 	if err == nil && len(tokenIssuerList.Items) > 0 {
-		
+
 		for _, tokenIssuer := range tokenIssuerList.Items {
 			req := reconcile.Request{
 				NamespacedName: types.NamespacedName{
@@ -168,7 +168,7 @@ func (r *TokenssuerReconciler) populateTokenReconcileRequestsForSecret(ctx conte
 	})
 	requests := []reconcile.Request{}
 	if err == nil && len(tokenIssuerList.Items) > 0 {
-		
+
 		for _, tokenIssuer := range tokenIssuerList.Items {
 			req := reconcile.Request{
 				NamespacedName: types.NamespacedName{
diff --git a/adapter/internal/operator/gateway-api/address.go b/adapter/internal/operator/gateway-api/address.go
new file mode 100644
index 000000000..3342bdc52
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/address.go
@@ -0,0 +1,49 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+var _ AddressesTranslator = (*Translator)(nil)
+
+type AddressesTranslator interface {
+	ProcessAddresses(gateways []*GatewayContext, infraIR InfraIRMap)
+}
+
+func (t *Translator) ProcessAddresses(gateways []*GatewayContext, infraIR InfraIRMap) {
+	for _, gateway := range gateways {
+		// Infra IR already exist
+		irKey := t.getIRKey(gateway.Gateway)
+		gwInfraIR := infraIR[irKey]
+
+		var ips []string
+		for _, gwadr := range gateway.Spec.Addresses {
+			if *gwadr.Type == v1.IPAddressType {
+				ips = append(ips, gwadr.Value)
+			}
+		}
+		gwInfraIR.Proxy.Addresses = ips
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
new file mode 100644
index 000000000..9c132361d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
@@ -0,0 +1,226 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package bootstrap
+
+import (
+	// Register embed
+	_ "embed"
+	"fmt"
+	"strings"
+	"text/template"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"github.com/wso2/apk/adapter/pkg/utils/regex"
+	"k8s.io/apimachinery/pkg/util/sets"
+)
+
+const (
+	// envoyCfgFileName is the name of the Envoy configuration file.
+	envoyCfgFileName = "bootstrap.yaml"
+	// envoyGatewayXdsServerHost is the DNS name of the Xds Server within Envoy Gateway.
+	// It defaults to the Envoy Gateway Kubernetes service.
+	envoyGatewayXdsServerHost = "envoy-gateway"
+	// EnvoyAdminAddress is the listening address of the envoy admin interface.
+	EnvoyAdminAddress = "0.0.0.0"
+	// EnvoyAdminPort is the port used to expose admin interface.
+	EnvoyAdminPort = 19000
+	// envoyAdminAccessLogPath is the path used to expose admin access log.
+	envoyAdminAccessLogPath = "/dev/null"
+
+	// DefaultXdsServerPort is the default listening port of the xds-server.
+	DefaultXdsServerPort = 18000
+
+	envoyReadinessAddress = "0.0.0.0"
+	EnvoyReadinessPort    = 19001
+	EnvoyReadinessPath    = "/ready"
+)
+
+//go:embed bootstrap.yaml.tpl
+var bootstrapTmplStr string
+
+var bootstrapTmpl = template.Must(template.New(envoyCfgFileName).Parse(bootstrapTmplStr))
+
+// envoyBootstrap defines the envoy Bootstrap configuration.
+type bootstrapConfig struct {
+	// parameters defines configurable bootstrap configuration parameters.
+	parameters bootstrapParameters
+	// rendered is the rendered bootstrap configuration.
+	rendered string
+}
+
+// envoyBootstrap defines the envoy Bootstrap configuration.
+type bootstrapParameters struct {
+	// XdsServer defines the configuration of the XDS server.
+	XdsServer xdsServerParameters
+	// AdminServer defines the configuration of the Envoy admin interface.
+	AdminServer adminServerParameters
+	// ReadyServer defines the configuration for health check ready listener
+	ReadyServer readyServerParameters
+	// EnablePrometheus defines whether to enable metrics endpoint for prometheus.
+	EnablePrometheus bool
+	// OtelMetricSinks defines the configuration of the OpenTelemetry sinks.
+	OtelMetricSinks []metricSink
+	// EnableStatConfig defines whether to to customize the Envoy proxy stats.
+	EnableStatConfig bool
+	// StatsMatcher is to control creation of custom Envoy stats with prefix,
+	// suffix, and regex expressions match on the name of the stats.
+	StatsMatcher *StatsMatcherParameters
+}
+
+type xdsServerParameters struct {
+	// Address is the address of the XDS Server that Envoy is managed by.
+	Address string
+	// Port is the port of the XDS Server that Envoy is managed by.
+	Port int32
+}
+
+type metricSink struct {
+	// Address is the address of the XDS Server that Envoy is managed by.
+	Address string
+	// Port is the port of the XDS Server that Envoy is managed by.
+	Port int32
+}
+
+type adminServerParameters struct {
+	// Address is the address of the Envoy admin interface.
+	Address string
+	// Port is the port of the Envoy admin interface.
+	Port int32
+	// AccessLogPath is the path of the Envoy admin access log.
+	AccessLogPath string
+}
+
+type readyServerParameters struct {
+	// Address is the address of the Envoy readiness probe
+	Address string
+	// Port is the port of envoy readiness probe
+	Port int32
+	// ReadinessPath is the path for the envoy readiness probe
+	ReadinessPath string
+}
+
+type StatsMatcherParameters struct {
+	Exacts             []string
+	Prefixs            []string
+	Suffixs            []string
+	RegularExpressions []string
+}
+
+// render the stringified bootstrap config in yaml format.
+func (b *bootstrapConfig) render() error {
+	buf := new(strings.Builder)
+	if err := bootstrapTmpl.Execute(buf, b.parameters); err != nil {
+		return fmt.Errorf("failed to render bootstrap config: %w", err)
+	}
+	b.rendered = buf.String()
+
+	return nil
+}
+
+// GetRenderedBootstrapConfig renders the bootstrap YAML string
+func GetRenderedBootstrapConfig(proxyMetrics *egv1a1.ProxyMetrics) (string, error) {
+	var (
+		enablePrometheus = true
+		metricSinks      []metricSink
+		StatsMatcher     StatsMatcherParameters
+	)
+
+	if proxyMetrics != nil {
+		if proxyMetrics.Prometheus != nil {
+			enablePrometheus = !proxyMetrics.Prometheus.Disable
+		}
+
+		addresses := sets.NewString()
+		for _, sink := range proxyMetrics.Sinks {
+			if sink.OpenTelemetry == nil {
+				continue
+			}
+
+			// skip duplicate sinks
+			addr := fmt.Sprintf("%s:%d", sink.OpenTelemetry.Host, sink.OpenTelemetry.Port)
+			if addresses.Has(addr) {
+				continue
+			}
+			addresses.Insert(addr)
+
+			metricSinks = append(metricSinks, metricSink{
+				Address: sink.OpenTelemetry.Host,
+				Port:    sink.OpenTelemetry.Port,
+			})
+		}
+
+		if proxyMetrics.Matches != nil {
+			// Add custom envoy proxy stats
+			for _, match := range proxyMetrics.Matches {
+				// matchType default to exact
+				matchType := egv1a1.StringMatchExact
+				if match.Type != nil {
+					matchType = *match.Type
+				}
+				switch matchType {
+				case egv1a1.StringMatchExact:
+					StatsMatcher.Exacts = append(StatsMatcher.Exacts, match.Value)
+				case egv1a1.StringMatchPrefix:
+					StatsMatcher.Prefixs = append(StatsMatcher.Prefixs, match.Value)
+				case egv1a1.StringMatchSuffix:
+					StatsMatcher.Suffixs = append(StatsMatcher.Suffixs, match.Value)
+				case egv1a1.StringMatchRegularExpression:
+					if err := regex.Validate(match.Value); err != nil {
+						return "", err
+					}
+					StatsMatcher.RegularExpressions = append(StatsMatcher.RegularExpressions, match.Value)
+				}
+			}
+		}
+	}
+
+	cfg := &bootstrapConfig{
+		parameters: bootstrapParameters{
+			XdsServer: xdsServerParameters{
+				Address: envoyGatewayXdsServerHost,
+				Port:    DefaultXdsServerPort,
+			},
+			AdminServer: adminServerParameters{
+				Address:       EnvoyAdminAddress,
+				Port:          EnvoyAdminPort,
+				AccessLogPath: envoyAdminAccessLogPath,
+			},
+			ReadyServer: readyServerParameters{
+				Address:       envoyReadinessAddress,
+				Port:          EnvoyReadinessPort,
+				ReadinessPath: EnvoyReadinessPath,
+			},
+			EnablePrometheus: enablePrometheus,
+			OtelMetricSinks:  metricSinks,
+		},
+	}
+	if proxyMetrics != nil && proxyMetrics.Matches != nil {
+		cfg.parameters.StatsMatcher = &StatsMatcher
+	}
+
+	if err := cfg.render(); err != nil {
+		return "", err
+	}
+
+	return cfg.rendered, nil
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
new file mode 100644
index 000000000..bad77c930
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -0,0 +1,191 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: {{ .AdminServer.AccessLogPath }}
+  address:
+    socket_address:
+      address: {{ .AdminServer.Address }}
+      port_value: {{ .AdminServer.Port }}
+{{- if .StatsMatcher  }}
+stats_config:
+  stats_matcher:
+    inclusion_list:
+      patterns:
+      {{- range $_, $item := .StatsMatcher.Exacts }}
+      - exact: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.Prefixs }}
+      - prefix: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.Suffixs }}
+      - suffix: {{$item}}
+      {{- end}}
+      {{- range $_, $item := .StatsMatcher.RegularExpressions }}
+      - safe_regex:
+          google_re2: {}
+          regex: {{js $item}}
+      {{- end}}
+{{- end }}
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+{{- if .OtelMetricSinks }}
+stats_sinks:
+{{- range $idx, $sink := .OtelMetricSinks }}
+- name: "envoy.stat_sinks.open_telemetry"
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig
+    grpc_service:
+      envoy_grpc:
+        cluster_name: otel_metric_sink_{{ $idx }}
+{{- end }}
+{{- end }}
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-{{ .ReadyServer.Address }}-{{ .ReadyServer.Port }}
+    address:
+      socket_address:
+        address: {{ .ReadyServer.Address }}
+        port_value: {{ .ReadyServer.Port }}
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: {{ .ReadyServer.ReadinessPath }}
+          - name: envoy.filters.http.ext_authz
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+              clear_route_cache: true
+              include_peer_certificate: true
+              transport_api_version: 2
+              grpc_service: 
+                  envoy_grpc: 
+                    cluster_name: ext-authz
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  {{- range $idx, $sink := .OtelMetricSinks }}
+  - name: otel_metric_sink_{{ $idx }}
+    connect_timeout: 0.250s
+    type: STRICT_DNS
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options: {}
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: otel_metric_sink_{{ $idx }}
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: {{ $sink.Address }}
+                port_value: {{ $sink.Port }}
+  {{- end }}
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: apk-test-wso2-apk-adapter-service.apk.svc
+                port_value: {{ .XdsServer.Port }}
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificates:
+            private_key:
+              filename: '/home/wso2/security/keystore/router.key'
+            certificate_chain:
+              filename: '/home/wso2/security/keystore/router.crt'
+          validation_context:
+            trusted_ca:
+              filename: '/home/wso2/security/truststore/adapter.crt'
+  - name: ext-authz
+    type: STRICT_DNS
+    connect_timeout: 20s
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicit_http_config:
+          http2_protocol_options: {}
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_minimum_protocol_version: TLSv1_2
+            tls_maximum_protocol_version: TLSv1_2
+          tls_certificates:
+            private_key:
+              filename: "/home/wso2/security/keystore/router.key"
+            certificate_chain:
+              filename: "/home/wso2/security/keystore/router.crt"
+          validation_context:
+            trusted_ca:
+              filename: "/home/wso2/security/truststore/enforcer.crt"
+    load_assignment:
+      cluster_name: ext-authz
+      endpoints:
+        - lb_endpoints:
+            - endpoint:
+                address:
+                  socket_address:
+                    address: enforcer
+                    port_value: 8081
+  
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
new file mode 100644
index 000000000..ae4118529
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap_test.go
@@ -0,0 +1,128 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package bootstrap
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path"
+)
+
+var (
+	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+)
+
+// func TestGetRenderedBootstrapConfig(t *testing.T) {
+// 	cases := []struct {
+// 		name         string
+// 		proxyMetrics *egv1a1.ProxyMetrics
+// 	}{
+// 		{
+// 			name: "disable-prometheus",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 					Disable: true,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "enable-prometheus",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{},
+// 			},
+// 		},
+// 		{
+// 			name: "otel-metrics",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 					Disable: true,
+// 				},
+// 				Sinks: []egv1a1.ProxyMetricSink{
+// 					{
+// 						Type: egv1a1.MetricSinkTypeOpenTelemetry,
+// 						OpenTelemetry: &egv1a1.ProxyOpenTelemetrySink{
+// 							Host: "otel-collector.monitoring.svc",
+// 							Port: 4317,
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "custom-stats-matcher",
+// 			proxyMetrics: &egv1a1.ProxyMetrics{
+// 				Matches: []egv1a1.StringMatch{
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchExact),
+// 						Value: "http.foo.bar.cluster.upstream_rq",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchPrefix),
+// 						Value: "http",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchSuffix),
+// 						Value: "upstream_rq",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchRegularExpression),
+// 						Value: "virtual.*",
+// 					},
+// 					{
+// 						Type:  ptr.To(egv1a1.StringMatchPrefix),
+// 						Value: "cluster",
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			got, err := GetRenderedBootstrapConfig(tc.proxyMetrics)
+// 			require.NoError(t, err)
+
+// 			if *overrideTestData {
+// 				// nolint:gosec
+// 				err = os.WriteFile(path.Join("testdata", "render", fmt.Sprintf("%s.yaml", tc.name)), []byte(got), 0644)
+// 				require.NoError(t, err)
+// 				return
+// 			}
+
+// 			expected, err := readTestData(tc.name)
+// 			require.NoError(t, err)
+// 			assert.Equal(t, expected, got)
+// 		})
+// 	}
+// }
+
+func readTestData(caseName string) (string, error) {
+	filename := path.Join("testdata", "render", fmt.Sprintf("%s.yaml", caseName))
+
+	b, err := os.ReadFile(filename)
+	if err != nil {
+		return "", err
+	}
+	return string(b), nil
+}
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
new file mode 100644
index 000000000..3a18cfed3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.in.yaml
@@ -0,0 +1,13 @@
+admin:
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 20000
+layered_runtime:
+  layers:
+  - name: runtime-0
+    rtds_layer:
+      rtds_config:
+        ads: {}
+        resource_api_version: V3
+      name: runtime-0
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
new file mode 100644
index 000000000..528105b3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
@@ -0,0 +1,118 @@
+admin:
+  accessLog:
+  - name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 20000
+dynamicResources:
+  adsConfig:
+    apiType: DELTA_GRPC
+    grpcServices:
+    - envoyGrpc:
+        clusterName: xds_cluster
+    setNodeOnFirstMessageOnly: true
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+layeredRuntime:
+  layers:
+  - name: global_config
+    staticLayer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+  - name: runtime-0
+    rtdsLayer:
+      name: runtime-0
+      rtdsConfig:
+        ads: {}
+        resourceApiVersion: V3
+staticResources:
+  clusters:
+  # - connectTimeout: 0.250s
+  #   loadAssignment:
+  #     clusterName: prometheus_stats
+  #     endpoints:
+  #     - lbEndpoints:
+  #       - endpoint:
+  #           address:
+  #             socketAddress:
+  #               address: 0.0.0.0
+  #               portValue: 19000
+  #   name: prometheus_stats
+  #   type: STATIC
+  - connectTimeout: 10s
+    loadAssignment:
+      clusterName: xds_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: envoy-gateway
+                portValue: 18000
+          loadBalancingWeight: 1
+        loadBalancingWeight: 1
+    name: xds_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsCertificateSdsSecretConfigs:
+          - name: xds_certificate
+            sdsConfig:
+              pathConfigSource:
+                path: /sds/xds-certificate.json
+              resourceApiVersion: V3
+          tlsParams:
+            tlsMaximumProtocolVersion: TLSv1_3
+          validationContextSdsSecretConfig:
+            name: xds_trusted_ca
+            sdsConfig:
+              pathConfigSource:
+                path: /sds/xds-trusted-ca.json
+              resourceApiVersion: V3
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  listeners:
+  - address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 19001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          httpFilters:
+          - name: envoy.filters.http.health_check
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              headers:
+              - name: :path
+                stringMatch:
+                  exact: /ready
+              passThroughMode: false
+          - name: envoy.filters.http.router
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          routeConfig:
+            name: local_route
+          statPrefix: eg-ready-http
+    name: envoy-gateway-proxy-ready-0.0.0.0-19001
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
new file mode 100644
index 000000000..8b4f9363f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.in.yaml
@@ -0,0 +1,34 @@
+stats_sinks:
+  - name: envoy.stat_sinks.metrics_service
+    typed_config:
+      "@type": type.googleapis.com/envoy.config.metrics.v3.MetricsServiceConfig
+      transport_api_version: V3
+      grpc_service:
+        envoy_grpc:
+          cluster_name: metrics_cluster
+static_resources:
+  clusters:
+    - connect_timeout: 1s
+      dns_lookup_family: V4_ONLY
+      dns_refresh_rate: 30s
+      lb_policy: ROUND_ROBIN
+      typed_extension_protocol_options:
+        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":
+          "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+          explicit_http_config:
+            http2_protocol_options:
+              connection_keepalive:
+                interval: 30s
+                timeout: 5s
+      load_assignment:
+        cluster_name: metrics_cluster
+        endpoints:
+          - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: skywalking-oap.skywalking
+                      portValue: 11800
+      name: metrics_cluster
+      respect_dns_ttl: true
+      type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
new file mode 100644
index 000000000..ccfff8e1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
@@ -0,0 +1,140 @@
+admin:
+  accessLog:
+  - name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 19000
+dynamicResources:
+  adsConfig:
+    apiType: DELTA_GRPC
+    grpcServices:
+    - envoyGrpc:
+        clusterName: xds_cluster
+    setNodeOnFirstMessageOnly: true
+    transportApiVersion: V3
+  cdsConfig:
+    ads: {}
+    resourceApiVersion: V3
+  ldsConfig:
+    ads: {}
+    resourceApiVersion: V3
+layeredRuntime:
+  layers:
+  - name: global_config
+    staticLayer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+staticResources:
+  clusters:
+  # - connectTimeout: 0.250s
+  #   loadAssignment:
+  #     clusterName: prometheus_stats
+  #     endpoints:
+  #     - lbEndpoints:
+  #       - endpoint:
+  #           address:
+  #             socketAddress:
+  #               address: 0.0.0.0
+  #               portValue: 19000
+  #   name: prometheus_stats
+  #   type: STATIC
+  - connectTimeout: 10s
+    loadAssignment:
+      clusterName: xds_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: envoy-gateway
+                portValue: 18000
+          loadBalancingWeight: 1
+        loadBalancingWeight: 1
+    name: xds_cluster
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          tlsParams:
+            tlsMinimumProtocolVersion: TLSv1_2
+            tlsMaximumProtocolVersion: TLSv1_2
+          tlsCertificates:
+            privateKey:
+              filename: '/home/wso2/security/keystore/router.key'
+            certificateChain:
+              filename: '/home/wso2/security/keystore/router.crt'
+          validationContext:
+            trustedCA:
+              filename: '/home/wso2/security/truststore/adapter.crt'
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  - connectTimeout: 1s
+    dnsLookupFamily: V4_ONLY
+    dnsRefreshRate: 30s
+    loadAssignment:
+      clusterName: metrics_cluster
+      endpoints:
+      - lbEndpoints:
+        - endpoint:
+            address:
+              socketAddress:
+                address: skywalking-oap.skywalking
+                portValue: 11800
+    name: metrics_cluster
+    respectDnsTtl: true
+    type: STRICT_DNS
+    typedExtensionProtocolOptions:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+        explicitHttpConfig:
+          http2ProtocolOptions:
+            connectionKeepalive:
+              interval: 30s
+              timeout: 5s
+  listeners:
+  - address:
+      socketAddress:
+        address: 0.0.0.0
+        portValue: 19001
+    filterChains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          httpFilters:
+          - name: envoy.filters.http.health_check
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              headers:
+              - name: :path
+                stringMatch:
+                  exact: /ready
+              passThroughMode: false
+          - name: envoy.filters.http.router
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+          routeConfig:
+            name: local_route
+          statPrefix: eg-ready-http
+    name: envoy-gateway-proxy-ready-0.0.0.0-19001
+statsSinks:
+- name: envoy.stat_sinks.metrics_service
+  typedConfig:
+    '@type': type.googleapis.com/envoy.config.metrics.v3.MetricsServiceConfig
+    grpcService:
+      envoyGrpc:
+        clusterName: metrics_cluster
+    transportApiVersion: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
new file mode 100644
index 000000000..7364bc85a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -0,0 +1,112 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+stats_config:
+  stats_matcher:
+    inclusion_list:
+      patterns:
+      - exact: http.foo.bar.cluster.upstream_rq
+      - prefix: http
+      - prefix: cluster
+      - suffix: upstream_rq
+      - safe_regex:
+          google_re2: {}
+          regex: virtual.*
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
new file mode 100644
index 000000000..ca8a5c09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
@@ -0,0 +1,101 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
new file mode 100644
index 000000000..ca8a5c09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
@@ -0,0 +1,101 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
new file mode 100644
index 000000000..82fbd38ad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
@@ -0,0 +1,126 @@
+admin:
+  access_log:
+  - name: envoy.access_loggers.file
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      path: /dev/null
+  address:
+    socket_address:
+      address: 0.0.0.0
+      port_value: 19000
+layered_runtime:
+  layers:
+  - name: global_config
+    static_layer:
+      envoy.restart_features.use_eds_cache_for_ads: true
+      re2.max_program_size.error_level: 4294967295
+      re2.max_program_size.warn_level: 1000
+dynamic_resources:
+  ads_config:
+    api_type: DELTA_GRPC
+    transport_api_version: V3
+    grpc_services:
+    - envoy_grpc:
+        cluster_name: xds_cluster
+    set_node_on_first_message_only: true
+  lds_config:
+    ads: {}
+    resource_api_version: V3
+  cds_config:
+    ads: {}
+    resource_api_version: V3
+stats_sinks:
+- name: "envoy.stat_sinks.open_telemetry"
+  typed_config:
+    "@type": type.googleapis.com/envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig
+    grpc_service:
+      envoy_grpc:
+        cluster_name: otel_metric_sink_0
+static_resources:
+  listeners:
+  - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+    address:
+      socket_address:
+        address: 0.0.0.0
+        port_value: 19001
+        protocol: TCP
+    filter_chains:
+    - filters:
+      - name: envoy.filters.network.http_connection_manager
+        typed_config:
+          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+          stat_prefix: eg-ready-http
+          route_config:
+            name: local_route
+          http_filters:
+          - name: envoy.filters.http.health_check
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+              pass_through_mode: false
+              headers:
+              - name: ":path"
+                string_match:
+                  exact: /ready
+          - name: envoy.filters.http.router
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  clusters:
+  - name: otel_metric_sink_0
+    connect_timeout: 0.250s
+    type: STRICT_DNS
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options: {}
+    lb_policy: ROUND_ROBIN
+    load_assignment:
+      cluster_name: otel_metric_sink_0
+      endpoints:
+      - lb_endpoints:
+        - endpoint:
+            address:
+              socket_address:
+                address: otel-collector.monitoring.svc
+                port_value: 4317
+  - connect_timeout: 10s
+    load_assignment:
+      cluster_name: xds_cluster
+      endpoints:
+      - load_balancing_weight: 1
+        lb_endpoints:
+        - load_balancing_weight: 1
+          endpoint:
+            address:
+              socket_address:
+                address: envoy-gateway
+                port_value: 18000
+    typed_extension_protocol_options:
+      envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+        explicit_http_config:
+          http2_protocol_options:
+            connection_keepalive:
+              interval: 30s
+              timeout: 5s
+    name: xds_cluster
+    type: STRICT_DNS
+    transport_socket:
+      name: envoy.transport_sockets.tls
+      typed_config:
+        "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        common_tls_context:
+          tls_params:
+            tls_maximum_protocol_version: TLSv1_3
+          tls_certificate_sds_secret_configs:
+          - name: xds_certificate
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-certificate.json"
+              resource_api_version: V3
+          validation_context_sds_secret_config:
+            name: xds_trusted_ca
+            sds_config:
+              path_config_source:
+                path: "/sds/xds-trusted-ca.json"
+              resource_api_version: V3
diff --git a/adapter/internal/operator/gateway-api/contexts.go b/adapter/internal/operator/gateway-api/contexts.go
new file mode 100644
index 000000000..40ab07009
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/contexts.go
@@ -0,0 +1,453 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"reflect"
+	"time"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+// GatewayContext wraps a Gateway and provides helper methods for setting conditions, accessing Listeners, etc.
+type GatewayContext struct {
+	*gwapiv1.Gateway
+	listeners []*ListenerContext
+}
+
+// ResetListeners resets the listener statuses and re-generates the GatewayContext
+// ListenerContexts from the Gateway spec.
+func (g *GatewayContext) ResetListeners() {
+	lenListener := len(g.Spec.Listeners)
+	g.Status.Listeners = make([]gwapiv1.ListenerStatus, lenListener)
+	g.listeners = make([]*ListenerContext, lenListener)
+	for i := range g.Spec.Listeners {
+		listener := &g.Spec.Listeners[i]
+		g.Status.Listeners[i] = gwapiv1.ListenerStatus{Name: listener.Name}
+		g.listeners[i] = &ListenerContext{
+			listenerStatusID: i,
+			Listener:         listener,
+			gateway:          g.Gateway,
+		}
+	}
+}
+
+// ListenerContext wraps a Listener and provides helper methods for
+// setting conditions and other status information on the associated
+// Gateway, etc.
+type ListenerContext struct {
+	*gwapiv1.Listener
+
+	gateway           *gwapiv1.Gateway
+	listenerStatusID  int
+	namespaceSelector labels.Selector
+	tlsSecrets        []*v1.Secret
+}
+
+func (l *ListenerContext) SetCondition(conditionType gwapiv1.ListenerConditionType, status metav1.ConditionStatus, reason gwapiv1.ListenerConditionReason, message string) {
+	cond := metav1.Condition{
+		Type:               string(conditionType),
+		Status:             status,
+		Reason:             string(reason),
+		Message:            message,
+		ObservedGeneration: l.gateway.Generation,
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+
+	index := -1
+	for i, existing := range l.gateway.Status.Listeners[l.listenerStatusID].Conditions {
+		if existing.Type == cond.Type {
+			// return early if the condition is unchanged
+			if existing.Status == cond.Status &&
+				existing.Reason == cond.Reason &&
+				existing.Message == cond.Message &&
+				existing.ObservedGeneration == cond.ObservedGeneration {
+				return
+			}
+			index = i
+			break
+		}
+	}
+
+	if index > -1 {
+		l.gateway.Status.Listeners[l.listenerStatusID].Conditions[index] = cond
+	} else {
+		l.gateway.Status.Listeners[l.listenerStatusID].Conditions = append(l.gateway.Status.Listeners[l.listenerStatusID].Conditions, cond)
+	}
+}
+
+func (l *ListenerContext) SetSupportedKinds(kinds ...gwapiv1.RouteGroupKind) {
+	l.gateway.Status.Listeners[l.listenerStatusID].SupportedKinds = kinds
+}
+
+func (l *ListenerContext) IncrementAttachedRoutes() {
+	l.gateway.Status.Listeners[l.listenerStatusID].AttachedRoutes++
+}
+
+func (l *ListenerContext) AttachedRoutes() int32 {
+	return l.gateway.Status.Listeners[l.listenerStatusID].AttachedRoutes
+}
+
+func (l *ListenerContext) AllowsKind(kind gwapiv1.RouteGroupKind) bool {
+	for _, allowed := range l.gateway.Status.Listeners[l.listenerStatusID].SupportedKinds {
+		if GroupDerefOr(allowed.Group, "") == GroupDerefOr(kind.Group, "") &&
+			allowed.Kind == kind.Kind {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (l *ListenerContext) AllowsNamespace(namespace *v1.Namespace) bool {
+	if namespace == nil {
+		return false
+	}
+
+	if l.AllowedRoutes == nil || l.AllowedRoutes.Namespaces == nil || l.AllowedRoutes.Namespaces.From == nil {
+		return l.gateway.Namespace == namespace.Name
+	}
+
+	switch *l.AllowedRoutes.Namespaces.From {
+	case gwapiv1.NamespacesFromAll:
+		return true
+	case gwapiv1.NamespacesFromSelector:
+		if l.namespaceSelector == nil {
+			return false
+		}
+		return l.namespaceSelector.Matches(labels.Set(namespace.Labels))
+	default:
+		// NamespacesFromSame is the default
+		return l.gateway.Namespace == namespace.Name
+	}
+}
+
+func (l *ListenerContext) IsReady() bool {
+	for _, cond := range l.gateway.Status.Listeners[l.listenerStatusID].Conditions {
+		if cond.Type == string(gwapiv1.ListenerConditionProgrammed) && cond.Status == metav1.ConditionTrue {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (l *ListenerContext) GetConditions() []metav1.Condition {
+	return l.gateway.Status.Listeners[l.listenerStatusID].Conditions
+}
+
+func (l *ListenerContext) SetTLSSecrets(tlsSecrets []*v1.Secret) {
+	l.tlsSecrets = tlsSecrets
+}
+
+// RouteContext represents a generic Route object (HTTPRoute, TLSRoute, etc.)
+// that can reference Gateway objects.
+type RouteContext interface {
+	client.Object
+}
+
+// HTTPRouteContext wraps an HTTPRoute and provides helper methods for
+// accessing the route's parents.
+type HTTPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*gwapiv1.HTTPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// GRPCRouteContext wraps a GRPCRoute and provides helper methods for
+// accessing the route's parents.
+type GRPCRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.GRPCRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// TLSRouteContext wraps a TLSRoute and provides helper methods for
+// accessing the route's parents.
+type TLSRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.TLSRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// UDPRouteContext wraps a UDPRoute and provides helper methods for
+// accessing the route's parents.
+type UDPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.UDPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// TCPRouteContext wraps a TCPRoute and provides helper methods for
+// accessing the route's parents.
+type TCPRouteContext struct {
+	// GatewayControllerName is the name of the Gateway API controller.
+	GatewayControllerName string
+
+	*v1alpha2.TCPRoute
+
+	ParentRefs map[gwapiv1.ParentReference]*RouteParentContext
+}
+
+// GetRouteType returns the Kind of the Route object, HTTPRoute,
+// TLSRoute, TCPRoute, UDPRoute etc.
+func GetRouteType(route RouteContext) gwapiv1.Kind {
+	rv := reflect.ValueOf(route).Elem()
+	return gwapiv1.Kind(rv.FieldByName("Kind").String())
+}
+
+// TODO: [v1alpha2-gwapiv1] This should not be required once all Route
+// objects being implemented are of type gwapiv1.
+// GetHostnames returns the hosts targeted by the Route object.
+func GetHostnames(route RouteContext) []string {
+	rv := reflect.ValueOf(route).Elem()
+	kind := rv.FieldByName("Kind").String()
+	if kind == KindTCPRoute || kind == KindUDPRoute {
+		return nil
+	}
+
+	hs := rv.FieldByName("Spec").FieldByName("Hostnames")
+	hostnames := make([]string, hs.Len())
+	for i := 0; i < len(hostnames); i++ {
+		hostnames[i] = hs.Index(i).String()
+	}
+	return hostnames
+}
+
+// TODO: [v1alpha2-gwapiv1] This should not be required once all Route
+// objects being implemented are of type gwapiv1.
+// GetParentReferences returns the ParentReference of the Route object.
+func GetParentReferences(route RouteContext) []gwapiv1.ParentReference {
+	rv := reflect.ValueOf(route).Elem()
+	kind := rv.FieldByName("Kind").String()
+	pr := rv.FieldByName("Spec").FieldByName("ParentRefs")
+	if kind == KindHTTPRoute || kind == KindGRPCRoute {
+		return pr.Interface().([]gwapiv1.ParentReference)
+	}
+
+	parentReferences := make([]gwapiv1.ParentReference, pr.Len())
+	for i := 0; i < len(parentReferences); i++ {
+		p := pr.Index(i).Interface().(gwapiv1.ParentReference)
+		parentReferences[i] = UpgradeParentReference(p)
+	}
+	return parentReferences
+}
+
+// GetRouteStatus returns the RouteStatus object associated with the Route.
+func GetRouteStatus(route RouteContext) *gwapiv1.RouteStatus {
+	rv := reflect.ValueOf(route).Elem()
+	rs := rv.FieldByName("Status").FieldByName("RouteStatus").Interface().(gwapiv1.RouteStatus)
+	return &rs
+}
+
+// GetRouteParentContext returns RouteParentContext by using the Route
+// objects' ParentReference.
+func GetRouteParentContext(route RouteContext, forParentRef gwapiv1.ParentReference) *RouteParentContext {
+	rv := reflect.ValueOf(route).Elem()
+	pr := rv.FieldByName("ParentRefs")
+	if pr.IsNil() {
+		mm := reflect.MakeMap(reflect.TypeOf(map[gwapiv1.ParentReference]*RouteParentContext{}))
+		pr.Set(mm)
+	}
+
+	if p := pr.MapIndex(reflect.ValueOf(forParentRef)); p.IsValid() && !p.IsZero() {
+		ctx := p.Interface().(*RouteParentContext)
+		return ctx
+	}
+
+	isHTTPRoute := false
+	if rv.FieldByName("Kind").String() == KindHTTPRoute {
+		isHTTPRoute = true
+	}
+
+	var parentRef *gwapiv1.ParentReference
+	specParentRefs := rv.FieldByName("Spec").FieldByName("ParentRefs")
+	for i := 0; i < specParentRefs.Len(); i++ {
+		p := specParentRefs.Index(i).Interface().(gwapiv1.ParentReference)
+		up := p
+		if !isHTTPRoute {
+			up = UpgradeParentReference(p)
+		}
+		if reflect.DeepEqual(up, forParentRef) {
+			if isHTTPRoute {
+				parentRef = &p
+			} else {
+				upgraded := UpgradeParentReference(p)
+				parentRef = &upgraded
+			}
+			break
+		}
+	}
+	if parentRef == nil {
+		panic("parentRef not found")
+	}
+
+	routeParentStatusIdx := -1
+	statusParents := rv.FieldByName("Status").FieldByName("Parents")
+	for i := 0; i < statusParents.Len(); i++ {
+		p := statusParents.Index(i).FieldByName("ParentRef").Interface().(gwapiv1.ParentReference)
+		if !isHTTPRoute {
+			p = UpgradeParentReference(p)
+			defaultNamespace := gwapiv1.Namespace(metav1.NamespaceDefault)
+			if forParentRef.Namespace == nil {
+				forParentRef.Namespace = &defaultNamespace
+			}
+			if p.Namespace == nil {
+				p.Namespace = &defaultNamespace
+			}
+		}
+		if reflect.DeepEqual(p, forParentRef) {
+			routeParentStatusIdx = i
+			break
+		}
+	}
+	if routeParentStatusIdx == -1 {
+		tmpPR := forParentRef
+		if !isHTTPRoute {
+			tmpPR = DowngradeParentReference(tmpPR)
+		}
+		rParentStatus := v1alpha2.RouteParentStatus{
+			ControllerName: v1alpha2.GatewayController(rv.FieldByName("GatewayControllerName").String()),
+			ParentRef:      tmpPR,
+		}
+		statusParents.Set(reflect.Append(statusParents, reflect.ValueOf(rParentStatus)))
+		routeParentStatusIdx = statusParents.Len() - 1
+	}
+
+	ctx := &RouteParentContext{
+		ParentReference:      parentRef,
+		routeParentStatusIdx: routeParentStatusIdx,
+	}
+	rctx := reflect.ValueOf(ctx)
+	rctx.Elem().FieldByName(string(GetRouteType(route))).Set(rv.Field(1))
+	pr.SetMapIndex(reflect.ValueOf(forParentRef), rctx)
+	return ctx
+}
+
+// RouteParentContext wraps a ParentReference and provides helper methods for
+// setting conditions and other status information on the associated
+// HTTPRoute, TLSRoute etc.
+type RouteParentContext struct {
+	*gwapiv1.ParentReference
+
+	// TODO: [v1alpha2-gwapiv1] This can probably be replaced with
+	// a single field pointing to *gwapiv1.RouteStatus.
+	HTTPRoute *gwapiv1.HTTPRoute
+	GRPCRoute *v1alpha2.GRPCRoute
+	TLSRoute  *v1alpha2.TLSRoute
+	TCPRoute  *v1alpha2.TCPRoute
+	UDPRoute  *v1alpha2.UDPRoute
+
+	routeParentStatusIdx int
+	listeners            []*ListenerContext
+}
+
+func (r *RouteParentContext) SetListeners(listeners ...*ListenerContext) {
+	r.listeners = append(r.listeners, listeners...)
+}
+
+func (r *RouteParentContext) SetCondition(route RouteContext, conditionType gwapiv1.RouteConditionType, status metav1.ConditionStatus, reason gwapiv1.RouteConditionReason, message string) {
+	cond := metav1.Condition{
+		Type:               string(conditionType),
+		Status:             status,
+		Reason:             string(reason),
+		Message:            message,
+		ObservedGeneration: route.GetGeneration(),
+		LastTransitionTime: metav1.NewTime(time.Now()),
+	}
+
+	idx := -1
+	routeStatus := GetRouteStatus(route)
+	for i, existing := range routeStatus.Parents[r.routeParentStatusIdx].Conditions {
+		if existing.Type == cond.Type {
+			// return early if the condition is unchanged
+			if existing.Status == cond.Status &&
+				existing.Reason == cond.Reason &&
+				existing.Message == cond.Message &&
+				existing.ObservedGeneration == cond.ObservedGeneration {
+				return
+			}
+			idx = i
+			break
+		}
+	}
+
+	if idx > -1 {
+		routeStatus.Parents[r.routeParentStatusIdx].Conditions[idx] = cond
+	} else {
+		routeStatus.Parents[r.routeParentStatusIdx].Conditions = append(routeStatus.Parents[r.routeParentStatusIdx].Conditions, cond)
+	}
+}
+
+func (r *RouteParentContext) ResetConditions(route RouteContext) {
+	routeStatus := GetRouteStatus(route)
+	routeStatus.Parents[r.routeParentStatusIdx].Conditions = make([]metav1.Condition, 0)
+}
+
+func (r *RouteParentContext) HasCondition(route RouteContext, condType gwapiv1.RouteConditionType, status metav1.ConditionStatus) bool {
+	var conditions []metav1.Condition
+	routeStatus := GetRouteStatus(route)
+	conditions = routeStatus.Parents[r.routeParentStatusIdx].Conditions
+	for _, c := range conditions {
+		if c.Type == string(condType) && c.Status == status {
+			return true
+		}
+	}
+	return false
+}
+
+// BackendRefContext represents a generic BackendRef object (HTTPBackendRef, GRPCBackendRef or BackendRef itself)
+type BackendRefContext any
+
+func GetBackendRef(b BackendRefContext) *gwapiv1.BackendRef {
+	rv := reflect.ValueOf(b)
+	br := rv.FieldByName("BackendRef")
+	if br.IsValid() {
+		backendRef := br.Interface().(gwapiv1.BackendRef)
+		return &backendRef
+
+	}
+	backendRef := b.(gwapiv1.BackendRef)
+	return &backendRef
+}
+
+func GetFilters(b BackendRefContext) any {
+	return reflect.ValueOf(b).FieldByName("Filters").Interface()
+}
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen.go b/adapter/internal/operator/gateway-api/crypto/certgen.go
new file mode 100644
index 000000000..87a8f1bcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/crypto/certgen.go
@@ -0,0 +1,321 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package crypto
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1" // nolint:gosec
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"fmt"
+	"math/big"
+	"time"
+
+	"github.com/wso2/apk/adapter/config"
+)
+
+const (
+	// DefaultEnvoyGatewayDNSPrefix defines the default Envoy Gateway DNS prefix.
+	DefaultEnvoyGatewayDNSPrefix = "envoy-gateway"
+
+	// DefaultEnvoyDNSPrefix defines the default Envoy DNS prefix.
+	DefaultEnvoyDNSPrefix = "*"
+
+	// DefaultCertificateLifetime holds the default certificate lifetime (in days).
+	DefaultCertificateLifetime = 365 * 5
+
+	// keySize sets the RSA key size to 2048 bits. This is minimum recommended size
+	// for RSA keys.
+	keySize = 2048
+)
+
+// Configuration holds config parameters used for generating certificates.
+type Configuration struct {
+	// Provider defines the desired cert provider and provider-specific
+	// configuration.
+	Provider *CertProvider
+}
+
+func (c *Configuration) getProvider() {
+	if c.Provider == nil {
+		c.Provider = &CertProvider{
+			Type: ProviderTypeEnvoyGateway,
+		}
+	}
+}
+
+// CertProvider defines the provider of certificates.
+type CertProvider struct {
+	// Type is the type of provider to use for managing certificates.
+	Type ProviderType `json:"type"`
+}
+
+// ProviderType defines the types of supported certificate providers.
+type ProviderType string
+
+const (
+	// ProviderTypeEnvoyGateway defines the "EnvoyGateway" provider.
+	// EnvoyGateway implements a self-signed CA and generates server
+	// certs for Envoy Gateway and Envoy.
+	ProviderTypeEnvoyGateway ProviderType = "EnvoyGateway"
+)
+
+// Certificates contains a set of Certificates as []byte each holding
+// the CA Cert along with Envoy Gateway & Envoy certificates.
+type Certificates struct {
+	CACertificate             []byte
+	EnvoyGatewayCertificate   []byte
+	EnvoyGatewayPrivateKey    []byte
+	EnvoyCertificate          []byte
+	EnvoyPrivateKey           []byte
+	EnvoyRateLimitCertificate []byte
+	EnvoyRateLimitPrivateKey  []byte
+	OIDCHMACSecret            []byte
+}
+
+// certificateRequest defines a certificate request.
+type certificateRequest struct {
+	caCertPEM  []byte
+	caKeyPEM   []byte
+	expiry     time.Time
+	commonName string
+	altNames   []string
+}
+
+// GenerateCerts generates a CA Certificate along with certificates for Envoy Gateway
+// and Envoy returning them as a *Certificates struct or error if encountered.
+func GenerateCerts() (*Certificates, error) {
+	conf := config.ReadConfigs()
+	gatewayNs := conf.Envoy.Namespace
+	certCfg := new(Configuration)
+
+	certCfg.getProvider()
+	switch certCfg.Provider.Type {
+	case ProviderTypeEnvoyGateway:
+		now := time.Now()
+		expiry := now.Add(24 * time.Duration(DefaultCertificateLifetime) * time.Hour)
+		caCertPEM, caKeyPEM, err := newCA(DefaultEnvoyGatewayDNSPrefix, expiry)
+		if err != nil {
+			return nil, err
+		}
+
+		var egDNSNames, envoyDNSNames []string
+		egDNSNames = kubeServiceNames(DefaultEnvoyGatewayDNSPrefix, gatewayNs, "cluster.local")
+		envoyDNSNames = append(envoyDNSNames, fmt.Sprintf("*.%s", gatewayNs))
+
+		egCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyGatewayDNSPrefix,
+			altNames:   egDNSNames,
+		}
+
+		egCert, egKey, err := newCert(egCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		envoyCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyDNSPrefix,
+			altNames:   envoyDNSNames,
+		}
+
+		envoyCert, envoyKey, err := newCert(envoyCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		envoyRateLimitCertReq := &certificateRequest{
+			caCertPEM:  caCertPEM,
+			caKeyPEM:   caKeyPEM,
+			expiry:     expiry,
+			commonName: DefaultEnvoyDNSPrefix,
+			altNames:   envoyDNSNames,
+		}
+
+		envoyRateLimitCert, envoyRateLimitKey, err := newCert(envoyRateLimitCertReq)
+		if err != nil {
+			return nil, err
+		}
+
+		oidcHMACSecret, err := generateHMACSecret()
+		if err != nil {
+			return nil, err
+		}
+
+		return &Certificates{
+			CACertificate:             caCertPEM,
+			EnvoyGatewayCertificate:   egCert,
+			EnvoyGatewayPrivateKey:    egKey,
+			EnvoyCertificate:          envoyCert,
+			EnvoyPrivateKey:           envoyKey,
+			EnvoyRateLimitCertificate: envoyRateLimitCert,
+			EnvoyRateLimitPrivateKey:  envoyRateLimitKey,
+			OIDCHMACSecret:            oidcHMACSecret,
+		}, nil
+	default:
+		// Envoy Gateway, e.g. self-signed CA, is the only supported certificate provider.
+		return nil, fmt.Errorf("unsupported certificate provider type %v", certCfg.Provider.Type)
+	}
+}
+
+// newCert generates a new keypair based on the given the request.
+// The return values are cert, key, err.
+func newCert(request *certificateRequest) ([]byte, []byte, error) {
+	caKeyPair, err := tls.X509KeyPair(request.caCertPEM, request.caKeyPEM)
+	if err != nil {
+		return nil, nil, err
+	}
+	caCert, err := x509.ParseCertificate(caKeyPair.Certificate[0])
+	if err != nil {
+		return nil, nil, err
+	}
+	caKey, ok := caKeyPair.PrivateKey.(*rsa.PrivateKey)
+	if !ok {
+		return nil, nil, fmt.Errorf("CA private key has unexpected type %T", caKeyPair.PrivateKey)
+	}
+
+	newKey, err := rsa.GenerateKey(rand.Reader, keySize)
+	if err != nil {
+		return nil, nil, fmt.Errorf("cannot generate key: %w", err)
+	}
+
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber: newSerial(now),
+		Subject: pkix.Name{
+			CommonName: request.commonName,
+		},
+		NotBefore:    now.UTC().AddDate(0, 0, -1),
+		NotAfter:     request.expiry.UTC(),
+		SubjectKeyId: bigIntHash(newKey.N),
+		KeyUsage: x509.KeyUsageDigitalSignature |
+			x509.KeyUsageDataEncipherment |
+			x509.KeyUsageKeyEncipherment |
+			x509.KeyUsageContentCommitment,
+		DNSNames: request.altNames,
+	}
+	newCert, err := x509.CreateCertificate(rand.Reader, template, caCert, &newKey.PublicKey, caKey)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	newKeyPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(newKey),
+	})
+	newCertPEM := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: newCert,
+	})
+	return newCertPEM, newKeyPEM, nil
+
+}
+
+// newCA generates a new CA, given the CA's CN and an expiry time.
+// The return order is cacert, cakey, error.
+func newCA(cn string, expiry time.Time) ([]byte, []byte, error) {
+	key, err := rsa.GenerateKey(rand.Reader, keySize)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	now := time.Now()
+	serial := newSerial(now)
+	template := &x509.Certificate{
+		SerialNumber: serial,
+		Subject: pkix.Name{
+			CommonName:   cn,
+			SerialNumber: serial.String(),
+		},
+		NotBefore:             now.UTC().AddDate(0, 0, -1),
+		NotAfter:              expiry.UTC(),
+		SubjectKeyId:          bigIntHash(key.N),
+		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+	}
+	certDER, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return nil, nil, err
+	}
+	certPEMData := pem.EncodeToMemory(&pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certDER,
+	})
+	keyPEMData := pem.EncodeToMemory(&pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	})
+	return certPEMData, keyPEMData, nil
+}
+
+func newSerial(now time.Time) *big.Int {
+	return big.NewInt(int64(now.Nanosecond()))
+}
+
+// bigIntHash generates a SubjectKeyId by hashing the modulus of the private
+// key. This isn't one of the methods listed in RFC 5280 4.2.1.2, but that also
+// notes that other methods are acceptable.
+//
+// gosec makes a blanket claim that SHA-1 is unacceptable, which is
+// false here. The core Go method of generations the SubjectKeyId (see
+// https://github.com/golang/go/issues/26676) also uses SHA-1, as recommended
+// by RFC 5280.
+func bigIntHash(n *big.Int) []byte {
+	h := sha1.New()    // nolint:gosec
+	h.Write(n.Bytes()) // nolint:errcheck
+	return h.Sum(nil)
+}
+
+func kubeServiceNames(service, namespace, dnsName string) []string {
+	return []string{
+		service,
+		fmt.Sprintf("%s.%s", service, namespace),
+		fmt.Sprintf("%s.%s.svc", service, namespace),
+		fmt.Sprintf("%s.%s.svc.%s", service, namespace, dnsName),
+	}
+}
+
+func generateHMACSecret() ([]byte, error) {
+	// Set the desired length of the secret key in bytes
+	keyLength := 32
+
+	// Create a byte slice to hold the random bytes
+	key := make([]byte, keyLength)
+
+	// Read random bytes from the cryptographically secure random number generator
+	_, err := rand.Read(key)
+	if err != nil {
+		return nil, fmt.Errorf("failed to generate hmack secret key: %w", err)
+	}
+
+	return key, nil
+}
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen_test.go b/adapter/internal/operator/gateway-api/crypto/certgen_test.go
new file mode 100644
index 000000000..df4d5c399
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/crypto/certgen_test.go
@@ -0,0 +1,174 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package crypto
+
+import (
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGenerateCerts(t *testing.T) {
+	type testcase struct {
+		certConfig              *Configuration
+		wantEnvoyGatewayDNSName string
+		wantEnvoyDNSName        string
+	}
+
+	run := func(t *testing.T, name string, tc testcase) {
+		t.Helper()
+
+		t.Run(name, func(t *testing.T) {
+			t.Helper()
+
+			got, err := GenerateCerts()
+			require.NoError(t, err)
+
+			roots := x509.NewCertPool()
+			ok := roots.AppendCertsFromPEM(got.CACertificate)
+			require.Truef(t, ok, "Failed to set up CA cert for testing, maybe it's an invalid PEM")
+
+			currentTime := time.Now()
+
+			err = verifyCert(got.EnvoyGatewayCertificate, roots, tc.wantEnvoyGatewayDNSName, currentTime)
+			require.NoErrorf(t, err, "Validating %s failed", name)
+
+			err = verifyCert(got.EnvoyCertificate, roots, tc.wantEnvoyDNSName, currentTime)
+			require.NoErrorf(t, err, "Validating %s failed", name)
+		})
+	}
+
+	run(t, "no configuration - use defaults", testcase{
+		certConfig:              &Configuration{},
+		wantEnvoyGatewayDNSName: DefaultEnvoyGatewayDNSPrefix,
+		wantEnvoyDNSName:        fmt.Sprintf("*.%s", "apk"),
+	})
+}
+
+func TestGeneratedValidKubeCerts(t *testing.T) {
+	now := time.Now()
+	expiry := now.Add(24 * 365 * time.Hour)
+
+	caCert, caKey, err := newCA("envoy-gateway", expiry)
+	require.NoErrorf(t, err, "Failed to generate CA cert")
+
+	egCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy-gateway",
+		altNames:   kubeServiceNames("envoy-gateway", "apk", "cluster.local"),
+	}
+	egCert, _, err := newCert(egCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy Gateway cert")
+
+	roots := x509.NewCertPool()
+	ok := roots.AppendCertsFromPEM(caCert)
+	require.Truef(t, ok, "Failed to set up CA cert for testing, maybe it's an invalid PEM")
+
+	envoyCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy",
+		altNames:   kubeServiceNames("envoy", "apk", "cluster.local"),
+	}
+	envoyCert, _, err := newCert(envoyCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy cert")
+
+	envoyRateLimitCertReq := &certificateRequest{
+		caCertPEM:  caCert,
+		caKeyPEM:   caKey,
+		expiry:     expiry,
+		commonName: "envoy",
+		altNames:   kubeServiceNames("envoy", "apk", "cluster.local"),
+	}
+
+	envoyRateLimitCert, _, err := newCert(envoyRateLimitCertReq)
+	require.NoErrorf(t, err, "Failed to generate Envoy Rate Limit Client cert")
+
+	tests := []struct {
+		name    string
+		cert    []byte
+		dnsName string
+	}{
+		{
+			name:    "envoy gateway cert",
+			cert:    egCert,
+			dnsName: "envoy-gateway",
+		},
+		{
+			name:    "envoy cert",
+			cert:    envoyCert,
+			dnsName: "envoy",
+		},
+		{
+			name:    "envoy rate limit client cert",
+			cert:    envoyRateLimitCert,
+			dnsName: "envoy",
+		},
+	}
+
+	for i := range tests {
+		tc := tests[i]
+		t.Run(tc.name, func(t *testing.T) {
+			err := verifyCert(tc.cert, roots, tc.dnsName, now)
+			require.NoErrorf(t, err, "Validating %s failed", tc.name)
+		})
+	}
+
+}
+
+func verifyCert(certPEM []byte, roots *x509.CertPool, dnsname string, currentTime time.Time) error {
+	block, _ := pem.Decode(certPEM)
+	if block == nil {
+		return fmt.Errorf("failed to decode %s certificate from PEM form", dnsname)
+	}
+
+	cert, err := x509.ParseCertificate(block.Bytes)
+	if err != nil {
+		return err
+	}
+
+	opts := x509.VerifyOptions{
+		DNSName:     dnsname,
+		Roots:       roots,
+		CurrentTime: currentTime,
+	}
+	if _, err = cert.Verify(opts); err != nil {
+		return fmt.Errorf("certificate verification failed: %w", err)
+	}
+
+	return nil
+}
+
+func TestGenerateHMACSecret(t *testing.T) {
+	bytes, _ := generateHMACSecret()
+	encodedSecret := base64.StdEncoding.EncodeToString(bytes)
+	fmt.Println("Base64 encoded secret:", encodedSecret)
+}
diff --git a/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go b/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
new file mode 100644
index 000000000..94dc8b8c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/envoy/shutdown_manager.go
@@ -0,0 +1,238 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package envoy
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+)
+
+const (
+	// ShutdownManagerPort is the port Envoy shutdown manager will listen on.
+	ShutdownManagerPort = 19002
+	// ShutdownManagerHealthCheckPath is the path used for health checks.
+	ShutdownManagerHealthCheckPath = "/healthz"
+	// ShutdownManagerReadyPath is the path used to indicate shutdown readiness.
+	ShutdownManagerReadyPath = "/shutdown/ready"
+	// ShutdownReadyFile is the file used to indicate shutdown readiness.
+	ShutdownReadyFile = "/tmp/shutdown-ready"
+)
+
+// ShutdownManager serves shutdown manager process for Envoy proxies.
+func ShutdownManager(readyTimeout time.Duration) error {
+	// Setup HTTP handler
+	handler := http.NewServeMux()
+	handler.HandleFunc(ShutdownManagerHealthCheckPath, func(_ http.ResponseWriter, _ *http.Request) {})
+	handler.HandleFunc(ShutdownManagerReadyPath, func(w http.ResponseWriter, _ *http.Request) {
+		shutdownReadyHandler(w, readyTimeout, ShutdownReadyFile)
+	})
+
+	// Setup HTTP server
+	srv := http.Server{
+		Handler:           handler,
+		Addr:              fmt.Sprintf(":%d", ShutdownManagerPort),
+		ReadTimeout:       5 * time.Second,
+		ReadHeaderTimeout: 5 * time.Second,
+		WriteTimeout:      10 * time.Second,
+		IdleTimeout:       15 * time.Second,
+	}
+
+	// Setup signal handling
+	c := make(chan struct{})
+	go func() {
+		s := make(chan os.Signal, 1)
+		signal.Notify(s, os.Interrupt, syscall.SIGTERM)
+
+		r := <-s
+		loggers.LoggerAPKOperator.Info(fmt.Sprintf("received %s", unix.SignalName(r.(syscall.Signal))))
+
+		// Shutdown HTTP server without interrupting active connections
+		if err := srv.Shutdown(context.Background()); err != nil {
+			loggers.LoggerAPKOperator.Error(err, "server shutdown error")
+		}
+		close(c)
+	}()
+
+	// Start HTTP server
+	loggers.LoggerAPKOperator.Info("starting shutdown manager")
+	if err := srv.ListenAndServe(); !errors.Is(err, http.ErrServerClosed) {
+		loggers.LoggerAPKOperator.Error(err, "starting shutdown manager failed")
+	}
+
+	// Wait until done
+	<-c
+	return nil
+}
+
+// shutdownReadyHandler handles the endpoint used by a preStop hook on the Envoy
+// container to block until ready to terminate. After the graceful drain process
+// has completed a file will be written to indicate shutdown readiness.
+func shutdownReadyHandler(w http.ResponseWriter, readyTimeout time.Duration, readyFile string) {
+	var startTime = time.Now()
+
+	loggers.LoggerAPKOperator.Info("received shutdown ready request")
+
+	// Poll for shutdown readiness
+	for {
+		// Check if ready timeout is exceeded
+		elapsedTime := time.Since(startTime)
+		if elapsedTime > readyTimeout {
+			loggers.LoggerAPKOperator.Info("shutdown readiness timeout exceeded")
+			w.WriteHeader(http.StatusInternalServerError)
+			return
+		}
+
+		_, err := os.Stat(readyFile)
+		switch {
+		case os.IsNotExist(err):
+			time.Sleep(1 * time.Second)
+		case err != nil:
+			loggers.LoggerAPKOperator.Error(err, "error checking for shutdown readiness")
+		case err == nil:
+			loggers.LoggerAPKOperator.Info("shutdown readiness detected")
+			return
+		}
+	}
+}
+
+// Shutdown is called from a preStop hook on the shutdown-manager container where
+// it will initiate a graceful drain sequence on the Envoy proxy and block until
+// connections are drained or a timeout is exceeded.
+func Shutdown(drainTimeout time.Duration, minDrainDuration time.Duration, exitAtConnections int) error {
+	var startTime = time.Now()
+	var allowedToExit = false
+
+	loggers.LoggerAPKOperator.Info(fmt.Sprintf("initiating graceful drain with %.0f second minimum drain period and %.0f second timeout",
+		minDrainDuration.Seconds(), drainTimeout.Seconds()))
+
+	// Start failing active health checks
+	if err := postEnvoyAdminAPI("healthcheck/fail"); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error failing active health checks")
+	}
+
+	// Initiate graceful drain sequence
+	if err := postEnvoyAdminAPI("drain_listeners?graceful&skip_exit"); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error initiating graceful drain")
+	}
+
+	// Poll total connections from Envoy admin API until minimum drain period has
+	// been reached and total connections reaches threshold or timeout is exceeded
+	for {
+		elapsedTime := time.Since(startTime)
+
+		conn, err := getTotalConnections()
+		if err != nil {
+			loggers.LoggerAPKOperator.Error(err, "error getting total connections")
+		}
+
+		if elapsedTime > minDrainDuration && !allowedToExit {
+			loggers.LoggerAPKOperator.Info(fmt.Sprintf("minimum drain period reached; will exit when total connections reaches %d", exitAtConnections))
+			allowedToExit = true
+		}
+
+		if elapsedTime > drainTimeout {
+			loggers.LoggerAPKOperator.Info("graceful drain sequence timeout exceeded")
+			break
+		} else if allowedToExit && conn != nil && *conn <= exitAtConnections {
+			loggers.LoggerAPKOperator.Info("graceful drain sequence completed")
+			break
+		}
+
+		time.Sleep(1 * time.Second)
+	}
+
+	// Signal to shutdownReadyHandler that drain process is complete
+	if _, err := os.Create(ShutdownReadyFile); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "error creating shutdown ready file")
+		return err
+	}
+
+	return nil
+}
+
+// postEnvoyAdminAPI sends a POST request to the Envoy admin API
+func postEnvoyAdminAPI(path string) error {
+	resp, err := http.Post(fmt.Sprintf("http://%s:%d/%s",
+		bootstrap.EnvoyAdminAddress, bootstrap.EnvoyAdminPort, path), "application/json", nil)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("unexpected response status: %s", resp.Status)
+	}
+	return nil
+
+}
+
+// getTotalConnections retrieves the total number of open connections from Envoy's server.total_connections stat
+func getTotalConnections() (*int, error) {
+	// Send request to Envoy admin API to retrieve server.total_connections stat
+	resp, err := http.Get(fmt.Sprintf("http://%s:%d//stats?filter=^server\\.total_connections$&format=json",
+		bootstrap.EnvoyAdminAddress, bootstrap.EnvoyAdminPort))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("unexpected response status: %s", resp.Status)
+	}
+	// Define struct to decode JSON response into; expecting a single stat in the response in the format:
+	// {"stats":[{"name":"server.total_connections","value":123}]}
+	var r *struct {
+		Stats []struct {
+			Name  string
+			Value int
+		}
+	}
+
+	// Decode JSON response into struct
+	if err := json.NewDecoder(resp.Body).Decode(&r); err != nil {
+		return nil, err
+	}
+
+	// Defensive check for empty stats
+	if len(r.Stats) == 0 {
+		return nil, fmt.Errorf("no stats found")
+	}
+
+	// Log and return total connections
+	c := r.Stats[0].Value
+	loggers.LoggerAPKOperator.Info(fmt.Sprintf("total connections: %d", c))
+	return &c, nil
+
+}
diff --git a/adapter/internal/operator/gateway-api/filters.go b/adapter/internal/operator/gateway-api/filters.go
new file mode 100644
index 000000000..305574d7e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/filters.go
@@ -0,0 +1,792 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+type FiltersTranslator interface {
+	HTTPFiltersTranslator
+}
+
+var _ FiltersTranslator = (*Translator)(nil)
+
+type HTTPFiltersTranslator interface {
+	processURLRewriteFilter(rewrite *gwapiv1.HTTPURLRewriteFilter, filterContext *HTTPFiltersContext)
+	processRedirectFilter(redirect *gwapiv1.HTTPRequestRedirectFilter, filterContext *HTTPFiltersContext)
+	processRequestHeaderModifierFilter(headerModifier *gwapiv1.HTTPHeaderFilter, filterContext *HTTPFiltersContext)
+	processResponseHeaderModifierFilter(headerModifier *gwapiv1.HTTPHeaderFilter, filterContext *HTTPFiltersContext)
+	processRequestMirrorFilter(filterIdx int, mirror *gwapiv1.HTTPRequestMirrorFilter, filterContext *HTTPFiltersContext, resources *Resources)
+	processExtensionRefHTTPFilter(extRef *gwapiv1.LocalObjectReference, filterContext *HTTPFiltersContext, resources *Resources)
+	processUnsupportedHTTPFilter(filterType string, filterContext *HTTPFiltersContext)
+}
+
+// HTTPFiltersContext is the context of http filters processing.
+type HTTPFiltersContext struct {
+	*HTTPFilterIR
+
+	ParentRef *RouteParentContext
+	Route     RouteContext
+	RuleIdx   int
+}
+
+// HTTPFilterIR contains the ir processing results.
+type HTTPFilterIR struct {
+	DirectResponse   *ir.DirectResponse
+	RedirectResponse *ir.Redirect
+
+	URLRewrite *ir.URLRewrite
+
+	AddRequestHeaders    []ir.AddHeader
+	RemoveRequestHeaders []string
+
+	AddResponseHeaders    []ir.AddHeader
+	RemoveResponseHeaders []string
+
+	Mirrors []*ir.RouteDestination
+
+	ExtensionRefs []*ir.UnstructuredRef
+}
+
+// ProcessHTTPFilters translates gateway api http filters to IRs.
+func (t *Translator) ProcessHTTPFilters(parentRef *RouteParentContext,
+	route RouteContext,
+	filters []gwapiv1.HTTPRouteFilter,
+	ruleIdx int,
+	resources *Resources) *HTTPFiltersContext {
+	httpFiltersContext := &HTTPFiltersContext{
+		ParentRef:    parentRef,
+		Route:        route,
+		RuleIdx:      ruleIdx,
+		HTTPFilterIR: &HTTPFilterIR{},
+	}
+	for i := range filters {
+		filter := filters[i]
+		// If an invalid filter type has been configured then skip processing any more filters
+		if httpFiltersContext.DirectResponse != nil {
+			break
+		}
+		if err := ValidateHTTPRouteFilter(&filter); err != nil {
+			t.processInvalidHTTPFilter(string(filter.Type), httpFiltersContext, err)
+			break
+		}
+
+		switch filter.Type {
+		case gwapiv1.HTTPRouteFilterURLRewrite:
+			t.processURLRewriteFilter(filter.URLRewrite, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestRedirect:
+			t.processRedirectFilter(filter.RequestRedirect, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestHeaderModifier:
+			t.processRequestHeaderModifierFilter(filter.RequestHeaderModifier, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterResponseHeaderModifier:
+			t.processResponseHeaderModifierFilter(filter.ResponseHeaderModifier, httpFiltersContext)
+		case gwapiv1.HTTPRouteFilterRequestMirror:
+			t.processRequestMirrorFilter(i, filter.RequestMirror, httpFiltersContext, resources)
+		case gwapiv1.HTTPRouteFilterExtensionRef:
+			t.processExtensionRefHTTPFilter(filter.ExtensionRef, httpFiltersContext, resources)
+		default:
+			t.processUnsupportedHTTPFilter(string(filter.Type), httpFiltersContext)
+		}
+	}
+
+	return httpFiltersContext
+}
+
+// ProcessGRPCFilters translates gateway api grpc filters to IRs.
+func (t *Translator) ProcessGRPCFilters(parentRef *RouteParentContext,
+	route RouteContext,
+	filters []v1alpha2.GRPCRouteFilter,
+	resources *Resources) *HTTPFiltersContext {
+	httpFiltersContext := &HTTPFiltersContext{
+		ParentRef: parentRef,
+		Route:     route,
+
+		HTTPFilterIR: &HTTPFilterIR{},
+	}
+	for i := range filters {
+		filter := filters[i]
+		// If an invalid filter type has been configured then skip processing any more filters
+		if httpFiltersContext.DirectResponse != nil {
+			break
+		}
+		if err := ValidateGRPCRouteFilter(&filter); err != nil {
+			t.processInvalidHTTPFilter(string(filter.Type), httpFiltersContext, err)
+			break
+		}
+
+		switch filter.Type {
+		case v1alpha2.GRPCRouteFilterRequestHeaderModifier:
+			t.processRequestHeaderModifierFilter(filter.RequestHeaderModifier, httpFiltersContext)
+		case v1alpha2.GRPCRouteFilterResponseHeaderModifier:
+			t.processResponseHeaderModifierFilter(filter.ResponseHeaderModifier, httpFiltersContext)
+		case v1alpha2.GRPCRouteFilterRequestMirror:
+			t.processRequestMirrorFilter(i, filter.RequestMirror, httpFiltersContext, resources)
+		case v1alpha2.GRPCRouteFilterExtensionRef:
+			t.processExtensionRefHTTPFilter(filter.ExtensionRef, httpFiltersContext, resources)
+		default:
+			t.processUnsupportedHTTPFilter(string(filter.Type), httpFiltersContext)
+		}
+	}
+
+	return httpFiltersContext
+}
+
+func (t *Translator) processURLRewriteFilter(
+	rewrite *gwapiv1.HTTPURLRewriteFilter,
+	filterContext *HTTPFiltersContext) {
+	if filterContext.URLRewrite != nil {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"Cannot configure multiple urlRewrite filters for a single HTTPRouteRule",
+		)
+		return
+	}
+
+	if rewrite == nil {
+		return
+	}
+
+	newURLRewrite := &ir.URLRewrite{}
+
+	if rewrite.Hostname != nil {
+		if err := t.validateHostname(string(*rewrite.Hostname)); err != nil {
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				err.Error(),
+			)
+			return
+		}
+		redirectHost := string(*rewrite.Hostname)
+		newURLRewrite.Hostname = &redirectHost
+	}
+
+	if rewrite.Path != nil {
+		switch rewrite.Path.Type {
+		case gwapiv1.FullPathHTTPPathModifier:
+			if rewrite.Path.ReplacePrefixMatch != nil {
+				errMsg := "ReplacePrefixMatch cannot be set when rewrite path type is \"ReplaceFullPath\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplaceFullPath == nil {
+				errMsg := "ReplaceFullPath must be set when rewrite path type is \"ReplaceFullPath\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplaceFullPath != nil {
+				newURLRewrite.Path = &ir.HTTPPathModifier{
+					FullReplace: rewrite.Path.ReplaceFullPath,
+				}
+			}
+		case gwapiv1.PrefixMatchHTTPPathModifier:
+			if rewrite.Path.ReplaceFullPath != nil {
+				errMsg := "ReplaceFullPath cannot be set when rewrite path type is \"ReplacePrefixMatch\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplacePrefixMatch == nil {
+				errMsg := "ReplacePrefixMatch must be set when rewrite path type is \"ReplacePrefixMatch\""
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					errMsg,
+				)
+				return
+			}
+			if rewrite.Path.ReplacePrefixMatch != nil {
+				newURLRewrite.Path = &ir.HTTPPathModifier{
+					PrefixMatchReplace: rewrite.Path.ReplacePrefixMatch,
+				}
+			}
+		default:
+			errMsg := fmt.Sprintf("Rewrite path type: %s is invalid, only \"ReplaceFullPath\" and \"ReplacePrefixMatch\" are supported", rewrite.Path.Type)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	filterContext.URLRewrite = newURLRewrite
+}
+
+func (t *Translator) processRedirectFilter(
+	redirect *gwapiv1.HTTPRequestRedirectFilter,
+	filterContext *HTTPFiltersContext) {
+	// Can't have two redirects for the same route
+	if filterContext.RedirectResponse != nil {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"Cannot configure multiple requestRedirect filters for a single HTTPRouteRule",
+		)
+		return
+	}
+
+	if redirect == nil {
+		return
+	}
+
+	redir := &ir.Redirect{}
+	if redirect.Scheme != nil {
+		// Note that gateway API may support additional schemes in the future, but unknown values
+		// must result in an UnsupportedValue status
+		if *redirect.Scheme == "http" || *redirect.Scheme == "https" {
+			redir.Scheme = redirect.Scheme
+		} else {
+			errMsg := fmt.Sprintf("Scheme: %s is unsupported, only 'https' and 'http' are supported", *redirect.Scheme)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.Hostname != nil {
+		if err := t.validateHostname(string(*redirect.Hostname)); err != nil {
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				err.Error(),
+			)
+		} else {
+			redirectHost := string(*redirect.Hostname)
+			redir.Hostname = &redirectHost
+		}
+	}
+
+	if redirect.Path != nil {
+		switch redirect.Path.Type {
+		case gwapiv1.FullPathHTTPPathModifier:
+			if redirect.Path.ReplaceFullPath != nil {
+				redir.Path = &ir.HTTPPathModifier{
+					FullReplace: redirect.Path.ReplaceFullPath,
+				}
+			}
+		case gwapiv1.PrefixMatchHTTPPathModifier:
+			if redirect.Path.ReplacePrefixMatch != nil {
+				redir.Path = &ir.HTTPPathModifier{
+					PrefixMatchReplace: redirect.Path.ReplacePrefixMatch,
+				}
+			}
+		default:
+			errMsg := fmt.Sprintf("Redirect path type: %s is invalid, only \"ReplaceFullPath\" and \"ReplacePrefixMatch\" are supported", redirect.Path.Type)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.StatusCode != nil {
+		redirectCode := int32(*redirect.StatusCode)
+		// Envoy supports 302, 303, 307, and 308, but gateway API only includes 301 and 302
+		if redirectCode == 301 || redirectCode == 302 {
+			redir.StatusCode = &redirectCode
+		} else {
+			errMsg := fmt.Sprintf("Status code %d is invalid, only 302 and 301 are supported", redirectCode)
+			filterContext.ParentRef.SetCondition(filterContext.Route,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				errMsg,
+			)
+			return
+		}
+	}
+
+	if redirect.Port != nil {
+		redirectPort := uint32(*redirect.Port)
+		redir.Port = &redirectPort
+	}
+
+	filterContext.RedirectResponse = redir
+}
+
+func (t *Translator) processRequestHeaderModifierFilter(
+	headerModifier *gwapiv1.HTTPHeaderFilter,
+	filterContext *HTTPFiltersContext) {
+	// Make sure the header modifier config actually exists
+	if headerModifier == nil {
+		return
+	}
+	emptyFilterConfig := true // keep track of whether the provided config is empty or not
+
+	// Add request headers
+	if headersToAdd := headerModifier.Add; headersToAdd != nil {
+		if len(headersToAdd) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, addHeader := range headersToAdd {
+			emptyFilterConfig = false
+			if addHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot add a header with an empty name",
+				)
+				// try to process the rest of the headers and produce a valid config.
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(addHeader.Name), "/") || strings.Contains(string(addHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("RequestHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: %q", string(addHeader.Name)),
+				)
+				continue
+			}
+			// Check if the header is a duplicate
+			headerKey := string(addHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+
+			if !canAddHeader {
+				continue
+			}
+
+			newHeader := ir.AddHeader{
+				Name:   headerKey,
+				Append: true,
+				Value:  addHeader.Value,
+			}
+
+			filterContext.AddRequestHeaders = append(filterContext.AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Set headers
+	if headersToSet := headerModifier.Set; headersToSet != nil {
+		if len(headersToSet) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, setHeader := range headersToSet {
+
+			if setHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot set a header with an empty name",
+				)
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(setHeader.Name), "/") || strings.Contains(string(setHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("RequestHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: '%s'", string(setHeader.Name)),
+				)
+				continue
+			}
+
+			// Check if the header to be set has already been configured
+			headerKey := string(setHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddRequestHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+			if !canAddHeader {
+				continue
+			}
+			newHeader := ir.AddHeader{
+				Name:   string(setHeader.Name),
+				Append: false,
+				Value:  setHeader.Value,
+			}
+
+			filterContext.AddRequestHeaders = append(filterContext.AddRequestHeaders, newHeader)
+		}
+	}
+
+	// Remove request headers
+	// As far as Envoy is concerned, it is ok to configure a header to be added/set and also in the list of
+	// headers to remove. It will remove the original header if present and then add/set the header after.
+	if headersToRemove := headerModifier.Remove; headersToRemove != nil {
+		if len(headersToRemove) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, removedHeader := range headersToRemove {
+			if removedHeader == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"RequestHeaderModifier Filter cannot remove a header with an empty name",
+				)
+				continue
+			}
+
+			canRemHeader := true
+			for _, h := range filterContext.RemoveRequestHeaders {
+				if strings.EqualFold(h, removedHeader) {
+					canRemHeader = false
+					break
+				}
+			}
+			if !canRemHeader {
+				continue
+			}
+
+			filterContext.RemoveRequestHeaders = append(filterContext.RemoveRequestHeaders, removedHeader)
+		}
+	}
+
+	// Update the status if the filter failed to configure any valid headers to add/remove
+	if len(filterContext.AddRequestHeaders) == 0 && len(filterContext.RemoveRequestHeaders) == 0 && !emptyFilterConfig {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"RequestHeaderModifier Filter did not provide valid configuration to add/set/remove any headers",
+		)
+	}
+}
+
+func (t *Translator) processResponseHeaderModifierFilter(
+	headerModifier *gwapiv1.HTTPHeaderFilter,
+	filterContext *HTTPFiltersContext) {
+	// Make sure the header modifier config actually exists
+	if headerModifier == nil {
+		return
+	}
+	emptyFilterConfig := true // keep track of whether the provided config is empty or not
+
+	// Add response headers
+	if headersToAdd := headerModifier.Add; headersToAdd != nil {
+		if len(headersToAdd) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, addHeader := range headersToAdd {
+			emptyFilterConfig = false
+			if addHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot add a header with an empty name",
+				)
+				// try to process the rest of the headers and produce a valid config.
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(addHeader.Name), "/") || strings.Contains(string(addHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("ResponseHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: %q", string(addHeader.Name)),
+				)
+				continue
+			}
+			// Check if the header is a duplicate
+			headerKey := string(addHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddResponseHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+
+			if !canAddHeader {
+				continue
+			}
+
+			newHeader := ir.AddHeader{
+				Name:   headerKey,
+				Append: true,
+				Value:  addHeader.Value,
+			}
+
+			filterContext.AddResponseHeaders = append(filterContext.AddResponseHeaders, newHeader)
+		}
+	}
+
+	// Set headers
+	if headersToSet := headerModifier.Set; headersToSet != nil {
+		if len(headersToSet) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, setHeader := range headersToSet {
+
+			if setHeader.Name == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot set a header with an empty name",
+				)
+				continue
+			}
+			// Per Gateway API specification on HTTPHeaderName, : and / are invalid characters in header names
+			if strings.Contains(string(setHeader.Name), "/") || strings.Contains(string(setHeader.Name), ":") {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					fmt.Sprintf("ResponseHeaderModifier Filter cannot set headers with a '/' or ':' character in them. Header: '%s'", string(setHeader.Name)),
+				)
+				continue
+			}
+
+			// Check if the header to be set has already been configured
+			headerKey := string(setHeader.Name)
+			canAddHeader := true
+			for _, h := range filterContext.AddResponseHeaders {
+				if strings.EqualFold(h.Name, headerKey) {
+					canAddHeader = false
+					break
+				}
+			}
+			if !canAddHeader {
+				continue
+			}
+			newHeader := ir.AddHeader{
+				Name:   string(setHeader.Name),
+				Append: false,
+				Value:  setHeader.Value,
+			}
+
+			filterContext.AddResponseHeaders = append(filterContext.AddResponseHeaders, newHeader)
+		}
+	}
+
+	// Remove response headers
+	// As far as Envoy is concerned, it is ok to configure a header to be added/set and also in the list of
+	// headers to remove. It will remove the original header if present and then add/set the header after.
+	if headersToRemove := headerModifier.Remove; headersToRemove != nil {
+		if len(headersToRemove) > 0 {
+			emptyFilterConfig = false
+		}
+		for _, removedHeader := range headersToRemove {
+			if removedHeader == "" {
+				filterContext.ParentRef.SetCondition(filterContext.Route,
+					gwapiv1.RouteConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.RouteReasonUnsupportedValue,
+					"ResponseHeaderModifier Filter cannot remove a header with an empty name",
+				)
+				continue
+			}
+
+			canRemHeader := true
+			for _, h := range filterContext.RemoveResponseHeaders {
+				if strings.EqualFold(h, removedHeader) {
+					canRemHeader = false
+					break
+				}
+			}
+			if !canRemHeader {
+				continue
+			}
+
+			filterContext.RemoveResponseHeaders = append(filterContext.RemoveResponseHeaders, removedHeader)
+
+		}
+	}
+
+	// Update the status if the filter failed to configure any valid headers to add/remove
+	if len(filterContext.AddResponseHeaders) == 0 && len(filterContext.RemoveResponseHeaders) == 0 && !emptyFilterConfig {
+		filterContext.ParentRef.SetCondition(filterContext.Route,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonUnsupportedValue,
+			"ResponseHeaderModifier Filter did not provide valid configuration to add/set/remove any headers",
+		)
+	}
+}
+
+func (t *Translator) processExtensionRefHTTPFilter(extFilter *gwapiv1.LocalObjectReference, filterContext *HTTPFiltersContext, resources *Resources) {
+	// Make sure the config actually exists.
+	if extFilter == nil {
+		return
+	}
+
+	filterNs := filterContext.Route.GetNamespace()
+	// This list of resources will be empty unless an extension is loaded (and introduces resources)
+	for _, res := range resources.ExtensionRefFilters {
+		if res.GetKind() == string(extFilter.Kind) && res.GetName() == string(extFilter.Name) && res.GetNamespace() == filterNs {
+			apiVers := res.GetAPIVersion()
+
+			// To get only the group we cut off the version.
+			// This could be a one liner but just to be safe we check that the APIVersion is properly formatted
+			idx := strings.IndexByte(apiVers, '/')
+			if idx == -1 {
+				errMsg := fmt.Sprintf("Unable to translate APIVersion for Extension Filter: kind: %s, %s/%s", res.GetKind(), filterNs, extFilter.Name)
+				t.processUnresolvedHTTPFilter(errMsg, filterContext)
+				return
+			}
+			group := apiVers[:idx]
+			if group == string(extFilter.Group) {
+				resource := res // Capture loop variable
+				filterContext.ExtensionRefs = append(filterContext.ExtensionRefs, &ir.UnstructuredRef{
+					Object: &resource,
+				})
+				return
+			}
+		}
+	}
+
+	// Matching filter not found, so set negative status condition.
+	errMsg := fmt.Sprintf("Reference %s/%s not found for filter type: %v", filterNs,
+		extFilter.Name, extFilter.Kind)
+	t.processUnresolvedHTTPFilter(errMsg, filterContext)
+}
+
+func (t *Translator) processRequestMirrorFilter(
+	filterIdx int,
+	mirrorFilter *gwapiv1.HTTPRequestMirrorFilter,
+	filterContext *HTTPFiltersContext,
+	resources *Resources) {
+
+	// Make sure the config actually exists
+	if mirrorFilter == nil {
+		return
+	}
+
+	mirrorBackend := mirrorFilter.BackendRef
+
+	// Wrap the filter's BackendObjectReference into a BackendRef so we can use existing tooling to check it
+	weight := int32(1)
+	mirrorBackendRef := gwapiv1.HTTPBackendRef{
+		BackendRef: gwapiv1.BackendRef{
+			BackendObjectReference: mirrorBackend,
+			Weight:                 &weight,
+		},
+	}
+
+	// This sets the status on the HTTPRoute, should the usage be changed so that the status message reflects that the backendRef is from the filter?
+	filterNs := filterContext.Route.GetNamespace()
+	serviceNamespace := NamespaceDerefOr(mirrorBackend.Namespace, filterNs)
+	if !t.validateBackendRef(mirrorBackendRef, filterContext.ParentRef, filterContext.Route,
+		resources, serviceNamespace, KindHTTPRoute) {
+		return
+	}
+
+	ds, _ := t.processDestination(mirrorBackendRef, filterContext.ParentRef, filterContext.Route, resources)
+
+	newMirror := &ir.RouteDestination{
+		Name:     fmt.Sprintf("%s-mirror-%d", irRouteDestinationName(filterContext.Route, filterContext.RuleIdx), filterIdx),
+		Settings: []*ir.DestinationSetting{ds},
+	}
+	filterContext.Mirrors = append(filterContext.Mirrors, newMirror)
+}
+
+func (t *Translator) processUnresolvedHTTPFilter(errMsg string, filterContext *HTTPFiltersContext) {
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionResolvedRefs,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonBackendNotFound,
+		errMsg,
+	)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
+
+func (t *Translator) processUnsupportedHTTPFilter(filterType string, filterContext *HTTPFiltersContext) {
+	errMsg := fmt.Sprintf("Unsupported filter type: %s", filterType)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
+
+func (t *Translator) processInvalidHTTPFilter(filterType string, filterContext *HTTPFiltersContext, err error) {
+	errMsg := fmt.Sprintf("Invalid filter %s: %v", filterType, err)
+	filterContext.ParentRef.SetCondition(filterContext.Route,
+		gwapiv1.RouteConditionAccepted,
+		metav1.ConditionFalse,
+		gwapiv1.RouteReasonUnsupportedValue,
+		errMsg,
+	)
+	filterContext.DirectResponse = &ir.DirectResponse{
+		Body:       &errMsg,
+		StatusCode: 500,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/helpers.go b/adapter/internal/operator/gateway-api/helpers.go
new file mode 100644
index 000000000..279d8bc43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/helpers.go
@@ -0,0 +1,461 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+const (
+	TCPProtocol = "TCP"
+	UDPProtocol = "UDP"
+	L4Protocol  = "L4"
+	L7Protocol  = "L7"
+)
+
+type protocolPort struct {
+	protocol gwapiv1.ProtocolType
+	port     int32
+}
+
+func GroupPtr(name string) *gwapiv1.Group {
+	group := gwapiv1.Group(name)
+	return &group
+}
+
+func KindPtr(name string) *gwapiv1.Kind {
+	kind := gwapiv1.Kind(name)
+	return &kind
+}
+
+func NamespacePtr(name string) *gwapiv1.Namespace {
+	namespace := gwapiv1.Namespace(name)
+	return &namespace
+}
+
+func FromNamespacesPtr(fromNamespaces gwapiv1.FromNamespaces) *gwapiv1.FromNamespaces {
+	return &fromNamespaces
+}
+
+func SectionNamePtr(name string) *gwapiv1.SectionName {
+	sectionName := gwapiv1.SectionName(name)
+	return &sectionName
+}
+
+func PortNumPtr(val int32) *gwapiv1.PortNumber {
+	portNum := gwapiv1.PortNumber(val)
+	return &portNum
+}
+
+func ObjectNamePtr(val string) *v1alpha2.ObjectName {
+	objectName := v1alpha2.ObjectName(val)
+	return &objectName
+}
+
+var (
+	PathMatchTypeDerefOr       = ptr.Deref[gwapiv1.PathMatchType]
+	GRPCMethodMatchTypeDerefOr = ptr.Deref[v1alpha2.GRPCMethodMatchType]
+	HeaderMatchTypeDerefOr     = ptr.Deref[gwapiv1.HeaderMatchType]
+	QueryParamMatchTypeDerefOr = ptr.Deref[gwapiv1.QueryParamMatchType]
+)
+
+func NamespaceDerefOr(namespace *gwapiv1.Namespace, defaultNamespace string) string {
+	if namespace != nil && *namespace != "" {
+		return string(*namespace)
+	}
+	return defaultNamespace
+}
+
+func GroupDerefOr(group *gwapiv1.Group, defaultGroup string) string {
+	if group != nil && *group != "" {
+		return string(*group)
+	}
+	return defaultGroup
+}
+
+func KindDerefOr(kind *gwapiv1.Kind, defaultKind string) string {
+	if kind != nil && *kind != "" {
+		return string(*kind)
+	}
+	return defaultKind
+}
+
+// IsRefToGateway returns whether the provided parent ref is a reference
+// to a Gateway with the given namespace/name, irrespective of whether a
+// section/listener name has been specified (i.e. a parent ref to a listener
+// on the specified gateway will return "true").
+func IsRefToGateway(parentRef gwapiv1.ParentReference, gateway types.NamespacedName) bool {
+	if parentRef.Group != nil && string(*parentRef.Group) != gwapiv1.GroupName {
+		return false
+	}
+
+	if parentRef.Kind != nil && string(*parentRef.Kind) != KindGateway {
+		return false
+	}
+
+	if parentRef.Namespace != nil && string(*parentRef.Namespace) != gateway.Namespace {
+		return false
+	}
+
+	return string(parentRef.Name) == gateway.Name
+}
+
+// GetReferencedListeners returns whether a given parent ref references a Gateway
+// in the given list, and if so, a list of the Listeners within that Gateway that
+// are included by the parent ref (either one specific Listener, or all Listeners
+// in the Gateway, depending on whether section name is specified or not).
+func GetReferencedListeners(parentRef gwapiv1.ParentReference, gateways []*GatewayContext) (bool, []*ListenerContext) {
+	var selectsGateway bool
+	var referencedListeners []*ListenerContext
+
+	for _, gateway := range gateways {
+		if !IsRefToGateway(parentRef, utils.NamespacedName(gateway)) {
+			continue
+		}
+
+		selectsGateway = true
+
+		// The parentRef may be to the entire Gateway, or to a specific listener.
+		for _, listener := range gateway.listeners {
+			if (parentRef.SectionName == nil || *parentRef.SectionName == listener.Name) && (parentRef.Port == nil || *parentRef.Port == listener.Port) {
+				referencedListeners = append(referencedListeners, listener)
+			}
+		}
+	}
+
+	return selectsGateway, referencedListeners
+}
+
+// HasReadyListener returns true if at least one Listener in the
+// provided list has a condition of "Ready: true", and false otherwise.
+func HasReadyListener(listeners []*ListenerContext) bool {
+	for _, listener := range listeners {
+		if listener.IsReady() {
+			return true
+		}
+	}
+	return false
+}
+
+// ValidateHTTPRouteFilter validates the provided filter within HTTPRoute.
+func ValidateHTTPRouteFilter(filter *gwapiv1.HTTPRouteFilter) error {
+	switch {
+	case filter == nil:
+		return errors.New("filter is nil")
+	case filter.Type == gwapiv1.HTTPRouteFilterRequestMirror ||
+		filter.Type == gwapiv1.HTTPRouteFilterURLRewrite ||
+		filter.Type == gwapiv1.HTTPRouteFilterRequestRedirect ||
+		filter.Type == gwapiv1.HTTPRouteFilterRequestHeaderModifier ||
+		filter.Type == gwapiv1.HTTPRouteFilterResponseHeaderModifier:
+		return nil
+	case filter.Type == gwapiv1.HTTPRouteFilterExtensionRef:
+		switch {
+		case filter.ExtensionRef == nil:
+			return errors.New("extensionRef field must be specified for an extended filter")
+		}
+	default:
+		return fmt.Errorf("unsupported filter type %v", filter.Type)
+	}
+	return nil
+}
+
+// ValidateGRPCRouteFilter validates the provided filter within GRPCRoute.
+func ValidateGRPCRouteFilter(filter *v1alpha2.GRPCRouteFilter, extGKs ...schema.GroupKind) error {
+	switch {
+	case filter == nil:
+		return errors.New("filter is nil")
+	case filter.Type == v1alpha2.GRPCRouteFilterRequestMirror ||
+		filter.Type == v1alpha2.GRPCRouteFilterRequestHeaderModifier ||
+		filter.Type == v1alpha2.GRPCRouteFilterResponseHeaderModifier:
+		return nil
+	case filter.Type == v1alpha2.GRPCRouteFilterExtensionRef:
+		switch {
+		case filter.ExtensionRef == nil:
+			return errors.New("extensionRef field must be specified for an extended filter")
+		default:
+			for _, gk := range extGKs {
+				if filter.ExtensionRef.Group == gwapiv1.Group(gk.Group) &&
+					filter.ExtensionRef.Kind == gwapiv1.Kind(gk.Kind) {
+					return nil
+				}
+			}
+			return fmt.Errorf("unknown kind %s/%s", string(filter.ExtensionRef.Group), string(filter.ExtensionRef.Kind))
+		}
+	default:
+		return fmt.Errorf("unsupported filter type %v", filter.Type)
+	}
+}
+
+// GatewayOwnerLabels returns the Gateway Owner labels using
+// the provided namespace and name as the values.
+func GatewayOwnerLabels(namespace, name string) map[string]string {
+	return map[string]string{
+		OwningGatewayNamespaceLabel: namespace,
+		OwningGatewayNameLabel:      name,
+	}
+}
+
+// GatewayClassOwnerLabel returns the GatewayCLass Owner label using
+// the provided name as the value.
+func GatewayClassOwnerLabel(name string) map[string]string {
+	return map[string]string{OwningGatewayClassLabel: name}
+}
+
+// servicePortToContainerPort translates a service port into an ephemeral
+// container port.
+func servicePortToContainerPort(servicePort int32) int32 {
+	// If the service port is a privileged port (1-1023)
+	// add a constant to the value converting it into an ephemeral port.
+	// This allows the container to bind to the port without needing a
+	// CAP_NET_BIND_SERVICE capability.
+	if servicePort < minEphemeralPort {
+		return servicePort + wellKnownPortShift
+	}
+	return servicePort
+}
+
+// computeHosts returns a list of the intersecting hostnames between the route
+// and the listener.
+func computeHosts(routeHostnames []string, listenerHostname *gwapiv1.Hostname) []string {
+	var listenerHostnameVal string
+	if listenerHostname != nil {
+		listenerHostnameVal = string(*listenerHostname)
+	}
+
+	// No route hostnames specified: use the listener hostname if specified,
+	// or else match all hostnames.
+	if len(routeHostnames) == 0 {
+		if len(listenerHostnameVal) > 0 {
+			return []string{listenerHostnameVal}
+		}
+
+		return []string{"*"}
+	}
+
+	var hostnames []string
+
+	for i := range routeHostnames {
+		routeHostname := routeHostnames[i]
+
+		// TODO ensure routeHostname is a valid hostname
+
+		switch {
+		// No listener hostname: use the route hostname.
+		case len(listenerHostnameVal) == 0:
+			hostnames = append(hostnames, routeHostname)
+
+		// Listener hostname matches the route hostname: use it.
+		case listenerHostnameVal == routeHostname:
+			hostnames = append(hostnames, routeHostname)
+
+		// Listener has a wildcard hostname: check if the route hostname matches.
+		case strings.HasPrefix(listenerHostnameVal, "*"):
+			if hostnameMatchesWildcardHostname(routeHostname, listenerHostnameVal) {
+				hostnames = append(hostnames, routeHostname)
+			}
+
+		// Route has a wildcard hostname: check if the listener hostname matches.
+		case strings.HasPrefix(routeHostname, "*"):
+			if hostnameMatchesWildcardHostname(listenerHostnameVal, routeHostname) {
+				hostnames = append(hostnames, listenerHostnameVal)
+			}
+
+		}
+	}
+
+	return hostnames
+}
+
+// hostnameMatchesWildcardHostname returns true if hostname has the non-wildcard
+// portion of wildcardHostname as a suffix, plus at least one DNS label matching the
+// wildcard.
+func hostnameMatchesWildcardHostname(hostname, wildcardHostname string) bool {
+	if !strings.HasSuffix(hostname, strings.TrimPrefix(wildcardHostname, "*")) {
+		return false
+	}
+
+	wildcardMatch := strings.TrimSuffix(hostname, strings.TrimPrefix(wildcardHostname, "*"))
+	return len(wildcardMatch) > 0
+}
+
+func containsPort(ports []*protocolPort, port *protocolPort) bool {
+	for _, protocolPort := range ports {
+		curProtocol, curLevel := layer4Protocol(protocolPort)
+		myProtocol, myLevel := layer4Protocol(port)
+		if protocolPort.port == port.port && (curProtocol == myProtocol && curLevel == myLevel) {
+			return true
+		}
+	}
+	return false
+}
+
+// layer4Protocol returns listener L4 protocol and listen protocol level
+func layer4Protocol(protocolPort *protocolPort) (string, string) {
+	switch protocolPort.protocol {
+	case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
+		return TCPProtocol, L7Protocol
+	case gwapiv1.TCPProtocolType:
+		return TCPProtocol, L4Protocol
+	default:
+		return UDPProtocol, L4Protocol
+	}
+}
+
+type crossNamespaceFrom struct {
+	group     string
+	kind      string
+	namespace string
+}
+
+type crossNamespaceTo struct {
+	group     string
+	kind      string
+	namespace string
+	name      string
+}
+
+func irStringKey(gatewayNs, gatewayName string) string {
+	if len(gatewayNs) > 5 {
+		gatewayNs = gatewayNs[:5]
+	}
+	return fmt.Sprintf("%s/%s", gatewayNs, gatewayName)
+}
+
+func irHTTPListenerName(listener *ListenerContext) string {
+	return fmt.Sprintf("%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name)
+}
+
+func irTLSListenerName(listener *ListenerContext, tlsRoute *TLSRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, tlsRoute.Name)
+}
+
+func irTCPListenerName(listener *ListenerContext, tcpRoute *TCPRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, tcpRoute.Name)
+}
+
+func irUDPListenerName(listener *ListenerContext, udpRoute *UDPRouteContext) string {
+	return fmt.Sprintf("%s/%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name, udpRoute.Name)
+}
+
+func irRoutePrefix(route RouteContext) string {
+	// add a "/" at the end of the prefix to prevent mismatching routes with the
+	// same prefix. For example, route prefix "/foo/" should not match a route "/foobar".
+	return fmt.Sprintf("%s/%s/%s/", strings.ToLower(string(GetRouteType(route))), route.GetNamespace(), route.GetName())
+}
+
+func irRouteName(route RouteContext, ruleIdx, matchIdx int) string {
+	return fmt.Sprintf("%srule/%d/match/%d", irRoutePrefix(route), ruleIdx, matchIdx)
+}
+
+func irRouteDestinationName(route RouteContext, ruleIdx int) string {
+	return fmt.Sprintf("%srule/%d", irRoutePrefix(route), ruleIdx)
+}
+
+func irTLSConfigs(tlsSecrets []*v1.Secret) *ir.TLSConfig {
+	if len(tlsSecrets) == 0 {
+		return nil
+	}
+
+	tlsListenerConfigs := &ir.TLSConfig{
+		Certificates: make([]ir.TLSCertificate, len(tlsSecrets)),
+	}
+	for i, tlsSecret := range tlsSecrets {
+		tlsListenerConfigs.Certificates[i] = ir.TLSCertificate{
+			Name:              irTLSListenerConfigName(tlsSecret),
+			ServerCertificate: tlsSecret.Data[v1.TLSCertKey],
+			PrivateKey:        tlsSecret.Data[v1.TLSPrivateKeyKey],
+		}
+	}
+	return tlsListenerConfigs
+}
+
+func irTLSListenerConfigName(secret *v1.Secret) string {
+	return fmt.Sprintf("%s/%s", secret.Namespace, secret.Name)
+}
+
+func protocolSliceToStringSlice(protocols []gwapiv1.ProtocolType) []string {
+	var protocolStrings []string
+	for _, protocol := range protocols {
+		protocolStrings = append(protocolStrings, string(protocol))
+	}
+	return protocolStrings
+}
+
+// func getAncestorRefForPolicy(gatewayNN types.NamespacedName, sectionName *v1alpha2.SectionName) v1alpha2.ParentReference {
+// 	return v1alpha2.ParentReference{
+// 		Group:       GroupPtr(gwapiv1.GroupName),
+// 		Kind:        KindPtr(KindGateway),
+// 		Namespace:   NamespacePtr(gatewayNN.Namespace),
+// 		Name:        gwapiv1.ObjectName(gatewayNN.Name),
+// 		SectionName: sectionName,
+// 	}
+// }
+
+// type policyTargetRouteKey struct {
+// 	Kind      string
+// 	Namespace string
+// 	Name      string
+// }
+
+// type policyRouteTargetContext struct {
+// 	RouteContext
+// 	attached bool
+// }
+
+// type policyGatewayTargetContext struct {
+// 	*GatewayContext
+// 	attached bool
+// }
+
+// listenersWithSameHTTPPort returns a list of the names of all other HTTP listeners
+// that would share the same filter chain as the provided listener when translated
+// to XDS
+func listenersWithSameHTTPPort(xdsIR *ir.Xds, listener *ir.HTTPListener) []string {
+	// if TLS is enabled, the listener would have its own filterChain in Envoy, so
+	// no conflicts are possible
+	if listener.TLS != nil {
+		return nil
+	}
+	res := []string{}
+	for _, http := range xdsIR.HTTP {
+		if http == listener {
+			continue
+		}
+		// Non-TLS listeners can be distinguished by their ports
+		if http.Port == listener.Port {
+			res = append(res, http.Name)
+		}
+	}
+	return res
+}
diff --git a/adapter/internal/operator/gateway-api/helpers_v1alpha2.go b/adapter/internal/operator/gateway-api/helpers_v1alpha2.go
new file mode 100644
index 000000000..c59a7f4f3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/helpers_v1alpha2.go
@@ -0,0 +1,205 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// TODO: [gwapiv1a2-gwapiv1]
+// This file can be removed once TLSRoute graduates to gwapiv1.
+
+func GroupPtrV1Alpha2(group string) *gwapiv1a2.Group {
+	gwGroup := gwapiv1a2.Group(group)
+	return &gwGroup
+}
+
+func KindPtrV1Alpha2(kind string) *gwapiv1a2.Kind {
+	gwKind := gwapiv1a2.Kind(kind)
+	return &gwKind
+}
+
+func NamespacePtrV1Alpha2(namespace string) *gwapiv1a2.Namespace {
+	gwNamespace := gwapiv1a2.Namespace(namespace)
+	return &gwNamespace
+}
+
+func SectionNamePtrV1Alpha2(sectionName string) *gwapiv1a2.SectionName {
+	gwSectionName := gwapiv1a2.SectionName(sectionName)
+	return &gwSectionName
+}
+
+func PortNumPtrV1Alpha2(port int) *gwapiv1a2.PortNumber {
+	pn := gwapiv1a2.PortNumber(port)
+	return &pn
+}
+
+func UpgradeParentReferences(old []gwapiv1a2.ParentReference) []gwapiv1.ParentReference {
+	newParentReferences := make([]gwapiv1.ParentReference, len(old))
+	for i, o := range old {
+		newParentReferences[i] = UpgradeParentReference(o)
+	}
+	return newParentReferences
+}
+
+// UpgradeParentReference converts gwapiv1a2.ParentReference to gwapiv1.ParentReference
+func UpgradeParentReference(old gwapiv1a2.ParentReference) gwapiv1.ParentReference {
+	upgraded := gwapiv1.ParentReference{}
+
+	if old.Group != nil {
+		upgraded.Group = GroupPtr(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		upgraded.Kind = KindPtr(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		upgraded.Namespace = NamespacePtr(string(*old.Namespace))
+	}
+
+	upgraded.Name = old.Name
+
+	if old.SectionName != nil {
+		upgraded.SectionName = SectionNamePtr(string(*old.SectionName))
+	}
+
+	if old.Port != nil {
+		upgraded.Port = PortNumPtr(int32(*old.Port))
+	}
+
+	return upgraded
+}
+
+func DowngradeParentReference(old gwapiv1.ParentReference) gwapiv1a2.ParentReference {
+	downgraded := gwapiv1a2.ParentReference{}
+
+	if old.Group != nil {
+		downgraded.Group = GroupPtrV1Alpha2(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		downgraded.Kind = KindPtrV1Alpha2(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		downgraded.Namespace = NamespacePtrV1Alpha2(string(*old.Namespace))
+	}
+
+	downgraded.Name = old.Name
+
+	if old.SectionName != nil {
+		downgraded.SectionName = SectionNamePtrV1Alpha2(string(*old.SectionName))
+	}
+
+	if old.Port != nil {
+		downgraded.Port = PortNumPtrV1Alpha2(int(*old.Port))
+	}
+
+	return downgraded
+}
+
+func UpgradeRouteParentStatuses(routeParentStatuses []gwapiv1a2.RouteParentStatus) []gwapiv1.RouteParentStatus {
+	var res []gwapiv1.RouteParentStatus
+
+	for _, rps := range routeParentStatuses {
+		res = append(res, gwapiv1.RouteParentStatus{
+			ParentRef:      UpgradeParentReference(rps.ParentRef),
+			ControllerName: rps.ControllerName,
+			Conditions:     rps.Conditions,
+		})
+	}
+
+	return res
+}
+
+func DowngradeRouteParentStatuses(routeParentStatuses []gwapiv1.RouteParentStatus) []gwapiv1a2.RouteParentStatus {
+	var res []gwapiv1a2.RouteParentStatus
+
+	for _, rps := range routeParentStatuses {
+		res = append(res, gwapiv1a2.RouteParentStatus{
+			ParentRef:      DowngradeParentReference(rps.ParentRef),
+			ControllerName: rps.ControllerName,
+			Conditions:     rps.Conditions,
+		})
+	}
+
+	return res
+}
+
+// UpgradeBackendRef converts gwapiv1a2.BackendRef to gwapiv1.BackendRef
+func UpgradeBackendRef(old gwapiv1a2.BackendRef) gwapiv1.BackendRef {
+	upgraded := gwapiv1.BackendRef{}
+
+	if old.Group != nil {
+		upgraded.Group = GroupPtr(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		upgraded.Kind = KindPtr(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		upgraded.Namespace = NamespacePtr(string(*old.Namespace))
+	}
+
+	upgraded.Name = old.Name
+
+	if old.Port != nil {
+		upgraded.Port = PortNumPtr(int32(*old.Port))
+	}
+
+	return upgraded
+}
+
+func DowngradeBackendRef(old gwapiv1.BackendRef) gwapiv1a2.BackendRef {
+	downgraded := gwapiv1a2.BackendRef{}
+
+	if old.Group != nil {
+		downgraded.Group = GroupPtrV1Alpha2(string(*old.Group))
+	}
+
+	if old.Kind != nil {
+		downgraded.Kind = KindPtrV1Alpha2(string(*old.Kind))
+	}
+
+	if old.Namespace != nil {
+		downgraded.Namespace = NamespacePtrV1Alpha2(string(*old.Namespace))
+	}
+
+	downgraded.Name = old.Name
+
+	if old.Port != nil {
+		downgraded.Port = PortNumPtrV1Alpha2(int(*old.Port))
+	}
+
+	return downgraded
+}
+
+func NamespaceDerefOrAlpha(namespace *gwapiv1a2.Namespace, defaultNamespace string) string {
+	if namespace != nil && *namespace != "" {
+		return string(*namespace)
+	}
+	return defaultNamespace
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
new file mode 100644
index 000000000..de1057994
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
@@ -0,0 +1,135 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/config"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// ResourceRender renders Kubernetes infrastructure resources
+// based on Infra IR resources.
+type ResourceRender interface {
+	Name() string
+	ServiceAccount() (*corev1.ServiceAccount, error)
+	Service() (*corev1.Service, error)
+	ConfigMap() (*corev1.ConfigMap, error)
+	Deployment() (*appsv1.Deployment, error)
+	HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPodAutoscaler, error)
+}
+
+// Infra manages the creation and deletion of Kubernetes infrastructure
+// based on Infra IR resources.
+type Infra struct {
+	// Namespace is the Namespace used for managed infra.
+	Namespace string
+
+	// Client wrap k8s client.
+	Client *InfraClient
+}
+
+// NewInfra returns a new Infra.
+func NewInfra(cli client.Client) *Infra {
+	conf := config.ReadConfigs()
+	return &Infra{
+		Namespace: conf.Envoy.Namespace,
+		Client:    New(cli),
+	}
+}
+
+// createOrUpdate creates a ServiceAccount/ConfigMap/Deployment/Service in the kube api server based on the
+// provided ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdate(ctx context.Context, r ResourceRender) error {
+
+	// certs, err := crypto.GenerateCerts()
+	// if err != nil {
+	// 	return fmt.Errorf("failed to generate certificates: %w", err)
+	// }
+	// secrets, err := gatewayapi.CreateOrUpdateSecrets(ctx, i.Client.Client, gatewayapi.CertsToSecret(i.Namespace, certs), true)
+
+	// if err != nil {
+	// 	if errors.Is(err, gatewayapi.ErrSecretExists) {
+	// 		loggers.LoggerAPKOperator.Info(err.Error())
+	// 	} else {
+	// 		return fmt.Errorf("failed to create or update secrets: %w", err)
+	// 	}
+	// } else {
+	// 	for i := range secrets {
+	// 		s := secrets[i]
+	// 		loggers.LoggerAPKOperator.Info("created secret", "namespace", s.Namespace, "name", s.Name)
+	// 	}
+	// }
+
+	if err := i.createOrUpdateServiceAccount(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	// if err := i.createOrUpdateConfigMap(ctx, r); err != nil {
+	// 	return fmt.Errorf("failed to create or update configmap %s/%s: %w", i.Namespace, r.Name(), err)
+	// }
+
+	if err := i.createOrUpdateDeployment(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update deployment %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.createOrUpdateService(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update service %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.createOrUpdateHPA(ctx, r); err != nil {
+		return fmt.Errorf("failed to create or update hpa %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	return nil
+}
+
+// delete deletes the ServiceAccount/ConfigMap/Deployment/Service in the kube api server, if it exists.
+func (i *Infra) delete(ctx context.Context, r ResourceRender) error {
+	if err := i.deleteServiceAccount(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteConfigMap(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete configmap %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteDeployment(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete deployment %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteService(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete service %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	if err := i.deleteHPA(ctx, r); err != nil {
+		return fmt.Errorf("failed to delete hpa %s/%s: %w", i.Namespace, r.Name(), err)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
new file mode 100644
index 000000000..afe78efc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_client.go
@@ -0,0 +1,89 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/client-go/util/retry"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type InfraClient struct {
+	client.Client
+}
+
+func New(cli client.Client) *InfraClient {
+	return &InfraClient{
+		Client: cli,
+	}
+}
+
+func (cli *InfraClient) CreateOrUpdate(ctx context.Context, key client.ObjectKey, current client.Object, specific client.Object, updateChecker func() bool) error {
+	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
+		if err := cli.Client.Get(ctx, key, current); err != nil {
+			loggers.LoggerAPI.Debugf("Error while getting resource %+v : %v", key, err)
+			if kerrors.IsNotFound(err) {
+				loggers.LoggerAPI.Infof("Creating a new resource %+v", key)
+				// Create if it does not exist.
+				if err := cli.Client.Create(ctx, specific); err != nil {
+					return fmt.Errorf("for Create: %w", err)
+				}
+			}
+		} else {
+			// Since the client.Object does not have a specific Spec field to compare
+			// just perform an update for now.
+			if updateChecker() {
+				specific.SetUID(current.GetUID())
+				if err := cli.Client.Update(ctx, specific); err != nil {
+					return fmt.Errorf("for Update: %w", err)
+				}
+			}
+		}
+
+		return nil
+	})
+}
+
+func (cli *InfraClient) Delete(ctx context.Context, object client.Object) error {
+	if err := cli.Client.Delete(ctx, object); err != nil {
+		if kerrors.IsNotFound(err) {
+			return nil
+		}
+		return err
+	}
+
+	return nil
+}
+
+// GetUID retrieves the uid of one resource.
+func (cli *InfraClient) GetUID(ctx context.Context, key client.ObjectKey, current client.Object) (types.UID, error) {
+	if err := cli.Client.Get(ctx, key, current); err != nil {
+		return "", err
+	}
+	return current.GetUID(), nil
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
new file mode 100644
index 000000000..ee11d8530
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra_resource.go
@@ -0,0 +1,209 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+// createOrUpdateServiceAccount creates a ServiceAccount in the kube api server based on the
+// provided ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdateServiceAccount(ctx context.Context, r ResourceRender) error {
+	sa, err := r.ServiceAccount()
+	if err != nil {
+		return err
+	}
+
+	current := &corev1.ServiceAccount{}
+	key := utils.NamespacedName(sa)
+
+	return i.Client.CreateOrUpdate(ctx, key, current, sa, func() bool {
+		// the service account never changed, does not need to update
+		// fixes https://github.com/envoyproxy/gateway/issues/1604
+		return false
+	})
+}
+
+// // createOrUpdateConfigMap creates a ConfigMap in the Kube api server based on the provided
+// // ResourceRender, if it doesn't exist and updates it if it does.
+// func (i *Infra) createOrUpdateConfigMap(ctx context.Context, r ResourceRender) error {
+// 	cm, err := r.ConfigMap()
+// 	if err != nil {
+// 		return err
+// 	}
+
+// 	if cm == nil {
+// 		return nil
+// 	}
+// 	current := &corev1.ConfigMap{}
+// 	key := types.NamespacedName{
+// 		Namespace: cm.Namespace,
+// 		Name:      cm.Name,
+// 	}
+
+// 	return i.Client.CreateOrUpdate(ctx, key, current, cm, func() bool {
+// 		return !reflect.DeepEqual(cm.Data, current.Data)
+// 	})
+// }
+
+// createOrUpdateDeployment creates a Deployment in the kube api server based on the provided
+// ResourceRender, if it doesn't exist and updates it if it does.
+func (i *Infra) createOrUpdateDeployment(ctx context.Context, r ResourceRender) error {
+	deployment, err := r.Deployment()
+	if err != nil {
+		return err
+	}
+
+	current := &appsv1.Deployment{}
+	key := types.NamespacedName{
+		Namespace: deployment.Namespace,
+		Name:      deployment.Name,
+	}
+
+	hpa, err := r.HorizontalPodAutoscaler()
+	if err != nil {
+		return err
+	}
+
+	var opts cmp.Options
+	if hpa != nil {
+		opts = append(opts, cmpopts.IgnoreFields(appsv1.DeploymentSpec{}, "Replicas"))
+	}
+
+	return i.Client.CreateOrUpdate(ctx, key, current, deployment, func() bool {
+		return !cmp.Equal(current.Spec, deployment.Spec, opts...)
+	})
+}
+
+// createOrUpdateHPA creates HorizontalPodAutoscaler object in the kube api server based on
+// the provided ResourceRender, if it doesn't exist and updates it if it does,
+// and delete hpa if not set.
+func (i *Infra) createOrUpdateHPA(ctx context.Context, r ResourceRender) error {
+	hpa, err := r.HorizontalPodAutoscaler()
+	if err != nil {
+		return err
+	}
+
+	// when HorizontalPodAutoscaler is not set,
+	// then delete the object in the kube api server if any.
+	if hpa == nil {
+		return i.deleteHPA(ctx, r)
+	}
+	current := &autoscalingv2.HorizontalPodAutoscaler{}
+	key := types.NamespacedName{
+		Namespace: hpa.Namespace,
+		Name:      hpa.Name,
+	}
+	return i.Client.CreateOrUpdate(ctx, key, current, hpa, func() bool {
+		return !cmp.Equal(hpa.Spec, current.Spec)
+	})
+}
+
+// createOrUpdateRateLimitService creates a Service in the kube api server based on the provided ResourceRender,
+// if it doesn't exist or updates it if it does.
+func (i *Infra) createOrUpdateService(ctx context.Context, r ResourceRender) error {
+	svc, err := r.Service()
+	if err != nil {
+		return err
+	}
+
+	current := &corev1.Service{}
+	key := types.NamespacedName{
+		Namespace: svc.Namespace,
+		Name:      svc.Name,
+	}
+
+	return i.Client.CreateOrUpdate(ctx, key, current, svc, func() bool {
+		return !resource.CompareSvc(svc, current)
+	})
+}
+
+// deleteServiceAccount deletes the ServiceAccount in the kube api server, if it exists.
+func (i *Infra) deleteServiceAccount(ctx context.Context, r ResourceRender) error {
+	sa := &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, sa)
+}
+
+// deleteDeployment deletes the Envoy Deployment in the kube api server, if it exists.
+func (i *Infra) deleteDeployment(ctx context.Context, r ResourceRender) error {
+	deployment := &appsv1.Deployment{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, deployment)
+}
+
+// deleteConfigMap deletes the ConfigMap in the kube api server, if it exists.
+func (i *Infra) deleteConfigMap(ctx context.Context, r ResourceRender) error {
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, cm)
+}
+
+// deleteService deletes the Service in the kube api server, if it exists.
+func (i *Infra) deleteService(ctx context.Context, r ResourceRender) error {
+	svc := &corev1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, svc)
+}
+
+// deleteHpa deletes the Horizontal Pod Autoscaler associated to its renderer, if it exists.
+func (i *Infra) deleteHPA(ctx context.Context, r ResourceRender) error {
+	hpa := &autoscalingv2.HorizontalPodAutoscaler{
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: i.Namespace,
+			Name:      r.Name(),
+		},
+	}
+
+	return i.Client.Delete(ctx, hpa)
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
new file mode 100644
index 000000000..d301e3059
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -0,0 +1,728 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/wso2/apk/adapter/config"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/envoy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/version"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	utils "github.com/wso2/apk/adapter/pkg/utils/misc"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	SdsCAFilename   = "xds-trusted-ca.json"
+	SdsCertFilename = "xds-certificate.json"
+	// XdsTLSCertFilename is the fully qualified path of the file containing Envoy's
+	// xDS server TLS certificate.
+	XdsTLSCertFilename = "/home/wso2/security/keystore/router.crt"
+	// XdsTLSCertFilename = "/home/wso2/security/keystore/router.crt"
+	// XdsTLSKeyFilename is the fully qualified path of the file containing Envoy's
+	// xDS server TLS key.
+	XdsTLSKeyFilename = "/home/wso2/security/keystore/router.key"
+	// XdsTLSKeyFilename = "/home/wso2/security/keystore/router.key"
+	// XdsTLSCaFilename is the fully qualified path of the file containing Envoy's
+	// trusted CA certificate.
+	// XdsTLSCaFilename = "/certs/ca.crt"
+	XdsTLSCaFilename = "/home/wso2/security/truststore/adapter.crt"
+	// envoyContainerName is the name of the Envoy container.
+	envoyContainerName    = "envoy"
+	enforcerContainerName = "enforcer"
+	// envoyNsEnvVar is the name of the Envoy Gateway namespace environment variable.
+	envoyNsEnvVar = "ENVOY_GATEWAY_NAMESPACE"
+	// envoyPodEnvVar is the name of the Envoy pod name environment variable.
+	envoyPodEnvVar = "ENVOY_POD_NAME"
+)
+
+var (
+	// xDS certificate rotation is supported by using SDS path-based resource files.
+	SdsCAConfigMapData = fmt.Sprintf(`{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",`+
+		`"name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"%s"},`+
+		`"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}`, XdsTLSCaFilename)
+	SdsCertConfigMapData = fmt.Sprintf(`{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",`+
+		`"name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"%s"},`+
+		`"private_key":{"filename":"%s"}}}]}`, XdsTLSCertFilename, XdsTLSKeyFilename)
+)
+
+// ExpectedResourceHashedName returns expected resource hashed name including up to the 48 characters of the original name.
+func ExpectedResourceHashedName(name string) string {
+	hashedName := utils.GetHashedName(name, 35)
+	return hashedName
+}
+
+// EnvoyAppLabel returns the labels used for all Envoy resources.
+func EnvoyAppLabel() map[string]string {
+	return map[string]string{
+		"app.kubernetes.io/name":       "envoy",
+		"app.kubernetes.io/component":  "proxy",
+		"app.kubernetes.io/managed-by": "envoy-gateway",
+	}
+}
+
+// EnvoyAppLabelSelector returns the labels used for all Envoy resources.
+func EnvoyAppLabelSelector() []string {
+	return []string{
+		"app.kubernetes.io/name=envoy",
+		"app.kubernetes.io/component=proxy",
+		"app.kubernetes.io/managed-by=envoy-gateway",
+	}
+}
+
+// envoyLabels returns the labels, including extraLabels, used for Envoy resources.
+func envoyLabels(extraLabels map[string]string) map[string]string {
+	labels := EnvoyAppLabel()
+	for k, v := range extraLabels {
+		labels[k] = v
+	}
+
+	return labels
+}
+
+func enablePrometheus(infra *ir.ProxyInfra) bool {
+	return false
+}
+
+// expectedProxyContainers returns expected proxy containers.
+func expectedProxyContainers(infra *ir.ProxyInfra,
+	deploymentConfig *egv1a1.KubernetesDeploymentSpec,
+	shutdownConfig *egv1a1.ShutdownConfig) ([]corev1.Container, error) {
+	// Define slice to hold container ports
+	var ports []corev1.ContainerPort
+
+	// Iterate over listeners and ports to get container ports
+	for _, listener := range infra.Listeners {
+		for _, p := range listener.Ports {
+			var protocol corev1.Protocol
+			switch p.Protocol {
+			case ir.HTTPProtocolType, ir.HTTPSProtocolType, ir.TLSProtocolType, ir.TCPProtocolType:
+				protocol = corev1.ProtocolTCP
+			case ir.UDPProtocolType:
+				protocol = corev1.ProtocolUDP
+			default:
+				return nil, fmt.Errorf("invalid protocol %q", p.Protocol)
+			}
+			port := corev1.ContainerPort{
+				// hashed container port name including up to the 6 characters of the port name and the maximum of 15 characters.
+				Name:          utils.GetHashedName(p.Name, 6),
+				ContainerPort: p.ContainerPort,
+				Protocol:      protocol,
+			}
+			ports = append(ports, port)
+		}
+	}
+
+	if enablePrometheus(infra) {
+		ports = append(ports, corev1.ContainerPort{
+			Name:          "metrics",
+			ContainerPort: bootstrap.EnvoyReadinessPort, // TODO: make this configurable
+			Protocol:      corev1.ProtocolTCP,
+		})
+	}
+
+	var bootstrapConfigurations string
+
+	var proxyMetrics *egv1a1.ProxyMetrics
+
+	// Get the default Bootstrap
+	bootstrapConfigurations, err := bootstrap.GetRenderedBootstrapConfig(proxyMetrics)
+	if err != nil {
+		return nil, err
+	}
+
+	args := []string{
+		fmt.Sprintf("--service-cluster %s", infra.Name),
+		fmt.Sprintf("--service-node $(%s)", envoyPodEnvVar),
+		fmt.Sprintf("--config-yaml %s", bootstrapConfigurations),
+		fmt.Sprintf("--log-level %s", "warn"),
+		"--cpuset-threads",
+	}
+
+	// if infra.Config != nil &&
+	// 	infra.Config.Spec.Concurrency != nil {
+	// 	args = append(args, fmt.Sprintf("--concurrency %d", *infra.Config.Spec.Concurrency))
+	// }
+
+	// if componentsLogLevel := logging.GetEnvoyProxyComponentLevel(); componentsLogLevel != "" {
+	// 	args = append(args, fmt.Sprintf("--component-log-level %s", componentsLogLevel))
+	// }
+
+	if shutdownConfig != nil && shutdownConfig.DrainTimeout != nil {
+		args = append(args, fmt.Sprintf("--drain-time-s %.0f", shutdownConfig.DrainTimeout.Seconds()))
+	}
+
+	// if infra.Config != nil {
+	// 	args = append(args, infra.Config.Spec.ExtraArgs...)
+	// }
+
+	containers := []corev1.Container{
+		{
+			Name:                     envoyContainerName,
+			Image:                    *deploymentConfig.EnvoyProxyContainer.Image,
+			ImagePullPolicy:          corev1.PullIfNotPresent,
+			Command:                  []string{"envoy"},
+			Args:                     args,
+			Env:                      expectedContainerEnv(deploymentConfig.EnvoyProxyContainer),
+			Resources:                *deploymentConfig.EnvoyProxyContainer.Resources,
+			SecurityContext:          deploymentConfig.EnvoyProxyContainer.SecurityContext,
+			Ports:                    ports,
+			VolumeMounts:             expectedContainerVolumeMounts(deploymentConfig.EnvoyProxyContainer),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			ReadinessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   bootstrap.EnvoyReadinessPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: bootstrap.EnvoyReadinessPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			Lifecycle: &corev1.Lifecycle{
+				PreStop: &corev1.LifecycleHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerReadyPath,
+						Port:   intstr.FromInt32(envoy.ShutdownManagerPort),
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+			},
+		},
+		{
+			Name:                     "shutdown-manager",
+			Image:                    expectedShutdownManagerImage(),
+			ImagePullPolicy:          corev1.PullIfNotPresent,
+			Command:                  []string{"envoy-gateway"},
+			Args:                     expectedShutdownManagerArgs(shutdownConfig),
+			Env:                      expectedContainerEnv(nil),
+			Resources:                *egv1a1.DefaultShutdownManagerContainerResourceRequirements(),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			ReadinessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerHealthCheckPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: envoy.ShutdownManagerPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			LivenessProbe: &corev1.Probe{
+				ProbeHandler: corev1.ProbeHandler{
+					HTTPGet: &corev1.HTTPGetAction{
+						Path:   envoy.ShutdownManagerHealthCheckPath,
+						Port:   intstr.IntOrString{Type: intstr.Int, IntVal: envoy.ShutdownManagerPort},
+						Scheme: corev1.URISchemeHTTP,
+					},
+				},
+				TimeoutSeconds:   1,
+				PeriodSeconds:    10,
+				SuccessThreshold: 1,
+				FailureThreshold: 3,
+			},
+			Lifecycle: &corev1.Lifecycle{
+				PreStop: &corev1.LifecycleHandler{
+					Exec: &corev1.ExecAction{
+						Command: expectedShutdownPreStopCommand(shutdownConfig),
+					},
+				},
+			},
+		},
+		{
+			Name:            enforcerContainerName,
+			Image:           *deploymentConfig.EnforcerContainer.Image,
+			ImagePullPolicy: corev1.PullIfNotPresent,
+			// Command:                  []string{"envoy"},
+			// Args:                     args,
+			Env:                      expectedEnforcerEnv(deploymentConfig.EnforcerContainer),
+			Resources:                *deploymentConfig.EnforcerContainer.Resources,
+			SecurityContext:          deploymentConfig.EnforcerContainer.SecurityContext,
+			Ports:                    expectedEnforcerPorts(),
+			VolumeMounts:             expectedEnforcerVolumeMounts(deploymentConfig.EnforcerContainer),
+			TerminationMessagePolicy: corev1.TerminationMessageReadFile,
+			TerminationMessagePath:   "/dev/termination-log",
+			//todo(amali)
+			// 	ReadinessProbe: &corev1.Probe{
+			// 		ProbeHandler: corev1.ProbeHandler{
+			// 			Exec: &corev1.ExecAction{
+			// 				Command: []string{"sh", "check_health.sh"},
+			// 			},
+			// 		},
+			// 		TimeoutSeconds:      1,
+			// 		PeriodSeconds:       20,
+			// 		SuccessThreshold:    1,
+			// 		FailureThreshold:    5,
+			// 		InitialDelaySeconds: 20,
+			// 	},
+			// 	LivenessProbe: &corev1.Probe{
+			// 		ProbeHandler: corev1.ProbeHandler{
+			// 			Exec: &corev1.ExecAction{
+			// 				Command: []string{"sh", "check_health.sh"},
+			// 			},
+			// 		},
+			// 		TimeoutSeconds:      1,
+			// 		PeriodSeconds:       20,
+			// 		SuccessThreshold:    1,
+			// 		FailureThreshold:    5,
+			// 		InitialDelaySeconds: 20,
+			// 	},
+		},
+	}
+
+	return containers, nil
+}
+
+func expectedShutdownManagerImage() string {
+	if v := version.Get().ShutdownManagerVersion; v != "" {
+		return fmt.Sprintf("%s:%s", strings.Split(egv1a1.DefaultShutdownManagerImage, ":")[0], v)
+	}
+	return egv1a1.DefaultShutdownManagerImage
+}
+
+func expectedShutdownManagerArgs(cfg *egv1a1.ShutdownConfig) []string {
+	args := []string{"envoy", "shutdown-manager"}
+	if cfg != nil && cfg.DrainTimeout != nil {
+		args = append(args, fmt.Sprintf("--ready-timeout=%.0fs", cfg.DrainTimeout.Seconds()+10))
+	}
+	return args
+}
+
+func expectedShutdownPreStopCommand(cfg *egv1a1.ShutdownConfig) []string {
+	command := []string{"envoy-gateway", "envoy", "shutdown"}
+
+	if cfg == nil {
+		return command
+	}
+
+	if cfg.DrainTimeout != nil {
+		command = append(command, fmt.Sprintf("--drain-timeout=%.0fs", cfg.DrainTimeout.Seconds()))
+	}
+
+	if cfg.MinDrainDuration != nil {
+		command = append(command, fmt.Sprintf("--min-drain-duration=%.0fs", cfg.MinDrainDuration.Seconds()))
+	}
+
+	return command
+}
+
+// expectedContainerVolumeMounts returns expected proxy container volume mounts.
+func expectedContainerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		// {
+		// 	Name:      "certs",
+		// 	MountPath: "/certs",
+		// 	ReadOnly:  true,
+		// },
+		// {
+		// 	Name:      "sds",
+		// 	MountPath: "/sds",
+		// },
+		{
+			Name:      "ratelimiter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/ratelimiter-ca.crt",
+			SubPath:   "ca.crt",
+		},
+		{
+			Name:      "ratelimiter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/ratelimiter.crt",
+			SubPath:   "tls.crt",
+		},
+		// {
+		// 	Name:      "log-conf-volume",
+		// 	MountPath: "/home/wso2/conf/",
+		// },
+		{
+			Name:      "enforcer-keystore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/enforcer.crt",
+			SubPath:   "tls.crt",
+		},
+		{
+			Name:      "adapter-truststore-secret-volume",
+			MountPath: "/home/wso2/security/truststore/adapter.crt",
+			SubPath:   "tls.crt",
+		},
+		{
+			MountPath: "/home/wso2/security/keystore/router.crt",
+			Name:      "router-keystore-secret-volume",
+			SubPath:   "tls.crt",
+		},
+		{
+			MountPath: "/home/wso2/security/keystore/router.key",
+			Name:      "router-keystore-secret-volume",
+			SubPath:   "tls.key",
+		},
+	}
+
+	return resource.ExpectedContainerVolumeMounts(containerSpec, volumeMounts)
+}
+
+func expectedEnforcerPorts() []corev1.ContainerPort {
+	ports := []corev1.ContainerPort{
+		{
+			Name:          "ext-auth",
+			ContainerPort: int32(8081),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			// Name:          "ExtAuthServer",
+			ContainerPort: int32(9001),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "debug",
+			ContainerPort: int32(5006),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "jwks",
+			ContainerPort: int32(9092),
+			Protocol:      corev1.ProtocolTCP,
+		},
+		{
+			Name:          "cc-xds",
+			ContainerPort: int32(18002),
+			Protocol:      corev1.ProtocolTCP,
+		},
+	}
+
+	return ports
+}
+
+// expectedContainerVolumeMounts returns expected proxy container volume mounts.
+func expectedEnforcerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.VolumeMount {
+	volumeMounts := []corev1.VolumeMount{
+		{
+			Name:      "tmp",
+			MountPath: "/tmp",
+			ReadOnly:  true,
+		},
+		{
+			Name:      "enforcer-keystore-secret-volume",
+			MountPath: "/home/wso2/security/keystore/enforcer.key",
+			SubPath:   "tls.key",
+		},
+
+		{MountPath: "/home/wso2/security/keystore/enforcer.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/apk.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "ca.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/enforcer.crt",
+			Name:    "enforcer-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/adapter.crt",
+			Name:    "adapter-truststore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		{MountPath: "/home/wso2/security/truststore/router.crt",
+			Name:    "router-keystore-secret-volume",
+			SubPath: "tls.crt",
+		},
+		// {MountPath: "/home/wso2/conf/",
+		// 	Name: "log-conf-volume",
+		// },
+		{MountPath: "/home/wso2/security/keystore/mg.pem",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/mg.pem",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.pem",
+		},
+		{MountPath: "/home/wso2/security/keystore/mg.key",
+			Name:    "enforcer-jwt-secret-volume",
+			SubPath: "mg.key",
+		},
+		{MountPath: "/home/wso2/security/truststore/wso2carbon.pem",
+			Name:    "enforcer-trusted-certs",
+			SubPath: "wso2carbon.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/wso2-apim-carbon.pem",
+			Name:    "enforcer-apikey-cert",
+			SubPath: "wso2-apim-carbon.pem",
+		},
+		{MountPath: "/home/wso2/security/truststore/idp.pem",
+			Name:    "idp-certificate-secret-volume",
+			SubPath: "wso2carbon.pem",
+		},
+	}
+
+	return resource.ExpectedContainerVolumeMounts(containerSpec, volumeMounts)
+}
+
+// expectedDeploymentVolumes returns expected proxy deployment volumes.
+func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+	volumes := []corev1.Volume{
+		// {
+		// 	Name: "certs",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		Secret: &corev1.SecretVolumeSource{
+		// 			SecretName:  "envoy",
+		// 			DefaultMode: ptr.To[int32](420),
+		// 		},
+		// 	},
+		// },
+		// {
+		// 	Name: "sds",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
+		// 			LocalObjectReference: corev1.LocalObjectReference{
+		// 				Name: ExpectedResourceHashedName(name),
+		// 			},
+		// 			Items: []corev1.KeyToPath{
+		// 				{
+		// 					Key:  SdsCAFilename,
+		// 					Path: SdsCAFilename,
+		// 				},
+		// 				{
+		// 					Key:  SdsCertFilename,
+		// 					Path: SdsCertFilename,
+		// 				},
+		// 			},
+		// 			DefaultMode: ptr.To[int32](420),
+		// 			Optional:    ptr.To(false),
+		// 		},
+		// 	},
+		// },
+		{
+			Name: "ratelimiter-truststore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					SecretName:  "apk-test-wso2-apk-ratelimiter-server-cert",
+					DefaultMode: ptr.To[int32](420),
+				},
+			},
+		},
+		{
+			Name: "enforcer-keystore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-server-cert",
+				},
+			},
+		},
+		// {
+		// 	Name: "log-conf-volume",
+		// 	VolumeSource: corev1.VolumeSource{
+		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
+		// 			DefaultMode: ptr.To[int32](420),
+		// 			LocalObjectReference: corev1.LocalObjectReference{
+		// 				Name: "apk-test-wso2-apk-log-conf",
+		// 			},
+		// 		},
+		// 	},
+		// },
+		{
+			Name: "router-keystore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "envoy-cert",
+				},
+			},
+		},
+		{
+			Name: "adapter-truststore-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-adapter-server-cert",
+				},
+			},
+		},
+		{
+			Name: "enforcer-jwt-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-keystore-secret",
+				},
+			},
+		},
+		{
+			Name: "enforcer-trusted-certs",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "enforcer-apikey-cert",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "idp-certificate-secret-volume",
+			VolumeSource: corev1.VolumeSource{
+				Secret: &corev1.SecretVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+				},
+			},
+		},
+		{
+			Name: "tmp",
+			VolumeSource: corev1.VolumeSource{
+				EmptyDir: &corev1.EmptyDirVolumeSource{},
+			},
+		},
+	}
+
+	return resource.ExpectedDeploymentVolumes(deploymentSpec.Pod, volumes)
+}
+
+// expectedContainerEnv returns expected proxy container envs.
+func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
+	env := []corev1.EnvVar{
+		{
+			Name: envoyNsEnvVar,
+			ValueFrom: &corev1.EnvVarSource{
+				FieldRef: &corev1.ObjectFieldSelector{
+					APIVersion: "v1",
+					FieldPath:  "metadata.namespace",
+				},
+			},
+		},
+		{
+			Name: envoyPodEnvVar,
+			ValueFrom: &corev1.EnvVarSource{
+				FieldRef: &corev1.ObjectFieldSelector{
+					APIVersion: "v1",
+					FieldPath:  "metadata.name",
+				},
+			},
+		},
+	}
+
+	if containerSpec != nil {
+		return resource.ExpectedContainerEnv(containerSpec, env)
+	}
+	return env
+
+}
+
+func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
+	conf := config.ReadConfigs()
+	adapterNs := conf.Adapter.Namespace
+	gatewayNs := conf.Envoy.Namespace
+	env := []corev1.EnvVar{
+		{
+			Name:  "ADAPTER_HOST_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "ADAPTER_HOST",
+			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "COMMON_CONTROLLER_HOST_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "COMMON_CONTROLLER_HOST",
+			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+		},
+		{
+			Name:  "ENFORCER_PRIVATE_KEY_PATH",
+			Value: "/home/wso2/security/keystore/enforcer.key",
+		},
+		{
+			Name:  "ENFORCER_PUBLIC_CERT_PATH",
+			Value: "/home/wso2/security/keystore/enforcer.crt",
+		},
+		{
+			Name:  "ENFORCER_SERVER_NAME",
+			Value: fmt.Sprintf("apk-test-wso2-apk-enforcer-service.%s.svc", gatewayNs),
+		},
+		{
+			Name:  "TRUSTED_CA_CERTS_PATH",
+			Value: "/home/wso2/security/truststore",
+		},
+		{
+			Name:  "ADAPTER_XDS_PORT",
+			Value: "18000",
+		},
+		{
+			Name:  "COMMON_CONTROLLER_XDS_PORT",
+			Value: "18002",
+		},
+		{
+			Name:  "COMMON_CONTROLLER_REST_PORT",
+			Value: "18003",
+		},
+		{
+			Name:  "ENFORCER_LABEL",
+			Value: "wso2-apk-default",
+		},
+		{
+			Name:  "ENFORCER_REGION",
+			Value: "UNKNOWN",
+		},
+		{
+			Name:  "XDS_MAX_MSG_SIZE",
+			Value: "4194304",
+		},
+		{
+			Name:  "XDS_MAX_RETRIES",
+			Value: "3",
+		},
+		{
+			Name:  "JAVA_OPTS",
+			Value: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+		},
+	}
+
+	if containerSpec != nil {
+		return resource.ExpectedContainerEnv(containerSpec, env)
+	}
+	return env
+
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
new file mode 100644
index 000000000..3947f7b5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -0,0 +1,351 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"fmt"
+	"strconv"
+
+	"golang.org/x/exp/maps"
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+type ResourceRender struct {
+	infra *ir.ProxyInfra
+
+	// Namespace is the Namespace used for managed infra.
+	Namespace string
+}
+
+func NewResourceRender(ns string, infra *ir.ProxyInfra) *ResourceRender {
+	return &ResourceRender{
+		Namespace: ns,
+		infra:     infra,
+	}
+}
+
+func (r *ResourceRender) Name() string {
+	return ExpectedResourceHashedName(r.infra.Name)
+}
+
+// ServiceAccount returns the expected proxy serviceAccount.
+func (r *ResourceRender) ServiceAccount() (*corev1.ServiceAccount, error) {
+	// Set the labels based on the owning gateway name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	return &corev1.ServiceAccount{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ServiceAccount",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+		},
+	}, nil
+}
+
+// Service returns the expected Service based on the provided infra.
+func (r *ResourceRender) Service() (*corev1.Service, error) {
+	var ports []corev1.ServicePort
+	for _, listener := range r.infra.Listeners {
+		for _, port := range listener.Ports {
+			target := intstr.IntOrString{IntVal: port.ContainerPort}
+			protocol := corev1.ProtocolTCP
+			if port.Protocol == ir.UDPProtocolType {
+				protocol = corev1.ProtocolUDP
+			}
+
+			p := corev1.ServicePort{
+				Name:       ExpectedResourceHashedName(port.Name),
+				Protocol:   protocol,
+				Port:       port.ServicePort,
+				TargetPort: target,
+			}
+			ports = append(ports, p)
+
+			if port.Protocol == ir.HTTPSProtocolType {
+				if listener.HTTP3 != nil {
+					p := corev1.ServicePort{
+						Name:       ExpectedResourceHashedName(port.Name + "-h3"),
+						Protocol:   corev1.ProtocolUDP,
+						Port:       port.ServicePort,
+						TargetPort: target,
+					}
+					ports = append(ports, p)
+				}
+			}
+		}
+	}
+
+	// Set the labels based on the owning gatewayclass name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	// Get annotations
+	annotations := map[string]string{}
+	maps.Copy(annotations, r.infra.GetProxyMetadata().Annotations)
+
+	provider := r.infra.GetProxyConfig().GetEnvoyProxyProvider()
+	envoyServiceConfig := provider.GetEnvoyProxyKubeProvider().EnvoyService
+	if envoyServiceConfig.Annotations != nil {
+		maps.Copy(annotations, envoyServiceConfig.Annotations)
+	}
+	if len(annotations) == 0 {
+		annotations = nil
+	}
+
+	// Set the spec of gateway service
+	serviceSpec := resource.ExpectedServiceSpec(envoyServiceConfig)
+	serviceSpec.Ports = ports
+	serviceSpec.Selector = resource.GetSelector(labels).MatchLabels
+
+	if (*envoyServiceConfig.Type) == egv1a1.ServiceTypeClusterIP {
+		if len(r.infra.Addresses) > 0 {
+			// Since K8s Service requires specify no more than one IP for each IP family
+			// So we only use the first address
+			// if address is not set, the automatically assigned clusterIP is used
+			serviceSpec.ClusterIP = r.infra.Addresses[0]
+			serviceSpec.ClusterIPs = r.infra.Addresses[0:1]
+		}
+	} else {
+		serviceSpec.ExternalIPs = r.infra.Addresses
+	}
+
+	svc := &corev1.Service{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "v1",
+			Kind:       "Service",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: annotations,
+		},
+		Spec: serviceSpec,
+	}
+
+	// apply merge patch to service
+	var err error
+	if svc, err = envoyServiceConfig.ApplyMergePatch(svc); err != nil {
+		return nil, err
+	}
+
+	return svc, nil
+}
+
+// ConfigMap returns the expected ConfigMap based on the provided infra.
+func (r *ResourceRender) ConfigMap() (*corev1.ConfigMap, error) {
+	// Set the labels based on the owning gateway name.
+	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
+	if OwningGatewayLabelsAbsent(labels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	return &corev1.ConfigMap{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "ConfigMap",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      labels,
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+		},
+		Data: map[string]string{
+			SdsCAFilename:   SdsCAConfigMapData,
+			SdsCertFilename: SdsCertConfigMapData,
+		},
+	}, nil
+}
+
+// Deployment returns the expected Deployment based on the provided infra.
+func (r *ResourceRender) Deployment() (*appsv1.Deployment, error) {
+	proxyConfig := r.infra.GetProxyConfig()
+
+	// Get the EnvoyProxy config to configure the deployment.
+	provider := proxyConfig.GetEnvoyProxyProvider()
+	if provider.Type != egv1a1.ProviderTypeKubernetes {
+		return nil, fmt.Errorf("invalid provider type %v for Kubernetes infra manager", provider.Type)
+	}
+	deploymentConfig := provider.GetEnvoyProxyKubeProvider().EnvoyDeployment
+
+	// Get expected bootstrap configurations rendered ProxyContainers
+	containers, err := expectedProxyContainers(r.infra, deploymentConfig, proxyConfig.Spec.Shutdown)
+	if err != nil {
+		return nil, err
+	}
+
+	// Set the labels based on the owning gateway name.
+	dpAnnotations := r.infra.GetProxyMetadata().Annotations
+	labels := r.infra.GetProxyMetadata().Labels
+	dpLabels := envoyLabels(labels)
+	if OwningGatewayLabelsAbsent(dpLabels) {
+		return nil, fmt.Errorf("missing owning gateway labels")
+	}
+
+	maps.Copy(labels, deploymentConfig.Pod.Labels)
+	podLabels := envoyLabels(labels)
+	selector := resource.GetSelector(podLabels)
+
+	// Get annotations
+	podAnnotations := map[string]string{}
+	maps.Copy(podAnnotations, dpAnnotations)
+	maps.Copy(podAnnotations, deploymentConfig.Pod.Annotations)
+	if enablePrometheus(r.infra) {
+		podAnnotations["prometheus.io/path"] = "/stats/prometheus" // TODO: make this configurable
+		podAnnotations["prometheus.io/scrape"] = "true"
+		podAnnotations["prometheus.io/port"] = strconv.Itoa(bootstrap.EnvoyReadinessPort)
+	}
+	if len(podAnnotations) == 0 {
+		podAnnotations = nil
+	}
+
+	deployment := &appsv1.Deployment{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Deployment",
+			APIVersion: "apps/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Labels:      dpLabels,
+			Annotations: dpAnnotations,
+		},
+		Spec: appsv1.DeploymentSpec{
+			Replicas: deploymentConfig.Replicas,
+			Strategy: *deploymentConfig.Strategy,
+			Selector: selector,
+			Template: corev1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels:      selector.MatchLabels,
+					Annotations: podAnnotations,
+				},
+				Spec: corev1.PodSpec{
+					Containers:                    containers,
+					InitContainers:                deploymentConfig.InitContainers,
+					ServiceAccountName:            ExpectedResourceHashedName(r.infra.Name),
+					AutomountServiceAccountToken:  ptr.To(false),
+					TerminationGracePeriodSeconds: expectedTerminationGracePeriodSeconds(proxyConfig.Spec.Shutdown),
+					DNSPolicy:                     corev1.DNSClusterFirst,
+					RestartPolicy:                 corev1.RestartPolicyAlways,
+					SchedulerName:                 "default-scheduler",
+					SecurityContext:               deploymentConfig.Pod.SecurityContext,
+					Affinity:                      deploymentConfig.Pod.Affinity,
+					Tolerations:                   deploymentConfig.Pod.Tolerations,
+					Volumes:                       expectedDeploymentVolumes(r.infra.Name, deploymentConfig),
+					ImagePullSecrets:              deploymentConfig.Pod.ImagePullSecrets,
+					NodeSelector:                  deploymentConfig.Pod.NodeSelector,
+					TopologySpreadConstraints:     deploymentConfig.Pod.TopologySpreadConstraints,
+				},
+			},
+			RevisionHistoryLimit:    ptr.To[int32](10),
+			ProgressDeadlineSeconds: ptr.To[int32](600),
+		},
+	}
+
+	// omit the deployment replicas if HPA is being set
+	if provider.GetEnvoyProxyKubeProvider().EnvoyHpa != nil {
+		deployment.Spec.Replicas = nil
+	}
+
+	// apply merge patch to deployment
+	if deployment, err = deploymentConfig.ApplyMergePatch(deployment); err != nil {
+		return nil, err
+	}
+
+	return deployment, nil
+}
+
+func expectedTerminationGracePeriodSeconds(cfg *egv1a1.ShutdownConfig) *int64 {
+	s := 900 // default
+	if cfg != nil && cfg.DrainTimeout != nil {
+		s = int(cfg.DrainTimeout.Seconds() + 300) // 5 minutes longer than drain timeout
+	}
+	return ptr.To(int64(s))
+}
+
+func (r *ResourceRender) HorizontalPodAutoscaler() (*autoscalingv2.HorizontalPodAutoscaler, error) {
+	provider := r.infra.GetProxyConfig().GetEnvoyProxyProvider()
+	if provider.Type != egv1a1.ProviderTypeKubernetes {
+		return nil, fmt.Errorf("invalid provider type %v for Kubernetes infra manager", provider.Type)
+	}
+
+	hpaConfig := provider.GetEnvoyProxyKubeProvider().EnvoyHpa
+	if hpaConfig == nil {
+		return nil, nil
+	}
+
+	hpa := &autoscalingv2.HorizontalPodAutoscaler{
+		TypeMeta: metav1.TypeMeta{
+			APIVersion: "autoscaling/v2",
+			Kind:       "HorizontalPodAutoscaler",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace:   r.Namespace,
+			Name:        r.Name(),
+			Annotations: r.infra.GetProxyMetadata().Annotations,
+			Labels:      r.infra.GetProxyMetadata().Labels,
+		},
+		Spec: autoscalingv2.HorizontalPodAutoscalerSpec{
+			ScaleTargetRef: autoscalingv2.CrossVersionObjectReference{
+				APIVersion: "apps/v1",
+				Kind:       "Deployment",
+				Name:       r.Name(),
+			},
+			MinReplicas: hpaConfig.MinReplicas,
+			MaxReplicas: ptr.Deref(hpaConfig.MaxReplicas, 1),
+			Metrics:     hpaConfig.Metrics,
+			Behavior:    hpaConfig.Behavior,
+		},
+	}
+
+	return hpa, nil
+}
+
+// OwningGatewayLabelsAbsent Check if labels are missing some OwningGatewayLabels
+func OwningGatewayLabelsAbsent(labels map[string]string) bool {
+	return (len(labels[gatewayapi.OwningGatewayNameLabel]) == 0 ||
+		len(labels[gatewayapi.OwningGatewayNamespaceLabel]) == 0) &&
+		len(labels[gatewayapi.OwningGatewayClassLabel]) == 0
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
new file mode 100644
index 000000000..7281ec61e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider_test.go
@@ -0,0 +1,989 @@
+// // Copyright Envoy Gateway Authors
+// // SPDX-License-Identifier: Apache-2.0
+// // The full text of the Apache license is available in the LICENSE file at
+// // the root of the repo.
+
+package proxy
+
+// import (
+// 	"flag"
+// 	"fmt"
+// 	"os"
+// 	"sort"
+// 	"testing"
+// 	"time"
+
+// 	"github.com/stretchr/testify/assert"
+// 	"github.com/stretchr/testify/require"
+// 	appsv1 "k8s.io/api/apps/v1"
+// 	autoscalingv2 "k8s.io/api/autoscaling/v2"
+// 	corev1 "k8s.io/api/core/v1"
+// 	v1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+// 	"k8s.io/apimachinery/pkg/api/resource"
+// 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+// 	"k8s.io/utils/ptr"
+// 	"sigs.k8s.io/yaml"
+
+// 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+// 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+// 	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+// )
+
+// var (
+// 	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+// 	defaultNamespace = "apk"
+// )
+
+// const (
+// 	// envoyHTTPPort is the container port number of Envoy's HTTP endpoint.
+// 	envoyHTTPPort = int32(8080)
+// 	// envoyHTTPSPort is the container port number of Envoy's HTTPS endpoint.
+// 	envoyHTTPSPort = int32(8443)
+// )
+
+// func newTestInfra() *ir.Infra {
+// 	return newTestInfraWithAnnotations(nil)
+// }
+
+// func newTestInfraWithAnnotations(annotations map[string]string) *ir.Infra {
+// 	return newTestInfraWithAnnotationsAndLabels(annotations, nil)
+// }
+
+// func newTestInfraWithAddresses(addresses []string) *ir.Infra {
+// 	infra := newTestInfraWithAnnotationsAndLabels(nil, nil)
+// 	infra.Proxy.Addresses = addresses
+
+// 	return infra
+// }
+
+// func newTestInfraWithAnnotationsAndLabels(annotations, labels map[string]string) *ir.Infra {
+// 	i := ir.NewInfra()
+
+// 	i.Proxy.GetProxyMetadata().Annotations = annotations
+// 	if len(labels) > 0 {
+// 		i.Proxy.GetProxyMetadata().Labels = labels
+// 	}
+// 	i.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+// 	i.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = i.Proxy.Name
+// 	i.Proxy.Listeners = []*ir.ProxyListener{
+// 		{
+// 			Ports: []ir.ListenerPort{
+// 				{
+// 					Name:          "EnvoyHTTPPort",
+// 					Protocol:      ir.TCPProtocolType,
+// 					ContainerPort: envoyHTTPPort,
+// 				},
+// 				{
+// 					Name:          "EnvoyHTTPSPort",
+// 					Protocol:      ir.TCPProtocolType,
+// 					ContainerPort: envoyHTTPSPort,
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	return i
+// }
+
+// func TestDeployment(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName     string
+// 		infra        *ir.Infra
+// 		deploy       *egv1a1.KubernetesDeploymentSpec
+// 		shutdown     *egv1a1.ShutdownConfig
+// 		proxyLogging map[egv1a1.ProxyLogComponent]egv1a1.LogLevel
+// 		bootstrap    string
+// 		telemetry    *egv1a1.ProxyTelemetry
+// 		concurrency  *int32
+// 		extraArgs    []string
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					Labels: map[string]string{
+// 						"foo.bar": "custom-label",
+// 					},
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "patch-deployment",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte("{\"spec\":{\"template\":{\"spec\":{\"hostNetwork\":true,\"dnsPolicy\":\"ClusterFirstWithHostNet\"}}}}"),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "shutdown-manager",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte(`{
+// 							"spec":{
+// 								"template":{
+// 									"spec":{
+// 										"containers":[{
+// 											"name":"shutdown-manager",
+// 											"resources":{
+// 												"requests":{"cpu":"100m","memory":"64Mi"},
+// 												"limits":{"cpu":"200m","memory":"96Mi"}
+// 											},
+// 											"securityContext":{"runAsUser":1234},
+// 											"env":[
+// 												{"name":"env_a","value":"env_a_value"},
+// 												{"name":"env_b","value":"env_b_value"}
+// 											],
+// 											"image":"envoyproxy/gateway-dev:v1.2.3"
+// 										}]
+// 									}
+// 								}
+// 							}
+// 						}`),
+// 					},
+// 				},
+// 			},
+// 			shutdown: &egv1a1.ShutdownConfig{
+// 				DrainTimeout: &metav1.Duration{
+// 					Duration: 30 * time.Second,
+// 				},
+// 				MinDrainDuration: &metav1.Duration{
+// 					Duration: 15 * time.Second,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "bootstrap",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 			// bootstrap: `test bootstrap config`,
+// 		},
+// 		{
+// 			caseName: "extension-env",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					// Env: []corev1.EnvVar{
+// 					// 	{
+// 					// 		Name:  "env_a",
+// 					// 		Value: "env_a_value",
+// 					// 	},
+// 					// 	{
+// 					// 		Name:  "env_b",
+// 					// 		Value: "env_b_value",
+// 					// 	},
+// 					// },
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0-ubuntu"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "default-env",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env:   nil,
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env:   nil,
+// 					Image: ptr.To("wso2/enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 						RunAsUser:  ptr.To[int64](1000),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "volumes",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](2),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 					Volumes: []corev1.Volume{
+// 						{
+// 							Name: "certs",
+// 							VolumeSource: corev1.VolumeSource{
+// 								Secret: &corev1.SecretVolumeSource{
+// 									SecretName:  "custom-envoy-cert",
+// 									DefaultMode: ptr.To[int32](420),
+// 								},
+// 							},
+// 						},
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Env: []corev1.EnvVar{
+// 						{
+// 							Name:  "env_a",
+// 							Value: "env_a_value",
+// 						},
+// 						{
+// 							Name:  "env_b",
+// 							Value: "env_b_value",
+// 						},
+// 					},
+// 					Image: ptr.To("wso2/enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "component-level",
+// 			infra:    newTestInfra(),
+// 			deploy:   nil,
+// 			proxyLogging: map[egv1a1.ProxyLogComponent]egv1a1.LogLevel{
+// 				egv1a1.LogComponentDefault: egv1a1.LogLevelError,
+// 				egv1a1.LogComponentFilter:  egv1a1.LogLevelInfo,
+// 			},
+// 			// bootstrap: `test bootstrap config`,
+// 		},
+// 		// {
+// 		// 	caseName: "disable-prometheus",
+// 		// 	infra:    newTestInfra(),
+// 		// 	telemetry: &egv1a1.ProxyTelemetry{
+// 		// 		Metrics: &egv1a1.ProxyMetrics{
+// 		// 			Prometheus: &egv1a1.ProxyPrometheusProvider{
+// 		// 				Disable: true,
+// 		// 			},
+// 		// 		},
+// 		// 	},
+// 		// },
+// 		{
+// 			caseName:    "with-concurrency",
+// 			infra:       newTestInfra(),
+// 			deploy:      nil,
+// 			concurrency: ptr.To[int32](4),
+// 			// bootstrap:   `test bootstrap config`,
+// 		},
+// 		{
+// 			caseName: "custom_with_initcontainers",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Replicas: ptr.To[int32](3),
+// 				Strategy: egv1a1.DefaultKubernetesDeploymentStrategy(),
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					// Annotations: map[string]string{
+// 					// 	"prometheus.io/scrape": "true",
+// 					// },
+// 					Labels: map[string]string{
+// 						"foo.bar": "custom-label",
+// 					},
+// 					SecurityContext: &corev1.PodSecurityContext{
+// 						RunAsUser: ptr.To[int64](1000),
+// 					},
+// 					Volumes: []corev1.Volume{
+// 						{
+// 							Name: "custom-libs",
+// 							VolumeSource: corev1.VolumeSource{
+// 								EmptyDir: &corev1.EmptyDirVolumeSource{},
+// 							},
+// 						},
+// 					},
+// 				},
+// 				EnvoyProxyContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("envoyproxy/envoy:v1.2.3"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 					VolumeMounts: []corev1.VolumeMount{
+// 						{
+// 							Name:      "custom-libs",
+// 							MountPath: "/lib/filter_foo.so",
+// 						},
+// 					},
+// 				},
+// 				EnforcerContainer: &egv1a1.KubernetesContainerSpec{
+// 					Image: ptr.To("wso2/apk-enforcer:1.1.0"),
+// 					Resources: &corev1.ResourceRequirements{
+// 						Limits: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("400m"),
+// 							corev1.ResourceMemory: resource.MustParse("2Gi"),
+// 						},
+// 						Requests: corev1.ResourceList{
+// 							corev1.ResourceCPU:    resource.MustParse("200m"),
+// 							corev1.ResourceMemory: resource.MustParse("1Gi"),
+// 						},
+// 					},
+// 					SecurityContext: &corev1.SecurityContext{
+// 						Privileged: ptr.To(true),
+// 					},
+// 					// VolumeMounts: []corev1.VolumeMount{
+// 					// 	{
+// 					// 		Name:      "custom-libs",
+// 					// 		MountPath: "/lib/filter_foo.so",
+// 					// 	},
+// 					// },
+// 				},
+// 				InitContainers: []corev1.Container{
+// 					{
+// 						Name:    "install-filter-foo",
+// 						Image:   "alpine:3.11.3",
+// 						Command: []string{"/bin/sh", "-c"},
+// 						Args:    []string{"echo \"Installing filter-foo\"; wget -q https://example.com/download/filter_foo_v1.0.0.tgz -O - | tar -xz --directory=/lib filter_foo.so; echo \"Done\";"},
+// 						VolumeMounts: []corev1.VolumeMount{
+// 							{
+// 								Name:      "custom-libs",
+// 								MountPath: "/lib",
+// 							},
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 			deploy: nil,
+// 		},
+// 		{
+// 			caseName: "override-labels-and-annotations",
+// 			infra: newTestInfraWithAnnotationsAndLabels(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}, map[string]string{
+// 				"label1": "value1",
+// 				"label2": "value2",
+// 			}),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					Annotations: map[string]string{
+// 						"anno1": "value1-override",
+// 					},
+// 					Labels: map[string]string{
+// 						"label1": "value1-override",
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-image-pull-secrets",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					ImagePullSecrets: []corev1.LocalObjectReference{
+// 						{
+// 							Name: "aaa",
+// 						},
+// 						{
+// 							Name: "bbb",
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-node-selector",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					NodeSelector: map[string]string{
+// 						"key1": "value1",
+// 						"key2": "value2",
+// 					},
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-topology-spread-constraints",
+// 			infra:    newTestInfra(),
+// 			deploy: &egv1a1.KubernetesDeploymentSpec{
+// 				Pod: &egv1a1.KubernetesPodSpec{
+// 					TopologySpreadConstraints: []corev1.TopologySpreadConstraint{
+// 						{
+// 							MaxSkew:           1,
+// 							TopologyKey:       "kubernetes.io/hostname",
+// 							WhenUnsatisfiable: corev1.DoNotSchedule,
+// 							LabelSelector: &metav1.LabelSelector{
+// 								MatchLabels: map[string]string{"app": "foo"},
+// 							},
+// 							MatchLabelKeys: []string{"pod-template-hash"},
+// 						},
+// 					},
+// 				},
+// 			},
+// 		},
+// 		// {
+// 		// 	caseName: "with-extra-args",
+// 		// 	infra:    newTestInfra(),
+// 		// 	// extraArgs: []string{"--key1 val1", "--key2 val2"},
+// 		// },
+// 	}
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			kube := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider().GetEnvoyProxyKubeProvider()
+// 			if tc.deploy != nil {
+// 				kube.EnvoyDeployment = tc.deploy
+// 			}
+
+// 			replace := egv1a1.BootstrapTypeReplace
+// 			if tc.bootstrap != "" {
+// 				tc.infra.Proxy.Config.Spec.Bootstrap = &egv1a1.ProxyBootstrap{
+// 					Type:  &replace,
+// 					Value: tc.bootstrap,
+// 				}
+// 			}
+
+// 			if tc.telemetry != nil {
+// 				tc.infra.Proxy.Config.Spec.Telemetry = tc.telemetry
+// 			}
+
+// 			if len(tc.proxyLogging) > 0 {
+// 				tc.infra.Proxy.Config.Spec.Logging = egv1a1.ProxyLogging{
+// 					Level: tc.proxyLogging,
+// 				}
+// 			}
+
+// 			if tc.concurrency != nil {
+// 				tc.infra.Proxy.Config.Spec.Concurrency = tc.concurrency
+// 			}
+
+// 			if tc.shutdown != nil {
+// 				tc.infra.Proxy.Config.Spec.Shutdown = tc.shutdown
+// 			}
+
+// 			if len(tc.extraArgs) > 0 {
+// 				tc.infra.Proxy.Config.Spec.ExtraArgs = tc.extraArgs
+// 			}
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			dp, err := r.Deployment()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadDeployment(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			sortEnv := func(env []corev1.EnvVar) {
+// 				sort.Slice(env, func(i, j int) bool {
+// 					return env[i].Name > env[j].Name
+// 				})
+// 			}
+
+// 			if *overrideTestData {
+// 				deploymentYAML, err := yaml.Marshal(dp)
+// 				require.NoError(t, err)
+// 				// nolint: gosec
+// 				err = os.WriteFile(fmt.Sprintf("testdata/deployments/%s.yaml", tc.caseName), deploymentYAML, 0644)
+// 				require.NoError(t, err)
+// 				return
+// 			}
+
+// 			sortEnv(dp.Spec.Template.Spec.Containers[0].Env)
+// 			sortEnv(expected.Spec.Template.Spec.Containers[0].Env)
+// 			assert.Equal(t, expected, dp, "failed "+tc.caseName)
+// 		})
+// 	}
+// }
+
+// func loadDeployment(caseName string) (*appsv1.Deployment, error) {
+// 	deploymentYAML, err := os.ReadFile(fmt.Sprintf("testdata/deployments/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	deployment := &appsv1.Deployment{}
+// 	_ = yaml.Unmarshal(deploymentYAML, deployment)
+// 	return deployment, nil
+// }
+
+// func TestService(t *testing.T) {
+
+// 	svcType := egv1a1.ServiceTypeClusterIP
+// 	cases := []struct {
+// 		caseName string
+// 		infra    *ir.Infra
+// 		service  *egv1a1.KubernetesServiceSpec
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			service:  nil,
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Annotations: map[string]string{
+// 					"key1": "value1",
+// 				},
+// 				Type: &svcType,
+// 			},
+// 		},
+// 		{
+// 			caseName: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 		{
+// 			caseName: "override-annotations",
+// 			infra: newTestInfraWithAnnotationsAndLabels(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}, map[string]string{
+// 				"label1": "value1",
+// 				"label2": "value2",
+// 			}),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Annotations: map[string]string{
+// 					"anno1": "value1-override",
+// 				},
+// 			},
+// 		},
+// 		{
+// 			caseName: "clusterIP-custom-addresses",
+// 			infra: newTestInfraWithAddresses([]string{
+// 				"10.102.168.100",
+// 			}),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Type: &svcType,
+// 			},
+// 		},
+// 		{
+// 			caseName: "patch-service",
+// 			infra:    newTestInfra(),
+// 			service: &egv1a1.KubernetesServiceSpec{
+// 				Patch: &egv1a1.KubernetesPatchSpec{
+// 					Type: ptr.To(egv1a1.StrategicMerge),
+// 					Value: v1.JSON{
+// 						Raw: []byte("{\"metadata\":{\"name\":\"foo\"}}"),
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			provider := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider().GetEnvoyProxyKubeProvider()
+// 			if tc.service != nil {
+// 				provider.EnvoyService = tc.service
+// 			}
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			svc, err := r.Service()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadService(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, svc)
+// 		})
+// 	}
+// }
+
+// func loadService(caseName string) (*corev1.Service, error) {
+// 	serviceYAML, err := os.ReadFile(fmt.Sprintf("testdata/services/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	svc := &corev1.Service{}
+// 	_ = yaml.Unmarshal(serviceYAML, svc)
+// 	return svc, nil
+// }
+
+// func TestConfigMap(t *testing.T) {
+
+// 	cases := []struct {
+// 		name  string
+// 		infra *ir.Infra
+// 	}{
+// 		{
+// 			name:  "default",
+// 			infra: newTestInfra(),
+// 		}, {
+// 			name: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			cm, err := r.ConfigMap()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadConfigmap(tc.name)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, cm)
+// 		})
+// 	}
+// }
+
+// func loadConfigmap(tc string) (*corev1.ConfigMap, error) {
+// 	cmYAML, err := os.ReadFile(fmt.Sprintf("testdata/configmap/%s.yaml", tc))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	cm := &corev1.ConfigMap{}
+// 	_ = yaml.Unmarshal(cmYAML, cm)
+// 	return cm, nil
+// }
+
+// func TestServiceAccount(t *testing.T) {
+// 	cases := []struct {
+// 		name  string
+// 		infra *ir.Infra
+// 	}{
+// 		{
+// 			name:  "default",
+// 			infra: newTestInfra(),
+// 		}, {
+// 			name: "with-annotations",
+// 			infra: newTestInfraWithAnnotations(map[string]string{
+// 				"anno1": "value1",
+// 				"anno2": "value2",
+// 			}),
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			sa, err := r.ServiceAccount()
+// 			require.NoError(t, err)
+
+// 			expected, err := loadServiceAccount(tc.name)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, expected, sa)
+// 		})
+// 	}
+// }
+
+// func loadServiceAccount(tc string) (*corev1.ServiceAccount, error) {
+// 	saYAML, err := os.ReadFile(fmt.Sprintf("testdata/serviceaccount/%s.yaml", tc))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+// 	sa := &corev1.ServiceAccount{}
+// 	_ = yaml.Unmarshal(saYAML, sa)
+// 	return sa, nil
+// }
+
+// func TestHorizontalPodAutoscaler(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName string
+// 		infra    *ir.Infra
+// 		hpa      *egv1a1.KubernetesHorizontalPodAutoscalerSpec
+// 	}{
+// 		{
+// 			caseName: "default",
+// 			infra:    newTestInfra(),
+// 			hpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{
+// 				MaxReplicas: ptr.To[int32](1),
+// 			},
+// 		},
+// 		{
+// 			caseName: "custom",
+// 			infra:    newTestInfra(),
+// 			hpa: &egv1a1.KubernetesHorizontalPodAutoscalerSpec{
+// 				MinReplicas: ptr.To[int32](5),
+// 				MaxReplicas: ptr.To[int32](10),
+// 				Metrics: []autoscalingv2.MetricSpec{
+// 					{
+// 						Resource: &autoscalingv2.ResourceMetricSource{
+// 							Name: corev1.ResourceCPU,
+// 							Target: autoscalingv2.MetricTarget{
+// 								Type:               autoscalingv2.UtilizationMetricType,
+// 								AverageUtilization: ptr.To[int32](60),
+// 							},
+// 						},
+// 						Type: autoscalingv2.ResourceMetricSourceType,
+// 					},
+// 					{
+// 						Resource: &autoscalingv2.ResourceMetricSource{
+// 							Name: corev1.ResourceMemory,
+// 							Target: autoscalingv2.MetricTarget{
+// 								Type:               autoscalingv2.UtilizationMetricType,
+// 								AverageUtilization: ptr.To[int32](70),
+// 							},
+// 						},
+// 						Type: autoscalingv2.ResourceMetricSourceType,
+// 					},
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			provider := tc.infra.GetProxyInfra().GetProxyConfig().GetEnvoyProxyProvider()
+// 			provider.Kubernetes = egv1a1.DefaultEnvoyProxyKubeProvider()
+
+// 			if tc.hpa != nil {
+// 				provider.Kubernetes.EnvoyHpa = tc.hpa
+// 			}
+
+// 			provider.GetEnvoyProxyKubeProvider()
+
+// 			r := NewResourceRender(defaultNamespace, tc.infra.GetProxyInfra())
+// 			hpa, err := r.HorizontalPodAutoscaler()
+// 			require.NoError(t, err)
+
+// 			want, err := loadHPA(tc.caseName)
+// 			require.NoError(t, err)
+
+// 			assert.Equal(t, want, hpa)
+// 		})
+// 	}
+// }
+
+// func loadHPA(caseName string) (*autoscalingv2.HorizontalPodAutoscaler, error) {
+// 	hpaYAML, err := os.ReadFile(fmt.Sprintf("testdata/hpa/%s.yaml", caseName))
+// 	if err != nil {
+// 		return nil, err
+// 	}
+
+// 	hpa := &autoscalingv2.HorizontalPodAutoscaler{}
+// 	_ = yaml.Unmarshal(hpaYAML, hpa)
+// 	return hpa, nil
+// }
+
+// func TestOwningGatewayLabelsAbsent(t *testing.T) {
+
+// 	cases := []struct {
+// 		caseName string
+// 		labels   map[string]string
+// 		expect   bool
+// 	}{
+// 		{
+// 			caseName: "OwningGatewayClassLabel exist, but lack OwningGatewayNameLabel or OwningGatewayNamespaceLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gatewayclass": "eg-class",
+// 			},
+// 			expect: false,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNameLabel and OwningGatewayNamespaceLabel exist, but lack OwningGatewayClassLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-name":      "eg",
+// 				"apk.wso2.com/owning-gateway-namespace": "default",
+// 			},
+// 			expect: false,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNameLabel exist, but lack OwningGatewayClassLabel and OwningGatewayNamespaceLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-name": "eg",
+// 			},
+// 			expect: true,
+// 		},
+// 		{
+// 			caseName: "OwningGatewayNamespaceLabel exist, but lack OwningGatewayClassLabel and OwningGatewayNameLabel",
+// 			labels: map[string]string{
+// 				"apk.wso2.com/owning-gateway-namespace": "default",
+// 			},
+// 			expect: true,
+// 		},
+// 		{
+// 			caseName: "lack all labels",
+// 			labels:   map[string]string{},
+// 			expect:   true,
+// 		},
+// 	}
+
+// 	for _, tc := range cases {
+// 		t.Run(tc.caseName, func(t *testing.T) {
+// 			actual := OwningGatewayLabelsAbsent(tc.labels)
+// 			require.Equal(t, tc.expect, actual)
+// 		})
+// 	}
+
+// }
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
new file mode 100644
index 000000000..de4881c03
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package proxy
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestEnvoyPodSelector(t *testing.T) {
+	cases := []struct {
+		name     string
+		in       map[string]string
+		expected map[string]string
+	}{
+		{
+			name: "default",
+			in:   map[string]string{"foo": "bar"},
+			expected: map[string]string{
+				"foo":                          "bar",
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run("", func(t *testing.T) {
+			got := envoyLabels(tc.in)
+			require.Equal(t, tc.expected, got)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
new file mode 100644
index 000000000..088b5372c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/default.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+data:
+  xds-certificate.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"/certs/tls.crt"},"private_key":{"filename":"/certs/tls.key"}}}]}'
+  xds-trusted-ca.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"/certs/ca.crt"},"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}'
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
new file mode 100644
index 000000000..0d2cc9cbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/configmap/with-annotations.yaml
@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+data:
+  xds-certificate.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_certificate","tls_certificate":{"certificate_chain":{"filename":"/certs/tls.crt"},"private_key":{"filename":"/certs/tls.key"}}}]}'
+  xds-trusted-ca.json: '{"resources":[{"@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret","name":"xds_trusted_ca","validation_context":{"trusted_ca":{"filename":"/certs/ca.crt"},"match_typed_subject_alt_names":[{"san_type":"DNS","matcher":{"exact":"envoy-gateway"}}]}}]}'
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
new file mode 100644
index 000000000..7de7ca171
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -0,0 +1,296 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
new file mode 100644
index 000000000..7ba4cb464
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --component-log-level filter:info
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
new file mode 100644
index 000000000..dddf49808
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -0,0 +1,311 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      foo.bar: custom-label
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        foo.bar: custom-label
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+            privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
new file mode 100644
index 000000000..7a3d8264d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -0,0 +1,328 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 3
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      foo.bar: custom-label
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        foo.bar: custom-label
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+        - mountPath: /lib/filter_foo.so
+          name: custom-libs
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 200m
+            memory: 1Gi
+          limits:
+            cpu: 400m
+            memory: 2Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      initContainers:
+      - args:
+        - echo "Installing filter-foo"; wget -q https://example.com/download/filter_foo_v1.0.0.tgz
+          -O - | tar -xz --directory=/lib filter_foo.so; echo "Done";
+        command:
+        - /bin/sh
+        - -c
+        image: alpine:3.11.3
+        name: install-filter-foo
+        resources: {}
+        volumeMounts:
+        - mountPath: /lib
+          name: custom-libs
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+      - emptyDir: {}
+        name: custom-libs
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
new file mode 100644
index 000000000..b51526666
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -0,0 +1,310 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+          RunAsUser: 1000
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
new file mode 100644
index 000000000..d459b8da9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -0,0 +1,296 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
new file mode 100644
index 000000000..a7f68d155
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -0,0 +1,264 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
new file mode 100644
index 000000000..a7bb21857
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -0,0 +1,313 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0-ubuntu
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
new file mode 100644
index 000000000..b1086f11d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -0,0 +1,307 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+      label1: value1-override
+      label2: value2
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        anno1: value1-override
+        anno2: value2
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+        label1: value1-override
+        label2: value2
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
new file mode 100644
index 000000000..3ca34b511
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirstWithHostNet
+      hostNetwork: true
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
new file mode 100644
index 000000000..46de0fee6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -0,0 +1,309 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        - --drain-time-s 30
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        - --ready-timeout=40s
+        command:
+        - envoy-gateway
+        env:
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+              - --drain-timeout=30s
+              - --min-drain-duration=15s
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 200m
+            memory: 96Mi
+          requests:
+            cpu: 100m
+            memory: 64Mi
+        securityContext:
+          runAsUser: 1234
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 330
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
new file mode 100644
index 000000000..fe1845ef5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -0,0 +1,313 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  replicas: 2
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        - name: env_a
+          value: env_a_value
+        - name: env_b
+          value: env_b_value
+        image: envoyproxy/envoy:v1.2.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        securityContext:
+          privileged: true
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          limits:
+            cpu: 400m
+            memory: 2Gi
+          requests:
+            cpu: 200m
+            memory: 1Gi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        securityContext:
+          privileged: true
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext:
+        runAsUser: 1000
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: custom-envoy-cert
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
new file mode 100644
index 000000000..e94ff083e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -0,0 +1,301 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      annotations:
+        anno1: value1
+        anno2: value2
+        # prometheus.io/path: /stats/prometheus
+        # prometheus.io/port: "19001"
+        # prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
new file mode 100644
index 000000000..5ee173a50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
@@ -0,0 +1,297 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --concurrency 4
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
new file mode 100644
index 000000000..5a358d89e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -0,0 +1,298 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        # - --key1 val1
+        # - --key2 val2
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
new file mode 100644
index 000000000..cd3821c50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -0,0 +1,299 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      imagePullSecrets:
+      - name: aaa
+      - name: bbb
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
new file mode 100644
index 000000000..01ea0267a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -0,0 +1,299 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      nodeSelector:
+        key1: value1
+        key2: value2
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
new file mode 100644
index 000000000..ab8338bb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -0,0 +1,305 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  creationTimestamp: null
+  labels:
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    app.kubernetes.io/name: envoy
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  progressDeadlineSeconds: 600
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: proxy
+      app.kubernetes.io/managed-by: envoy-gateway
+      app.kubernetes.io/name: envoy
+      apk.wso2.com/owning-gateway-name: default
+      apk.wso2.com/owning-gateway-namespace: default
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      # annotations:
+      #   prometheus.io/path: /stats/prometheus
+      #   prometheus.io/port: "19001"
+      #   prometheus.io/scrape: "true"
+      creationTimestamp: null
+      labels:
+        app.kubernetes.io/component: proxy
+        app.kubernetes.io/managed-by: envoy-gateway
+        app.kubernetes.io/name: envoy
+        apk.wso2.com/owning-gateway-name: default
+        apk.wso2.com/owning-gateway-namespace: default
+    spec:
+      automountServiceAccountToken: false
+      containers:
+      - args:
+        - --service-cluster default
+        - --service-node $(ENVOY_POD_NAME)
+        - |
+          --config-yaml admin:
+            access_log:
+            - name: envoy.access_loggers.file
+              typed_config:
+                "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+                path: /dev/null
+            address:
+              socket_address:
+                address: 0.0.0.0
+                port_value: 19000
+          layered_runtime:
+            layers:
+            - name: global_config
+              static_layer:
+                envoy.restart_features.use_eds_cache_for_ads: true
+                re2.max_program_size.error_level: 4294967295
+                re2.max_program_size.warn_level: 1000
+          dynamic_resources:
+            ads_config:
+              api_type: DELTA_GRPC
+              transport_api_version: V3
+              grpc_services:
+              - envoy_grpc:
+                  cluster_name: xds_cluster
+              set_node_on_first_message_only: true
+            lds_config:
+              ads: {}
+              resource_api_version: V3
+            cds_config:
+              ads: {}
+              resource_api_version: V3
+          static_resources:
+            listeners:
+            - name: envoy-gateway-proxy-ready-0.0.0.0-19001
+              address:
+                socket_address:
+                  address: 0.0.0.0
+                  port_value: 19001
+                  protocol: TCP
+              filter_chains:
+              - filters:
+                - name: envoy.filters.network.http_connection_manager
+                  typed_config:
+                    "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+                    stat_prefix: eg-ready-http
+                    route_config:
+                      name: local_route
+                    http_filters:
+                    - name: envoy.filters.http.health_check
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck
+                        pass_through_mode: false
+                        headers:
+                        - name: ":path"
+                          string_match:
+                            exact: /ready
+                    - name: envoy.filters.http.router
+                      typed_config:
+                        "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            clusters:
+            - connect_timeout: 10s
+              load_assignment:
+                cluster_name: xds_cluster
+                endpoints:
+                - load_balancing_weight: 1
+                  lb_endpoints:
+                  - load_balancing_weight: 1
+                    endpoint:
+                      address:
+                        socket_address:
+                          address: envoy-gateway
+                          port_value: 18000
+              typed_extension_protocol_options:
+                envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+                  "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                  explicit_http_config:
+                    http2_protocol_options:
+                      connection_keepalive:
+                        interval: 30s
+                        timeout: 5s
+              name: xds_cluster
+              type: STRICT_DNS
+              transport_socket:
+                name: envoy.transport_sockets.tls
+                typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+                  common_tls_context:
+                    tls_params:
+                      tls_maximum_protocol_version: TLSv1_3
+                    tls_certificate_sds_secret_configs:
+                    - name: xds_certificate
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-certificate.json"
+                        resource_api_version: V3
+                    validation_context_sds_secret_config:
+                      name: xds_trusted_ca
+                      sds_config:
+                        path_config_source:
+                          path: "/sds/xds-trusted-ca.json"
+                        resource_api_version: V3
+        - --log-level warn
+        - --cpuset-threads
+        command:
+        - envoy
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/envoy:distroless-v1.29.3
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            httpGet:
+              path: /shutdown/ready
+              port: 19002
+              scheme: HTTP
+        name: envoy
+        ports:
+        - containerPort: 8080
+          name: EnvoyH-d76a15e2
+          protocol: TCP
+        - containerPort: 8443
+          name: EnvoyH-6658f727
+          protocol: TCP
+        # - containerPort: 19001
+        #   name: metrics
+        #   protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /ready
+            port: 19001
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+        volumeMounts:
+        - mountPath: /certs
+          name: certs
+          readOnly: true
+        - mountPath: /sds
+          name: sds
+      - args:
+        - envoy
+        - shutdown-manager
+        command:
+        - envoy-gateway
+        env:
+        - name: ENVOY_GATEWAY_NAMESPACE
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.namespace
+        - name: ENVOY_POD_NAME
+          valueFrom:
+            fieldRef:
+              apiVersion: v1
+              fieldPath: metadata.name
+        image: envoyproxy/gateway-dev:latest
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - envoy-gateway
+              - envoy
+              - shutdown
+        livenessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: shutdown-manager
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 19002
+            scheme: HTTP
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 10m
+            memory: 32Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      - image: wso2/apk-enforcer:1.1.0
+        imagePullPolicy: IfNotPresent
+        name: enforcer
+        readinessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        livenessProbe:
+          exec:
+            command: ["sh", "check_health.sh"]
+          periodSeconds: 20
+          failureThreshold: 5
+          initialDelaySeconds: 20
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 512Mi
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      serviceAccountName: envoy-default-37a8eec1
+      terminationGracePeriodSeconds: 900
+      topologySpreadConstraints:
+      - labelSelector:
+          matchLabels:
+            app: foo
+        matchLabelKeys:
+        - pod-template-hash
+        maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+      volumes:
+      - name: certs
+        secret:
+          defaultMode: 420
+          secretName: envoy
+      - configMap:
+          defaultMode: 420
+          items:
+          - key: xds-trusted-ca.json
+            path: xds-trusted-ca.json
+          - key: xds-certificate.json
+            path: xds-certificate.json
+          name: envoy-default-37a8eec1
+          optional: false
+        name: sds
+status: {}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
new file mode 100644
index 000000000..274b2b53e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/custom.yaml
@@ -0,0 +1,28 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  maxReplicas: 10
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 60
+        type: Utilization
+    type: Resource
+  - resource:
+      name: memory
+      target:
+        averageUtilization: 70
+        type: Utilization
+    type: Resource
+  minReplicas: 5
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
new file mode 100644
index 000000000..f41b6cc45
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/default.yaml
@@ -0,0 +1,21 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  metrics:
+  - resource:
+      name: cpu
+      target:
+        averageUtilization: 80
+        type: Utilization
+    type: Resource
+  maxReplicas: 1
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
new file mode 100644
index 000000000..61eb91af0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/hpa/with-annotations.yaml
@@ -0,0 +1,24 @@
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  metrics:
+    - resource:
+        name: cpu
+        target:
+          averageUtilization: 80
+          type: Utilization
+      type: Resource
+  maxReplicas: 1
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: envoy-default-37a8eec1
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
new file mode 100644
index 000000000..e7da9b590
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/default.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
new file mode 100644
index 000000000..184fce181
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/serviceaccount/with-annotations.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
new file mode 100644
index 000000000..6585fe33b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/clusterIP-custom-addresses.yaml
@@ -0,0 +1,32 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  clusterIP: 10.102.168.100
+  clusterIPs:
+    - 10.102.168.100
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: ClusterIP
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
new file mode 100644
index 000000000..64f21eb51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/custom.yaml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    key1: value1
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: ClusterIP
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
new file mode 100644
index 000000000..a859db6e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/default.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
new file mode 100644
index 000000000..3f361b1f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/override-annotations.yaml
@@ -0,0 +1,37 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    anno1: value1-override
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+    label1: value1
+    label2: value2
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
new file mode 100644
index 000000000..c62c7799c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/patch-service.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: foo
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
new file mode 100644
index 000000000..3569d2897
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/services/with-annotations.yaml
@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+    anno1: value1
+    anno2: value2
+  labels:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  name: envoy-default-37a8eec1
+  namespace: apk
+spec:
+  externalTrafficPolicy: Local
+  ports:
+    - name: envoy-EnvoyHTTPPort-d76a15e2
+      port: 0
+      protocol: TCP
+      targetPort: 8080
+    - name: envoy-EnvoyHTTPSPort-6658f727
+      port: 0
+      protocol: TCP
+      targetPort: 8443
+  selector:
+    app.kubernetes.io/name: envoy
+    app.kubernetes.io/component: proxy
+    app.kubernetes.io/managed-by: envoy-gateway
+    apk.wso2.com/owning-gateway-name: default
+    apk.wso2.com/owning-gateway-namespace: default
+  sessionAffinity: None
+  type: LoadBalancer
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
new file mode 100644
index 000000000..6a04adc8b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+var (
+	namespace = "apk"
+)
+
+// func TestCreateOrUpdateProxyConfigMap(t *testing.T) {
+// 	infra := ir.NewInfra()
+// 	infra.Proxy.Name = "test"
+// 	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+// 	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+// 	testCases := []struct {
+// 		name    string
+// 		current *corev1.ConfigMap
+// 		expect  *corev1.ConfigMap
+// 	}{
+// 		{
+// 			name: "create configmap",
+// 			expect: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test-9f86d081",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{
+// 					proxy.SdsCAFilename:   proxy.SdsCAConfigMapData,
+// 					proxy.SdsCertFilename: proxy.SdsCertConfigMapData,
+// 				},
+// 			},
+// 		},
+// 		{
+// 			name: "update configmap",
+// 			current: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{"foo": "bar"},
+// 			},
+// 			expect: &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: namespace,
+// 					Name:      "envoy-test-9f86d081",
+// 					Labels: map[string]string{
+// 						"app.kubernetes.io/name":               "envoy",
+// 						"app.kubernetes.io/component":          "proxy",
+// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						gatewayapi.OwningGatewayNamespaceLabel: "default",
+// 						gatewayapi.OwningGatewayNameLabel:      "test",
+// 					},
+// 				},
+// 				Data: map[string]string{
+// 					proxy.SdsCAFilename:   proxy.SdsCAConfigMapData,
+// 					proxy.SdsCertFilename: proxy.SdsCertConfigMapData,
+// 				},
+// 			},
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			var cli client.Client
+// 			if tc.current != nil {
+// 				cli = fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+// 			} else {
+// 				cli = fakeclient.NewClientBuilder().Build()
+// 			}
+// 			kube := NewInfra(cli)
+// 			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+// 			err := kube.createOrUpdateConfigMap(context.Background(), r)
+// 			require.NoError(t, err)
+// 			actual := &corev1.ConfigMap{
+// 				ObjectMeta: metav1.ObjectMeta{
+// 					Namespace: tc.expect.Namespace,
+// 					Name:      tc.expect.Name,
+// 				},
+// 			}
+// 			require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(actual), actual))
+// 			require.Equal(t, tc.expect.Data, actual.Data)
+// 			assert.True(t, apiequality.Semantic.DeepEqual(tc.expect.Labels, actual.Labels))
+// 		})
+// 	}
+// }
+
+func TestDeleteConfigProxyMap(t *testing.T) {
+
+	infra := ir.NewInfra()
+	infra.Proxy.Name = "test"
+
+	testCases := []struct {
+		name    string
+		current *corev1.ConfigMap
+		expect  bool
+	}{
+		{
+			name: "delete configmap",
+			current: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      "envoy-test",
+				},
+			},
+			expect: true,
+		},
+		{
+			name: "configmap not found",
+			current: &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: namespace,
+					Name:      "foo",
+				},
+			},
+			expect: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			cli := fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+			kube := NewInfra(cli)
+
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+			cm := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      r.Name(),
+				},
+			}
+			err := kube.Client.Delete(context.Background(), cm)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
new file mode 100644
index 000000000..15966b478
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_deployment_test.go
@@ -0,0 +1,162 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+const (
+	// envoyContainerName is the name of the Envoy container.
+	envoyContainerName = "envoy"
+)
+
+func deploymentWithImage(deploy *appsv1.Deployment, image string) *appsv1.Deployment {
+	dCopy := deploy.DeepCopy()
+	for i, c := range dCopy.Spec.Template.Spec.Containers {
+		if c.Name == envoyContainerName {
+			dCopy.Spec.Template.Spec.Containers[i].Image = image
+		}
+	}
+	return dCopy
+}
+
+func TestCreateOrUpdateProxyDeployment(t *testing.T) {
+
+	infra := ir.NewInfra()
+	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+	infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+
+	r := proxy.NewResourceRender("", infra.GetProxyInfra())
+	deploy, err := r.Deployment()
+	require.NoError(t, err)
+
+	testCases := []struct {
+		name    string
+		in      *ir.Infra
+		current *appsv1.Deployment
+		want    *appsv1.Deployment
+	}{
+		{
+			name: "create deployment",
+			in:   infra,
+			want: deploy,
+		},
+		{
+			name:    "deployment exists",
+			in:      infra,
+			current: deploy,
+			want:    deploy,
+		},
+		{
+			name: "update deployment image",
+			in: &ir.Infra{
+				Proxy: &ir.ProxyInfra{
+					Metadata: &ir.InfraMetadata{
+						Labels: map[string]string{
+							gatewayapi.OwningGatewayNamespaceLabel: "default",
+							gatewayapi.OwningGatewayNameLabel:      infra.Proxy.Name,
+						},
+					},
+					Name:      ir.DefaultProxyName,
+					Listeners: ir.NewProxyListeners(),
+				},
+			},
+			current: deploy,
+			want:    deploy,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			var cli client.Client
+			if tc.current != nil {
+				cli = fakeclient.NewClientBuilder().WithObjects(tc.current).Build()
+			} else {
+				cli = fakeclient.NewClientBuilder().Build()
+			}
+
+			kube := NewInfra(cli)
+			r := proxy.NewResourceRender(kube.Namespace, tc.in.GetProxyInfra())
+			err := kube.createOrUpdateDeployment(context.Background(), r)
+			require.NoError(t, err)
+
+			actual := &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+				},
+			}
+			require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(actual), actual))
+			require.Equal(t, tc.want.Spec, actual.Spec)
+		})
+	}
+}
+
+func TestDeleteProxyDeployment(t *testing.T) {
+	cli := fakeclient.NewClientBuilder().WithObjects().Build()
+
+	testCases := []struct {
+		name   string
+		expect bool
+	}{
+		{
+			name:   "delete deployment",
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			kube := NewInfra(cli)
+
+			infra := ir.NewInfra()
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+
+			err := kube.createOrUpdateDeployment(context.Background(), r)
+			require.NoError(t, err)
+			deployment := &appsv1.Deployment{
+				ObjectMeta: metav1.ObjectMeta{
+					Namespace: kube.Namespace,
+					Name:      r.Name(),
+				},
+			}
+			err = kube.Client.Delete(context.Background(), deployment)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
new file mode 100644
index 000000000..ab898ea02
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra.go
@@ -0,0 +1,55 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"errors"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+// CreateOrUpdateProxyInfra creates the managed kube infra, if it doesn't exist.
+func (i *Infra) CreateOrUpdateProxyInfra(ctx context.Context, infra *ir.Infra) error {
+	if infra == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	if infra.Proxy == nil {
+		return errors.New("infra proxy ir is nil")
+	}
+
+	r := proxy.NewResourceRender(i.Namespace, infra.GetProxyInfra())
+	return i.createOrUpdate(ctx, r)
+}
+
+// DeleteProxyInfra removes the managed kube infra, if it doesn't exist.
+func (i *Infra) DeleteProxyInfra(ctx context.Context, infra *ir.Infra) error {
+	if infra == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	r := proxy.NewResourceRender(i.Namespace, infra.GetProxyInfra())
+	return i.delete(ctx, r)
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
new file mode 100644
index 000000000..cd3827f27
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_infra_test.go
@@ -0,0 +1,180 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+func newTestInfra(t *testing.T) *Infra {
+	cli := fakeclient.NewClientBuilder().Build()
+	return newTestInfraWithClient(t, cli)
+}
+
+func TestCmpBytes(t *testing.T) {
+	m1 := map[string][]byte{}
+	m1["a"] = []byte("aaa")
+	m2 := map[string][]byte{}
+	m2["a"] = []byte("aaa")
+
+	assert.True(t, reflect.DeepEqual(m1, m2))
+	assert.False(t, reflect.DeepEqual(nil, m2))
+	assert.False(t, reflect.DeepEqual(m1, nil))
+}
+
+func newTestInfraWithClient(t *testing.T, cli client.Client) *Infra {
+	return NewInfra(cli)
+}
+
+func TestCreateProxyInfra(t *testing.T) {
+	// Infra with Gateway owner labels.
+	infraWithLabels := ir.NewInfra()
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels = proxy.EnvoyAppLabel()
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+	infraWithLabels.GetProxyInfra().GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = "test-gw"
+
+	testCases := []struct {
+		name   string
+		in     *ir.Infra
+		expect bool
+	}{
+		{
+			name:   "infra-with-expected-labels",
+			in:     infraWithLabels,
+			expect: true,
+		},
+		{
+			name:   "default infra without Gateway owner labels",
+			in:     ir.NewInfra(),
+			expect: false,
+		},
+		{
+			name:   "nil-infra",
+			in:     nil,
+			expect: false,
+		},
+		{
+			name: "nil-infra-proxy",
+			in: &ir.Infra{
+				Proxy: nil,
+			},
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			kube := newTestInfra(t)
+			// Create or update the proxy infra.
+			err := kube.CreateOrUpdateProxyInfra(context.Background(), tc.in)
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+
+				// Verify all resources were created via the fake kube client.
+				sa := &corev1.ServiceAccount{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(sa), sa))
+
+				// cm := &corev1.ConfigMap{
+				// 	ObjectMeta: metav1.ObjectMeta{
+				// 		Namespace: kube.Namespace,
+				// 		Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+				// 	},
+				// }
+				// require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(cm), cm))
+
+				deploy := &appsv1.Deployment{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(deploy), deploy))
+
+				svc := &corev1.Service{
+					ObjectMeta: metav1.ObjectMeta{
+						Namespace: kube.Namespace,
+						Name:      proxy.ExpectedResourceHashedName(tc.in.Proxy.Name),
+					},
+				}
+				require.NoError(t, kube.Client.Get(context.Background(), client.ObjectKeyFromObject(svc), svc))
+			}
+		})
+	}
+}
+
+func TestDeleteProxyInfra(t *testing.T) {
+
+	testCases := []struct {
+		name   string
+		in     *ir.Infra
+		expect bool
+	}{
+		{
+			name:   "nil infra",
+			in:     nil,
+			expect: false,
+		},
+		{
+			name:   "default infra",
+			in:     ir.NewInfra(),
+			expect: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			kube := newTestInfra(t)
+
+			err := kube.DeleteProxyInfra(context.Background(), tc.in)
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
new file mode 100644
index 000000000..f5fea49d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_service_test.go
@@ -0,0 +1,60 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+func TestDeleteProxyService(t *testing.T) {
+	testCases := []struct {
+		name string
+	}{
+		{
+			name: "delete service",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			kube := newTestInfra(t)
+			infra := ir.NewInfra()
+
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNamespaceLabel] = "default"
+			infra.Proxy.GetProxyMetadata().Labels[gatewayapi.OwningGatewayNameLabel] = infra.Proxy.Name
+			r := proxy.NewResourceRender(kube.Namespace, infra.GetProxyInfra())
+			err := kube.createOrUpdateService(context.Background(), r)
+			require.NoError(t, err)
+
+			err = kube.deleteService(context.Background(), r)
+			require.NoError(t, err)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
new file mode 100644
index 000000000..06c672157
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource.go
@@ -0,0 +1,131 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package resource
+
+import (
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+// GetSelector returns a label selector used to select resources
+// based on the provided labels.
+func GetSelector(labels map[string]string) *metav1.LabelSelector {
+	return &metav1.LabelSelector{
+		MatchLabels: labels,
+	}
+}
+
+// ExpectedServiceSpec returns service spec.
+func ExpectedServiceSpec(service *egv1a1.KubernetesServiceSpec) corev1.ServiceSpec {
+	serviceSpec := corev1.ServiceSpec{}
+	serviceSpec.Type = corev1.ServiceType(*service.Type)
+	serviceSpec.SessionAffinity = corev1.ServiceAffinityNone
+	if service.ExternalTrafficPolicy == nil {
+		service.ExternalTrafficPolicy = egv1a1.DefaultKubernetesServiceExternalTrafficPolicy()
+	}
+	if *service.Type == egv1a1.ServiceTypeLoadBalancer {
+		if service.LoadBalancerClass != nil {
+			serviceSpec.LoadBalancerClass = service.LoadBalancerClass
+		}
+		if service.AllocateLoadBalancerNodePorts != nil {
+			serviceSpec.AllocateLoadBalancerNodePorts = service.AllocateLoadBalancerNodePorts
+		}
+		if service.LoadBalancerIP != nil {
+			serviceSpec.LoadBalancerIP = *service.LoadBalancerIP
+		}
+		serviceSpec.ExternalTrafficPolicy = corev1.ServiceExternalTrafficPolicy(*service.ExternalTrafficPolicy)
+	}
+
+	return serviceSpec
+}
+
+// CompareSvc compares the Service resource and ignores specific fields that may have been modified by other actors.
+func CompareSvc(currentSvc, originalSvc *corev1.Service) bool {
+	return cmp.Equal(currentSvc.Spec, originalSvc.Spec,
+		cmpopts.IgnoreFields(corev1.ServicePort{}, "NodePort"),
+		cmpopts.IgnoreFields(corev1.ServiceSpec{}, "ClusterIP", "ClusterIPs"),
+		cmpopts.IgnoreFields(metav1.ObjectMeta{}, "Finalizers"))
+}
+
+// ExpectedContainerEnv returns expected container envs.
+func ExpectedContainerEnv(container *egv1a1.KubernetesContainerSpec, env []corev1.EnvVar) []corev1.EnvVar {
+	amendFunc := func(envVar corev1.EnvVar) {
+		for index, e := range env {
+			if e.Name == envVar.Name {
+				env[index] = envVar
+				return
+			}
+		}
+		env = append(env, envVar)
+	}
+
+	for _, envVar := range container.Env {
+		amendFunc(envVar)
+	}
+
+	return env
+}
+
+// ExpectedDeploymentVolumes returns expected deployment volumes.
+func ExpectedDeploymentVolumes(pod *egv1a1.KubernetesPodSpec, volumes []corev1.Volume) []corev1.Volume {
+	amendFunc := func(volume corev1.Volume) {
+		for index, e := range volumes {
+			if e.Name == volume.Name {
+				volumes[index] = volume
+				return
+			}
+		}
+
+		volumes = append(volumes, volume)
+	}
+
+	for _, envVar := range pod.Volumes {
+		amendFunc(envVar)
+	}
+
+	return volumes
+}
+
+// ExpectedContainerVolumeMounts returns expected container volume mounts.
+func ExpectedContainerVolumeMounts(container *egv1a1.KubernetesContainerSpec, volumeMounts []corev1.VolumeMount) []corev1.VolumeMount {
+	amendFunc := func(volumeMount corev1.VolumeMount) {
+		for index, e := range volumeMounts {
+			if e.Name == volumeMount.Name {
+				volumeMounts[index] = volumeMount
+				return
+			}
+		}
+
+		volumeMounts = append(volumeMounts, volumeMount)
+	}
+
+	for _, volumeMount := range container.VolumeMounts {
+		amendFunc(volumeMount)
+	}
+
+	return volumeMounts
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
new file mode 100644
index 000000000..619459000
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
@@ -0,0 +1,553 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package resource
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+	"k8s.io/utils/ptr"
+
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+)
+
+func TestExpectedServiceSpec(t *testing.T) {
+	type args struct {
+		service *egv1a1.KubernetesServiceSpec
+	}
+	loadbalancerClass := "foobar"
+	tests := []struct {
+		name string
+		args args
+		want corev1.ServiceSpec
+	}{
+		{
+			name: "LoadBalancer",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type: egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithExternalTrafficPolicyCluster",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:                  egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				ExternalTrafficPolicy: egv1a1.GetKubernetesServiceExternalTrafficPolicy(egv1a1.ServiceExternalTrafficPolicyCluster),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeCluster,
+			},
+		},
+		{
+			name: "LoadBalancerWithClass",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:              egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				LoadBalancerClass: &loadbalancerClass,
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				LoadBalancerClass:     &loadbalancerClass,
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithAllocateLoadBalancerNodePorts",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:                          egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				AllocateLoadBalancerNodePorts: ptr.To(true),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                          corev1.ServiceTypeLoadBalancer,
+				AllocateLoadBalancerNodePorts: ptr.To(true),
+				SessionAffinity:               corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy:         corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "LoadBalancerWithLoadBalancerIP",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type:           egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeLoadBalancer),
+				LoadBalancerIP: ptr.To("10.11.12.13"),
+			}},
+			want: corev1.ServiceSpec{
+				Type:                  corev1.ServiceTypeLoadBalancer,
+				LoadBalancerIP:        "10.11.12.13",
+				SessionAffinity:       corev1.ServiceAffinityNone,
+				ExternalTrafficPolicy: corev1.ServiceExternalTrafficPolicyTypeLocal,
+			},
+		},
+		{
+			name: "ClusterIP",
+			args: args{service: &egv1a1.KubernetesServiceSpec{
+				Type: egv1a1.GetKubernetesServiceType(egv1a1.ServiceTypeClusterIP),
+			}},
+			want: corev1.ServiceSpec{
+				Type:            corev1.ServiceTypeClusterIP,
+				SessionAffinity: corev1.ServiceAffinityNone,
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedServiceSpec(tt.args.service), "expectedServiceSpec(%v)", tt.args.service)
+		})
+	}
+}
+
+func TestGetSelector(t *testing.T) {
+	cases := []struct {
+		name     string
+		in       map[string]string
+		expected map[string]string
+	}{
+		{
+			name: "proxy",
+			in: map[string]string{
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+			expected: map[string]string{
+				"app.kubernetes.io/name":       "envoy",
+				"app.kubernetes.io/component":  "proxy",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+		{
+			name: "ratelimit",
+			in: map[string]string{
+				"app.kubernetes.io/name":       "envoy-ratelimit",
+				"app.kubernetes.io/component":  "ratelimit",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+			expected: map[string]string{
+				"app.kubernetes.io/name":       "envoy-ratelimit",
+				"app.kubernetes.io/component":  "ratelimit",
+				"app.kubernetes.io/managed-by": "envoy-gateway",
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		tc := tc
+		t.Run("", func(t *testing.T) {
+			got := GetSelector(tc.in)
+			require.Equal(t, tc.expected, got.MatchLabels)
+		})
+	}
+}
+
+func TestCompareSvc(t *testing.T) {
+	cases := []struct {
+		ExpectRet   bool
+		NewSvc      *corev1.Service
+		OriginalSvc *corev1.Service
+	}{
+		{
+			// Only Spec.Ports[*].NodePort and ClusterType is different
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							NodePort:   30000,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "NodePort",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							NodePort:   30001,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "NodePort",
+				},
+			},
+		}, {
+			// Only Spec.Ports[*].Port is different
+			ExpectRet: false,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       90,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		},
+		{
+			// only Spec.ClusterIP is different, NewSvc's ClusterIP is nil build by ResourceRender
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					ClusterIP: "192.168.1.1",
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		}, {
+			// Finalizers field differs
+			ExpectRet: true,
+			NewSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:       "my-service",
+					Namespace:  "default",
+					Finalizers: []string{"service.k8s.aws/resources"},
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+			OriginalSvc: &corev1.Service{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "my-service",
+					Namespace: "default",
+				},
+				Spec: corev1.ServiceSpec{
+					Ports: []corev1.ServicePort{
+						{
+							Name:       "http",
+							Port:       80,
+							TargetPort: intstr.FromInt(8080),
+						},
+					},
+					Selector: map[string]string{
+						"app": "my-app",
+					},
+					Type: "ClusterIP",
+				},
+			},
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run("", func(t *testing.T) {
+			assert.Equal(t, tc.ExpectRet, CompareSvc(tc.NewSvc, tc.OriginalSvc), "expectedCompareSvcReturn(%v)", tc.ExpectRet)
+		})
+	}
+}
+
+func TestExpectedProxyContainerEnv(t *testing.T) {
+	type args struct {
+		container *egv1a1.KubernetesContainerSpec
+		env       []corev1.EnvVar
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.EnvVar
+	}{
+		{
+			name: "TestExpectedProxyContainerEnv",
+			args: args{
+				container: &egv1a1.KubernetesContainerSpec{
+					Env: []corev1.EnvVar{
+						{
+							Name:  "env_a",
+							Value: "override_env_a_value",
+						},
+						{
+							Name:  "env_b",
+							Value: "override_env_a_value",
+						},
+						{
+							Name:  "env_c",
+							Value: "new_env_c_value",
+						},
+					},
+				},
+				env: []corev1.EnvVar{
+					{
+						Name:  "env_a",
+						Value: "default_env_a_value",
+					},
+					{
+						Name:  "env_b",
+						Value: "default_env_a_value",
+					},
+					{
+						Name:  "default_env",
+						Value: "default_env_value",
+					},
+				},
+			},
+			want: []corev1.EnvVar{
+				{
+					Name:  "env_a",
+					Value: "override_env_a_value",
+				},
+				{
+					Name:  "env_b",
+					Value: "override_env_a_value",
+				},
+				{
+					Name:  "default_env",
+					Value: "default_env_value",
+				},
+				{
+					Name:  "env_c",
+					Value: "new_env_c_value",
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedContainerEnv(tt.args.container, tt.args.env), "ExpectedProxyContainerEnv(%v, %v)", tt.args.container, tt.args.env)
+		})
+	}
+}
+
+func TestExpectedDeploymentVolumes(t *testing.T) {
+	type args struct {
+		pod     *egv1a1.KubernetesPodSpec
+		volumes []corev1.Volume
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.Volume
+	}{
+		{
+			name: "TestExpectedDeploymentVolumes",
+			args: args{
+				pod: &egv1a1.KubernetesPodSpec{
+					Volumes: []corev1.Volume{
+						{
+							Name: "certs",
+							VolumeSource: corev1.VolumeSource{
+								Secret: &corev1.SecretVolumeSource{
+									SecretName: "override-cert",
+								},
+							},
+						},
+					},
+				},
+				volumes: []corev1.Volume{
+					{
+						Name: "certs",
+						VolumeSource: corev1.VolumeSource{
+							Secret: &corev1.SecretVolumeSource{
+								SecretName: "cert",
+							},
+						},
+					},
+					{
+						Name: "default-certs",
+						VolumeSource: corev1.VolumeSource{
+							Secret: &corev1.SecretVolumeSource{
+								SecretName: "default-cert",
+							},
+						},
+					},
+				},
+			},
+			want: []corev1.Volume{
+				{
+					Name: "certs",
+					VolumeSource: corev1.VolumeSource{
+						Secret: &corev1.SecretVolumeSource{
+							SecretName: "override-cert",
+						},
+					},
+				},
+				{
+					Name: "default-certs",
+					VolumeSource: corev1.VolumeSource{
+						Secret: &corev1.SecretVolumeSource{
+							SecretName: "default-cert",
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedDeploymentVolumes(tt.args.pod, tt.args.volumes), "ExpectedDeploymentVolumes(%v, %v)", tt.args.pod, tt.args.volumes)
+		})
+	}
+}
+
+func TestExpectedContainerVolumeMounts(t *testing.T) {
+	type args struct {
+		container    *egv1a1.KubernetesContainerSpec
+		volumeMounts []corev1.VolumeMount
+	}
+	tests := []struct {
+		name string
+		args args
+		want []corev1.VolumeMount
+	}{
+		{
+			name: "TestExpectedContainerVolumeMounts",
+			args: args{
+				container: &egv1a1.KubernetesContainerSpec{
+					VolumeMounts: []corev1.VolumeMount{
+						{
+							Name:      "certs",
+							MountPath: "/override-certs",
+							ReadOnly:  true,
+						},
+					},
+				},
+				volumeMounts: []corev1.VolumeMount{
+					{
+						Name:      "certs",
+						MountPath: "/certs",
+						ReadOnly:  true,
+					},
+					{
+						Name:      "default-certs",
+						MountPath: "/default-certs",
+						ReadOnly:  true,
+					},
+				},
+			},
+			want: []corev1.VolumeMount{
+				{
+					Name:      "certs",
+					MountPath: "/override-certs",
+					ReadOnly:  true,
+				},
+				{
+					Name:      "default-certs",
+					MountPath: "/default-certs",
+					ReadOnly:  true,
+				},
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equalf(t, tt.want, ExpectedContainerVolumeMounts(tt.args.container, tt.args.volumeMounts), "ExpectedContainerVolumeMounts(%v, %v)", tt.args.container, tt.args.volumeMounts)
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/manager.go b/adapter/internal/operator/gateway-api/infrastructure/manager.go
new file mode 100644
index 000000000..40e902b10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/infrastructure/manager.go
@@ -0,0 +1,57 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package infrastructure
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	clicfg "sigs.k8s.io/controller-runtime/pkg/client/config"
+)
+
+var _ Manager = (*kubernetes.Infra)(nil)
+
+// Manager provides the scaffolding for managing infrastructure.
+type Manager interface {
+	// CreateOrUpdateProxyInfra creates or updates infra.
+	CreateOrUpdateProxyInfra(ctx context.Context, infra *ir.Infra) error
+	// DeleteProxyInfra deletes infra.
+	DeleteProxyInfra(ctx context.Context, infra *ir.Infra) error
+	// // CreateOrUpdateRateLimitInfra creates or updates rate limit infra.
+	// CreateOrUpdateRateLimitInfra(ctx context.Context) error
+	// DeleteRateLimitInfra deletes rate limit infra.
+	// DeleteRateLimitInfra(ctx context.Context) error
+}
+
+// NewManager returns a new infrastructure Manager.
+func NewManager() (Manager, error) {
+	var mgr Manager
+	cli, err := client.New(clicfg.GetConfigOrDie(), client.Options{})
+	if err != nil {
+		return nil, err
+	}
+	mgr = kubernetes.NewInfra(cli)
+	return mgr, nil
+}
diff --git a/adapter/internal/operator/gateway-api/ir/infra.go b/adapter/internal/operator/gateway-api/ir/infra.go
new file mode 100644
index 000000000..f679e68ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/infra.go
@@ -0,0 +1,274 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"cmp"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"golang.org/x/exp/slices"
+	utilerrors "k8s.io/apimachinery/pkg/util/errors"
+	"sigs.k8s.io/yaml"
+)
+
+const (
+	DefaultProxyName = "default"
+)
+
+// Infra defines managed infrastructure.
+// +k8s:deepcopy-gen=true
+type Infra struct {
+	// Proxy defines managed proxy infrastructure.
+	Proxy *ProxyInfra `json:"proxy" yaml:"proxy"`
+}
+
+func (i Infra) YAMLString() string {
+	y, _ := yaml.Marshal(&i)
+	return string(y)
+}
+
+// ProxyInfra defines managed proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type ProxyInfra struct {
+	// Metadata defines metadata for the managed proxy infrastructure.
+	Metadata *InfraMetadata `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	// Name is the name used for managed proxy infrastructure.
+	Name string `json:"name" yaml:"name"`
+	// Config defines user-facing configuration of the managed proxy infrastructure.
+	Config *v1alpha1.EnvoyProxy `json:"config,omitempty" yaml:"config,omitempty"`
+	// Listeners define the listeners exposed by the proxy infrastructure.
+	Listeners []*ProxyListener `json:"listeners,omitempty" yaml:"listeners,omitempty"`
+	// Addresses contain the external addresses this gateway has been
+	// requested to be available at.
+	Addresses []string `json:"addresses,omitempty" yaml:"addresses,omitempty"`
+}
+
+// InfraMetadata defines metadata for the managed proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type InfraMetadata struct {
+	// Annotations define a map of string keys and values that can be used to
+	// organize and categorize proxy infrastructure objects.
+	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+	// Labels define a map of string keys and values that can be used to organize
+	// and categorize proxy infrastructure objects.
+	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
+}
+
+// ProxyListener defines the listener configuration of the proxy infrastructure.
+// +k8s:deepcopy-gen=true
+type ProxyListener struct {
+	// Name of the ProxyListener
+	Name string `json:"name" yaml:"name"`
+	// Address is the address that the listener should listen on.
+	Address *string `json:"address" yaml:"address"`
+	// Ports define network ports of the listener.
+	Ports []ListenerPort `json:"ports,omitempty" yaml:"ports,omitempty"`
+	// HTTP3 provides HTTP/3 configuration on the listener.
+	// +optional
+	HTTP3 *HTTP3Settings `json:"http3,omitempty"`
+}
+
+// HTTP3Settings provides HTTP/3 configuration on the listener.
+type HTTP3Settings struct {
+	QUICPort int32 `json:"quicPort" yaml:"quicPort"`
+}
+
+// ListenerPort defines a network port of a listener.
+// +k8s:deepcopy-gen=true
+type ListenerPort struct {
+	// Name is the name of the listener port.
+	Name string `json:"name" yaml:"name"`
+	// Protocol is the protocol that the listener port will listener for.
+	Protocol ProtocolType `json:"protocol" yaml:"protocol"`
+	// ServicePort is the port number the proxy service is listening on.
+	ServicePort int32 `json:"servicePort" yaml:"servicePort"`
+	// ContainerPort is the port number the proxy container is listening on.
+	ContainerPort int32 `json:"containerPort" yaml:"containerPort"`
+}
+
+// ProtocolType defines the application protocol accepted by a ListenerPort.
+//
+// Valid values include "HTTP" and "HTTPS".
+type ProtocolType string
+
+const (
+	// HTTPProtocolType accepts cleartext HTTP/1.1 sessions over TCP or HTTP/2
+	// over cleartext.
+	HTTPProtocolType ProtocolType = "HTTP"
+
+	// HTTPSProtocolType accepts HTTP/1.1 or HTTP/2 sessions over TLS.
+	HTTPSProtocolType ProtocolType = "HTTPS"
+
+	// TLSProtocolType accepts TLS sessions over TCP.
+	TLSProtocolType ProtocolType = "TLS"
+
+	// TCPProtocolType accepts TCP connection.
+	TCPProtocolType ProtocolType = "TCP"
+
+	// UDPProtocolType accepts UDP connection.
+	UDPProtocolType ProtocolType = "UDP"
+)
+
+// NewInfra returns a new Infra with default parameters.
+func NewInfra() *Infra {
+	return &Infra{
+		Proxy: NewProxyInfra(),
+	}
+}
+
+// NewProxyInfra returns a new ProxyInfra with default parameters.
+func NewProxyInfra() *ProxyInfra {
+	return &ProxyInfra{
+		Metadata: NewInfraMetadata(),
+		Name:     DefaultProxyName,
+	}
+}
+
+// NewProxyListeners returns a new slice of ProxyListener with default parameters.
+func NewProxyListeners() []*ProxyListener {
+	return []*ProxyListener{
+		{
+			Ports: nil,
+		},
+	}
+}
+
+// NewInfraMetadata returns a new InfraMetadata.
+func NewInfraMetadata() *InfraMetadata {
+	return &InfraMetadata{
+		Labels: map[string]string{},
+	}
+}
+
+// GetProxyInfra returns the ProxyInfra.
+func (i *Infra) GetProxyInfra() *ProxyInfra {
+	if i.Proxy == nil {
+		i.Proxy = NewProxyInfra()
+		return i.Proxy
+	}
+	if len(i.Proxy.Name) == 0 {
+		i.Proxy.Name = DefaultProxyName
+	}
+	if len(i.Proxy.Listeners) == 0 {
+		i.Proxy.Listeners = NewProxyListeners()
+	}
+	if i.Proxy.Metadata == nil {
+		i.Proxy.Metadata = NewInfraMetadata()
+	}
+
+	return i.Proxy
+}
+
+// GetProxyMetadata returns the InfraMetadata.
+func (p *ProxyInfra) GetProxyMetadata() *InfraMetadata {
+	if p.Metadata == nil {
+		p.Metadata = NewInfraMetadata()
+	}
+
+	return p.Metadata
+}
+
+// GetProxyConfig returns the ProxyInfra config.
+func (p *ProxyInfra) GetProxyConfig() *v1alpha1.EnvoyProxy {
+	if p.Config == nil {
+		p.Config = new(v1alpha1.EnvoyProxy)
+	}
+
+	return p.Config
+}
+
+// Validate validates the provided Infra.
+func (i *Infra) Validate() error {
+	if i == nil {
+		return errors.New("infra ir is nil")
+	}
+
+	var errs []error
+
+	if i.Proxy != nil {
+		if err := i.Proxy.Validate(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+
+	return utilerrors.NewAggregate(errs)
+}
+
+// Validate validates the provided ProxyInfra.
+func (p *ProxyInfra) Validate() error {
+	var errs []error
+
+	if len(p.Name) == 0 {
+		errs = append(errs, errors.New("name field required"))
+	}
+
+	if len(p.Listeners) > 0 {
+		for i := range p.Listeners {
+			listener := p.Listeners[i]
+			if len(listener.Ports) == 0 {
+				errs = append(errs, errors.New("listener ports field required"))
+			}
+			for j := range listener.Ports {
+				if len(listener.Ports[j].Name) == 0 {
+					errs = append(errs, errors.New("listener name field required"))
+				}
+				if listener.Ports[j].ServicePort < 1 || listener.Ports[j].ServicePort > 65353 {
+					errs = append(errs, errors.New("listener service port must be a valid port number"))
+				}
+				if listener.Ports[j].ContainerPort < 1024 || listener.Ports[j].ContainerPort > 65353 {
+					errs = append(errs, errors.New("listener container port must be a valid ephemeral port number"))
+				}
+			}
+		}
+	}
+
+	return utilerrors.NewAggregate(errs)
+}
+
+// ObjectName returns the name of the proxy infrastructure object.
+func (p *ProxyInfra) ObjectName() string {
+	if len(p.Name) == 0 {
+		return fmt.Sprintf("envoy-%s", DefaultProxyName)
+	}
+	return "envoy-" + p.Name
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (p *ProxyInfra) Equal(y *ProxyInfra) bool {
+	// Deep copy to avoid modifying the original ordering.
+	p = p.DeepCopy()
+	p.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(p, y)
+}
+
+// sort ensures the listeners are in a consistent order.
+func (p *ProxyInfra) sort() {
+	slices.SortFunc(p.Listeners, func(l1, l2 *ProxyListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/ir/infra_test.go b/adapter/internal/operator/gateway-api/ir/infra_test.go
new file mode 100644
index 000000000..d87e2836d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/infra_test.go
@@ -0,0 +1,263 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateInfra(t *testing.T) {
+	testCases := []struct {
+		name   string
+		infra  *Infra
+		expect bool
+	}{
+		{
+			name:   "default",
+			infra:  NewInfra(),
+			expect: true,
+		},
+		{
+			name: "no-name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name:      "",
+					Listeners: NewProxyListeners(),
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listeners",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+				},
+			},
+			expect: true,
+		},
+		{
+			name: "no-listener-ports",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-port-name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									ServicePort:   int32(80),
+									ContainerPort: int32(8080),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-service-port-number",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									Name:          "http",
+									ContainerPort: int32(8080),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+		{
+			name: "no-listener-container-port-number",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "test",
+					Listeners: []*ProxyListener{
+						{
+							Ports: []ListenerPort{
+								{
+									Name:        "http",
+									ServicePort: int32(80),
+								},
+							},
+						},
+					},
+				},
+			},
+			expect: false,
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.infra.Validate()
+			if !tc.expect {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestNewInfra(t *testing.T) {
+	testCases := []struct {
+		name     string
+		expected *Infra
+	}{
+		{
+			name: "default infra",
+			expected: &Infra{
+				Proxy: NewProxyInfra(),
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := NewInfra()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestNewProxyInfra(t *testing.T) {
+	testCases := []struct {
+		name     string
+		expected *ProxyInfra
+	}{
+		{
+			name: "default infra",
+			expected: &ProxyInfra{
+				Metadata: NewInfraMetadata(),
+				Name:     DefaultProxyName,
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := NewProxyInfra()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestObjectName(t *testing.T) {
+	defaultInfra := NewInfra()
+
+	testCases := []struct {
+		name     string
+		infra    *Infra
+		expected string
+	}{
+		{
+			name:     "default infra",
+			infra:    defaultInfra,
+			expected: "envoy-default",
+		},
+		{
+			name: "defined infra",
+			infra: &Infra{
+				Proxy: &ProxyInfra{
+					Name: "foo",
+				},
+			},
+			expected: "envoy-foo",
+		},
+		{
+			name: "unspecified infra name",
+			infra: &Infra{
+				Proxy: &ProxyInfra{},
+			},
+			expected: "envoy-default",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			actual := tc.infra.Proxy.ObjectName()
+			require.Equal(t, tc.expected, actual)
+		})
+	}
+}
+
+func TestEqualInfra(t *testing.T) {
+	tests := []struct {
+		desc  string
+		a     *ProxyInfra
+		b     *ProxyInfra
+		equal bool
+	}{
+		{
+			desc: "out of order proxy listeners are equal",
+			a: &ProxyInfra{
+				Listeners: []*ProxyListener{
+					{Name: "listener-1"},
+					{Name: "listener-2"},
+				},
+			},
+			b: &ProxyInfra{
+				Listeners: []*ProxyListener{
+					{Name: "listener-2"},
+					{Name: "listener-1"},
+				},
+			},
+			equal: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.desc, func(t *testing.T) {
+			require.Equal(t, tc.equal, cmp.Equal(tc.a, tc.b))
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/ir/protocol.go b/adapter/internal/operator/gateway-api/ir/protocol.go
new file mode 100644
index 000000000..8847ab54a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/protocol.go
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+type AppProtocol string
+
+const (
+	// GRPC declares that the port carries gRPC traffic.
+	GRPC AppProtocol = "GRPC"
+	// GRPCWeb declares that the port carries gRPC traffic.
+	GRPCWeb AppProtocol = "GRPC-Web"
+	// HTTP declares that the port carries HTTP/1.1 traffic.
+	// Note that HTTP/1.0 or earlier may not be supported by the proxy.
+	HTTP AppProtocol = "HTTP"
+	// HTTP2 declares that the port carries HTTP/2 traffic.
+	HTTP2 AppProtocol = "HTTP2"
+	// HTTPS declares that the port carries HTTPS traffic.
+	HTTPS AppProtocol = "HTTPS"
+	// TCP declares the port uses TCP.
+	// This is the default protocol for a service port.
+	TCP AppProtocol = "TCP"
+	// UDP declares that the port uses UDP.
+	UDP AppProtocol = "UDP"
+)
diff --git a/adapter/internal/operator/gateway-api/ir/xds.go b/adapter/internal/operator/gateway-api/ir/xds.go
new file mode 100644
index 000000000..f9cc35559
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/xds.go
@@ -0,0 +1,1749 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"cmp"
+	"errors"
+	"net/http"
+	"net/netip"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/types"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"golang.org/x/exp/slices"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	"sigs.k8s.io/yaml"
+)
+
+var (
+	ErrListenerNameEmpty                       = errors.New("field Name must be specified")
+	ErrListenerAddressInvalid                  = errors.New("field Address must be a valid IP address")
+	ErrListenerPortInvalid                     = errors.New("field Port specified is invalid")
+	ErrHTTPListenerHostnamesEmpty              = errors.New("field Hostnames must be specified with at least a single hostname entry")
+	ErrTCPListenerSNIsEmpty                    = errors.New("field SNIs must be specified with at least a single server name entry")
+	ErrTLSServerCertEmpty                      = errors.New("field ServerCertificate must be specified")
+	ErrTLSPrivateKey                           = errors.New("field PrivateKey must be specified")
+	ErrHTTPRouteNameEmpty                      = errors.New("field Name must be specified")
+	ErrHTTPRouteHostnameEmpty                  = errors.New("field Hostname must be specified")
+	ErrDestinationNameEmpty                    = errors.New("field Name must be specified")
+	ErrDestEndpointHostInvalid                 = errors.New("field Address must be a valid IP or FQDN address")
+	ErrDestEndpointPortInvalid                 = errors.New("field Port specified is invalid")
+	ErrStringMatchConditionInvalid             = errors.New("only one of the Exact, Prefix, SafeRegex or Distinct fields must be set")
+	ErrStringMatchNameIsEmpty                  = errors.New("field Name must be specified")
+	ErrDirectResponseStatusInvalid             = errors.New("only HTTP status codes 100 - 599 are supported for DirectResponse")
+	ErrRedirectUnsupportedStatus               = errors.New("only HTTP status codes 301 and 302 are supported for redirect filters")
+	ErrRedirectUnsupportedScheme               = errors.New("only http and https are supported for the scheme in redirect filters")
+	ErrHTTPPathModifierDoubleReplace           = errors.New("redirect filter cannot have a path modifier that supplies both fullPathReplace and prefixMatchReplace")
+	ErrHTTPPathModifierNoReplace               = errors.New("redirect filter cannot have a path modifier that does not supply either fullPathReplace or prefixMatchReplace")
+	ErrAddHeaderEmptyName                      = errors.New("header modifier filter cannot configure a header without a name to be added")
+	ErrAddHeaderDuplicate                      = errors.New("header modifier filter attempts to add the same header more than once (case insensitive)")
+	ErrRemoveHeaderDuplicate                   = errors.New("header modifier filter attempts to remove the same header more than once (case insensitive)")
+	ErrLoadBalancerInvalid                     = errors.New("loadBalancer setting is invalid, only one setting can be set")
+	ErrHealthCheckTimeoutInvalid               = errors.New("field HealthCheck.Timeout must be specified")
+	ErrHealthCheckIntervalInvalid              = errors.New("field HealthCheck.Interval must be specified")
+	ErrHealthCheckUnhealthyThresholdInvalid    = errors.New("field HealthCheck.UnhealthyThreshold should be greater than 0")
+	ErrHealthCheckHealthyThresholdInvalid      = errors.New("field HealthCheck.HealthyThreshold should be greater than 0")
+	ErrHealthCheckerInvalid                    = errors.New("health checker setting is invalid, only one health checker can be set")
+	ErrHCHTTPHostInvalid                       = errors.New("field HTTPHealthChecker.Host should be specified")
+	ErrHCHTTPPathInvalid                       = errors.New("field HTTPHealthChecker.Path should be specified")
+	ErrHCHTTPMethodInvalid                     = errors.New("only one of the GET, HEAD, POST, DELETE, OPTIONS, TRACE, PATCH of HTTPHealthChecker.Method could be set")
+	ErrHCHTTPExpectedStatusesInvalid           = errors.New("field HTTPHealthChecker.ExpectedStatuses should be specified")
+	ErrHealthCheckPayloadInvalid               = errors.New("one of Text, Binary fields must be set in payload")
+	ErrHTTPStatusInvalid                       = errors.New("HTTPStatus should be in [200,600)")
+	ErrOutlierDetectionBaseEjectionTimeInvalid = errors.New("field OutlierDetection.BaseEjectionTime must be specified")
+	ErrOutlierDetectionIntervalInvalid         = errors.New("field OutlierDetection.Interval must be specified")
+
+	redacted = []byte("[redacted]")
+)
+
+// Xds holds the intermediate representation of a Gateway and is
+// used by the xDS Translator to convert it into xDS resources.
+// +k8s:deepcopy-gen=true
+type Xds struct {
+	// AccessLog configuration for the gateway.
+	AccessLog *AccessLog `json:"accessLog,omitempty" yaml:"accessLog,omitempty"`
+	// Tracing configuration for the gateway.
+	Tracing *Tracing `json:"tracing,omitempty" yaml:"tracing,omitempty"`
+	// Metrics configuration for the gateway.
+	Metrics *Metrics `json:"metrics,omitempty" yaml:"metrics,omitempty"`
+	// HTTP listeners exposed by the gateway.
+	HTTP []*HTTPListener `json:"http,omitempty" yaml:"http,omitempty"`
+	// TCP Listeners exposed by the gateway.
+	TCP []*TCPListener `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+	// UDP Listeners exposed by the gateway.
+	UDP []*UDPListener `json:"udp,omitempty" yaml:"udp,omitempty"`
+	// EnvoyPatchPolicies is the intermediate representation of the EnvoyPatchPolicy resource
+	// EnvoyPatchPolicies []*EnvoyPatchPolicy `json:"envoyPatchPolicies,omitempty" yaml:"envoyPatchPolicies,omitempty"`
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (x *Xds) Equal(y *Xds) bool {
+	// Deep copy to avoid modifying the original ordering.
+	x = x.DeepCopy()
+	x.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(x, y)
+}
+
+// sort ensures the listeners are in a consistent order.
+func (x *Xds) sort() {
+	slices.SortFunc(x.HTTP, func(l1, l2 *HTTPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+	for _, l := range x.HTTP {
+		slices.SortFunc(l.Routes, func(r1, r2 *HTTPRoute) int {
+			return cmp.Compare(r1.Name, r2.Name)
+		})
+	}
+	slices.SortFunc(x.TCP, func(l1, l2 *TCPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+	slices.SortFunc(x.UDP, func(l1, l2 *UDPListener) int {
+		return cmp.Compare(l1.Name, l2.Name)
+	})
+}
+
+// Validate the fields within the Xds structure.
+func (x Xds) Validate() error {
+	var errs error
+	for _, http := range x.HTTP {
+		if err := http.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, tcp := range x.TCP {
+		if err := tcp.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, udp := range x.UDP {
+		if err := udp.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+func (x Xds) GetHTTPListener(name string) *HTTPListener {
+	for _, listener := range x.HTTP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) GetTCPListener(name string) *TCPListener {
+	for _, listener := range x.TCP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) GetUDPListener(name string) *UDPListener {
+	for _, listener := range x.UDP {
+		if listener.Name == name {
+			return listener
+		}
+	}
+	return nil
+}
+
+func (x Xds) YAMLString() string {
+	y, _ := yaml.Marshal(x.Printable())
+	return string(y)
+}
+
+// Printable returns a deep copy of the resource that can be safely logged.
+func (x Xds) Printable() *Xds {
+	out := x.DeepCopy()
+	for _, listener := range out.HTTP {
+		// Omit field
+		if listener.TLS != nil {
+			for i := range listener.TLS.Certificates {
+				listener.TLS.Certificates[i].PrivateKey = redacted
+			}
+		}
+
+		for _, route := range listener.Routes {
+			// Omit field
+			if route.OIDC != nil {
+				route.OIDC.ClientSecret = redacted
+				route.OIDC.HMACSecret = redacted
+			}
+			if route.BasicAuth != nil {
+				route.BasicAuth.Users = redacted
+			}
+		}
+	}
+	return out
+}
+
+// HTTPListener holds the listener configuration.
+// +k8s:deepcopy-gen=true
+type HTTPListener struct {
+	// Name of the HttpListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// Hostnames (Host/Authority header value) with which the service can be expected to be accessed by clients.
+	// This field is required. Wildcard hosts are supported in the suffix or prefix form.
+	// Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-virtualhost
+	// for more info.
+	Hostnames []string `json:"hostnames" yaml:"hostnames"`
+	// Tls configuration. If omitted, the gateway will expose a plain text HTTP server.
+	TLS *TLSConfig `json:"tls,omitempty" yaml:"tls,omitempty"`
+	// Routes associated with HTTP traffic to the service.
+	Routes []*HTTPRoute `json:"routes,omitempty" yaml:"routes,omitempty"`
+	// IsHTTP2 is set if the listener is configured to serve HTTP2 traffic,
+	// grpc-web and grpc-stats are also enabled if this is set.
+	IsHTTP2 bool `json:"isHTTP2" yaml:"isHTTP2"`
+	// TCPKeepalive configuration for the listener
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+	// Headers configures special header management for the listener
+	Headers *HeaderSettings `json:"headers,omitempty" yaml:"headers,omitempty"`
+	// EnableProxyProtocol enables the listener to interpret proxy protocol header
+	EnableProxyProtocol bool `json:"enableProxyProtocol,omitempty" yaml:"enableProxyProtocol,omitempty"`
+	// ClientIPDetection controls how the original client IP address is determined for requests.
+	// ClientIPDetection *ClientIPDetectionSettings `json:"clientIPDetection,omitempty" yaml:"clientIPDetection,omitempty"`
+	// HTTP3 provides HTTP/3 configuration on the listener.
+	// +optional
+	HTTP3 *HTTP3Settings `json:"http3,omitempty"`
+	// Path contains settings for path URI manipulations
+	Path PathSettings `json:"path,omitempty"`
+	// HTTP1 provides HTTP/1 configuration on the listener
+	// +optional
+	HTTP1 *HTTP1Settings `json:"http1,omitempty" yaml:"http1,omitempty"`
+	// ClientTimeout sets the timeout configuration for downstream connections
+	Timeout *ClientTimeout `json:"timeout,omitempty" yaml:"clientTimeout,omitempty"`
+}
+
+// Validate the fields within the HTTPListener structure
+func (h HTTPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if len(h.Hostnames) == 0 {
+		errs = errors.Join(errs, ErrHTTPListenerHostnamesEmpty)
+	}
+	if h.TLS != nil {
+		if err := h.TLS.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, route := range h.Routes {
+		if err := route.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+type TLSVersion types.TLSVersion
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto = TLSVersion(types.TLSAuto)
+	// TLSv10 specifies TLS version 1.0
+	TLSv10 = TLSVersion(types.TLSv10)
+	// TLSv11 specifies TLS version 1.1
+	TLSv11 = TLSVersion(types.TLSv11)
+	// TLSv12 specifies TLS version 1.2
+	TLSv12 = TLSVersion(types.TLSv12)
+	// TLSv13 specifies TLS version 1.3
+	TLSv13 = TLSVersion(types.TLSv13)
+)
+
+// TLSConfig holds the configuration for downstream TLS context.
+// +k8s:deepcopy-gen=true
+type TLSConfig struct {
+	// Certificates contains the set of certificates associated with this listener
+	Certificates []TLSCertificate `json:"certificates,omitempty" yaml:"certificates,omitempty"`
+	// CACertificate to verify the client
+	CACertificate *TLSCACertificate `json:"caCertificate,omitempty" yaml:"caCertificate,omitempty"`
+	// MinVersion defines the minimal version of the TLS protocol supported by this listener.
+	MinVersion *TLSVersion `json:"minVersion,omitempty" yaml:"version,omitempty"`
+	// MaxVersion defines the maximal version of the TLS protocol supported by this listener.
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty" yaml:"version,omitempty"`
+	// CipherSuites supported by this listener
+	Ciphers []string `json:"ciphers,omitempty" yaml:"ciphers,omitempty"`
+	// EDCHCurves supported by this listener
+	ECDHCurves []string `json:"ecdhCurves,omitempty" yaml:"ecdhCurves,omitempty"`
+	// SignatureAlgorithms supported by this listener
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty" yaml:"signatureAlgorithms,omitempty"`
+	// ALPNProtocols exposed by this listener
+	ALPNProtocols []string `json:"alpnProtocols,omitempty" yaml:"alpnProtocols,omitempty"`
+}
+
+// TLSCertificate holds a single certificate's details
+// +k8s:deepcopy-gen=true
+type TLSCertificate struct {
+	// Name of the Secret object.
+	Name string `json:"name" yaml:"name"`
+	// ServerCertificate of the server.
+	ServerCertificate []byte `json:"serverCertificate,omitempty" yaml:"serverCertificate,omitempty"`
+	// PrivateKey for the server.
+	PrivateKey []byte `json:"privateKey,omitempty" yaml:"privateKey,omitempty"`
+}
+
+// TLSCACertificate holds CA Certificate to validate clients
+// +k8s:deepcopy-gen=true
+type TLSCACertificate struct {
+	// Name of the Secret object.
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+	// Certificate content.
+	Certificate []byte `json:"certificate,omitempty" yaml:"certificate,omitempty"`
+}
+
+func (t TLSCertificate) Validate() error {
+	var errs error
+	if len(t.ServerCertificate) == 0 {
+		errs = errors.Join(errs, ErrTLSServerCertEmpty)
+	}
+	if len(t.PrivateKey) == 0 {
+		errs = errors.Join(errs, ErrTLSPrivateKey)
+	}
+	return errs
+}
+
+// Validate the fields within the TLSListenerConfig structure
+func (t TLSConfig) Validate() error {
+	var errs error
+	for _, cert := range t.Certificates {
+		if err := cert.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	// Correct values for cipher suites, ECDH curves, and signature algorithms are
+	// dependent on the version of EnvoyProxy being used - different values are valid
+	// depending if Envoy was compiled against BoringSSL or OpenSSL, or even the exact version
+	// of each of these libraries.
+	// Validation for TLS versions was done with CEL
+	return errs
+}
+
+// PathSettings holds configuration for path URI manipulations
+// +k8s:deepcopy-gen=true
+type PathSettings struct {
+	MergeSlashes bool `json:"mergeSlashes" yaml:"mergeSlashes"`
+	// EscapedSlashesAction PathEscapedSlashAction `json:"escapedSlashesAction" yaml:"escapedSlashesAction"`
+}
+
+// ClientIPDetectionSettings provides configuration for determining the original client IP address for requests.
+// +k8s:deepcopy-gen=true
+// type ClientIPDetectionSettings egv1a1.ClientIPDetectionSettings
+
+// BackendWeights stores the weights of valid and invalid backends for the route so that 500 error responses can be returned in the same proportions
+type BackendWeights struct {
+	Valid   uint32 `json:"valid" yaml:"valid"`
+	Invalid uint32 `json:"invalid" yaml:"invalid"`
+}
+
+// HTTP1Settings provides HTTP/1 configuration on the listener.
+// +k8s:deepcopy-gen=true
+type HTTP1Settings struct {
+	EnableTrailers     bool            `json:"enableTrailers,omitempty" yaml:"enableTrailers,omitempty"`
+	PreserveHeaderCase bool            `json:"preserveHeaderCase,omitempty" yaml:"preserveHeaderCase,omitempty"`
+	HTTP10             *HTTP10Settings `json:"http10,omitempty" yaml:"http10,omitempty"`
+}
+
+// HTTP10Settings provides HTTP/1.0 configuration on the listener.
+// +k8s:deepcopy-gen=true
+type HTTP10Settings struct {
+	// defaultHost is set to the default host that should be injected for HTTP10. If the hostname shouldn't
+	// be set, then defaultHost will be nil
+	DefaultHost *string `json:"defaultHost,omitempty" yaml:"defaultHost,omitempty"`
+}
+
+// HeaderSettings provides configuration related to header processing on the listener.
+// +k8s:deepcopy-gen=true
+type HeaderSettings struct {
+	// EnableEnvoyHeaders controls if "x-envoy-" headers are added by the HTTP Router filter.
+	// The default is to suppress these headers.
+	// Refer to https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/filters/http/router/v3/router.proto#extensions-filters-http-router-v3-router
+	EnableEnvoyHeaders bool `json:"enableEnvoyHeaders,omitempty" yaml:"enableEnvoyHeaders,omitempty"`
+}
+
+// ClientTimeout sets the timeout configuration for downstream connections
+// +k8s:deepcopy-gen=true
+type ClientTimeout struct {
+	// Timeout settings for HTTP.
+	HTTP *HTTPClientTimeout `json:"http,omitempty" yaml:"http,omitempty"`
+}
+
+// HTTPClientTimeout set the configuration for client HTTP.
+// +k8s:deepcopy-gen=true
+type HTTPClientTimeout struct {
+	// The duration envoy waits for the complete request reception. This timer starts upon request
+	// initiation and stops when either the last byte of the request is sent upstream or when the response begins.
+	RequestReceivedTimeout *metav1.Duration `json:"requestReceivedTimeout,omitempty" yaml:"requestReceivedTimeout,omitempty"`
+}
+
+// HTTPRoute holds the route information associated with the HTTP Route
+// +k8s:deepcopy-gen=true
+type HTTPRoute struct {
+	// Name of the HTTPRoute
+	Name string `json:"name" yaml:"name"`
+	// Hostname that the route matches against
+	Hostname string `json:"hostname" yaml:"hostname,omitempty"`
+	// IsHTTP2 is set if the route is configured to serve HTTP2 traffic
+	IsHTTP2 bool `json:"isHTTP2" yaml:"isHTTP2"`
+	// PathMatch defines the match conditions on the path.
+	PathMatch *StringMatch `json:"pathMatch,omitempty" yaml:"pathMatch,omitempty"`
+	// HeaderMatches define the match conditions on the request headers for this route.
+	HeaderMatches []*StringMatch `json:"headerMatches,omitempty" yaml:"headerMatches,omitempty"`
+	// QueryParamMatches define the match conditions on the query parameters.
+	QueryParamMatches []*StringMatch `json:"queryParamMatches,omitempty" yaml:"queryParamMatches,omitempty"`
+	// DestinationWeights stores the weights of valid and invalid backends for the route so that 500 error responses can be returned in the same proportions
+	BackendWeights BackendWeights `json:"backendWeights" yaml:"backendWeights"`
+	// AddRequestHeaders defines header/value sets to be added to the headers of requests.
+	AddRequestHeaders []AddHeader `json:"addRequestHeaders,omitempty" yaml:"addRequestHeaders,omitempty"`
+	// RemoveRequestHeaders defines a list of headers to be removed from requests.
+	RemoveRequestHeaders []string `json:"removeRequestHeaders,omitempty" yaml:"removeRequestHeaders,omitempty"`
+	// AddResponseHeaders defines header/value sets to be added to the headers of response.
+	AddResponseHeaders []AddHeader `json:"addResponseHeaders,omitempty" yaml:"addResponseHeaders,omitempty"`
+	// RemoveResponseHeaders defines a list of headers to be removed from response.
+	RemoveResponseHeaders []string `json:"removeResponseHeaders,omitempty" yaml:"removeResponseHeaders,omitempty"`
+	// Direct responses to be returned for this route. Takes precedence over Destinations and Redirect.
+	DirectResponse *DirectResponse `json:"directResponse,omitempty" yaml:"directResponse,omitempty"`
+	// Redirections to be returned for this route. Takes precedence over Destinations.
+	Redirect *Redirect `json:"redirect,omitempty" yaml:"redirect,omitempty"`
+	// Destination that requests to this HTTPRoute will be mirrored to
+	Mirrors []*RouteDestination `json:"mirrors,omitempty" yaml:"mirrors,omitempty"`
+	// Destination associated with this matched route.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+	// Rewrite to be changed for this route.
+	URLRewrite *URLRewrite `json:"urlRewrite,omitempty" yaml:"urlRewrite,omitempty"`
+	// RateLimit defines the more specific match conditions as well as limits for ratelimiting
+	// the requests on this route.
+	RateLimit *RateLimit `json:"rateLimit,omitempty" yaml:"rateLimit,omitempty"`
+	// load balancer policy to use when routing to the backend endpoints.
+	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty" yaml:"loadBalancer,omitempty"`
+	// CORS policy for the route.
+	CORS *CORS `json:"cors,omitempty" yaml:"cors,omitempty"`
+	// JWT defines the schema for authenticating HTTP requests using JSON Web Tokens (JWT).
+	// JWT *JWT `json:"jwt,omitempty" yaml:"jwt,omitempty"`
+	// OIDC defines the schema for authenticating HTTP requests using OpenID Connect (OIDC).
+	OIDC *OIDC `json:"oidc,omitempty" yaml:"oidc,omitempty"`
+	// Proxy Protocol Settings
+	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty" yaml:"proxyProtocol,omitempty"`
+	// BasicAuth defines the schema for the HTTP Basic Authentication.
+	BasicAuth *BasicAuth `json:"basicAuth,omitempty" yaml:"basicAuth,omitempty"`
+	// ExtAuth defines the schema for the external authorization.
+	ExtAuth *ExtAuth `json:"extAuth,omitempty" yaml:"extAuth,omitempty"`
+	// HealthCheck defines the configuration for health checking on the upstream.
+	HealthCheck *HealthCheck `json:"healthCheck,omitempty" yaml:"healthCheck,omitempty"`
+	// FaultInjection defines the schema for injecting faults into HTTP requests.
+	FaultInjection *FaultInjection `json:"faultInjection,omitempty" yaml:"faultInjection,omitempty"`
+	// ExtensionRefs holds unstructured resources that were introduced by an extension and used on the HTTPRoute as extensionRef filters
+	ExtensionRefs []*UnstructuredRef `json:"extensionRefs,omitempty" yaml:"extensionRefs,omitempty"`
+	// Circuit Breaker Settings
+	CircuitBreaker *CircuitBreaker `json:"circuitBreaker,omitempty" yaml:"circuitBreaker,omitempty"`
+	// Request and connection timeout settings
+	Timeout *Timeout `json:"timeout,omitempty" yaml:"timeout,omitempty"`
+	// TcpKeepalive settings associated with the upstream client connection.
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+	// Retry settings
+	Retry *Retry `json:"retry,omitempty" yaml:"retry,omitempty"`
+}
+
+// UnstructuredRef holds unstructured data for an arbitrary k8s resource introduced by an extension
+// Envoy Gateway does not need to know about the resource types in order to store and pass the data for these objects
+// to an extension.
+//
+// +k8s:deepcopy-gen=true
+type UnstructuredRef struct {
+	Object *unstructured.Unstructured `json:"object,omitempty" yaml:"object,omitempty"`
+}
+
+// CORS holds the Cross-Origin Resource Sharing (CORS) policy for the route.
+//
+// +k8s:deepcopy-gen=true
+type CORS struct {
+	// AllowOrigins defines the origins that are allowed to make requests.
+	AllowOrigins []*StringMatch `json:"allowOrigins,omitempty" yaml:"allowOrigins,omitempty"`
+	// AllowMethods defines the methods that are allowed to make requests.
+	AllowMethods []string `json:"allowMethods,omitempty" yaml:"allowMethods,omitempty"`
+	// AllowHeaders defines the headers that are allowed to be sent with requests.
+	AllowHeaders []string `json:"allowHeaders,omitempty" yaml:"allowHeaders,omitempty"`
+	// ExposeHeaders defines the headers that can be exposed in the responses.
+	ExposeHeaders []string `json:"exposeHeaders,omitempty" yaml:"exposeHeaders,omitempty"`
+	// MaxAge defines how long the results of a preflight request can be cached.
+	MaxAge *metav1.Duration `json:"maxAge,omitempty" yaml:"maxAge,omitempty"`
+	// AllowCredentials indicates whether a request can include user credentials.
+	AllowCredentials bool `json:"allowCredentials,omitempty" yaml:"allowCredentials,omitempty"`
+}
+
+// // JWT defines the schema for authenticating HTTP requests using
+// // JSON Web Tokens (JWT).
+// //
+// // +k8s:deepcopy-gen=true
+// type JWT struct {
+// 	// Providers defines a list of JSON Web Token (JWT) authentication providers.
+// 	Providers []egv1a1.JWTProvider `json:"providers,omitempty" yaml:"providers,omitempty"`
+// }
+
+// OIDC defines the schema for authenticating HTTP requests using
+// OpenID Connect (OIDC).
+//
+// +k8s:deepcopy-gen=true
+type OIDC struct {
+	// The OIDC Provider configuration.
+	Provider OIDCProvider `json:"provider" yaml:"provider"`
+
+	// The OIDC client ID to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	ClientID string `json:"clientID" yaml:"clientID"`
+
+	// The OIDC client secret to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	//
+	// This is an Opaque secret. The client secret should be stored in the key "client-secret".
+	ClientSecret []byte `json:"clientSecret,omitempty" yaml:"clientSecret,omitempty"`
+
+	// HMACSecret is the secret used to sign the HMAC of the OAuth2 filter cookies.
+	HMACSecret []byte `json:"hmacSecret,omitempty" yaml:"hmacSecret,omitempty"`
+
+	// The OIDC scopes to be used in the
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	Scopes []string `json:"scopes,omitempty" yaml:"scopes,omitempty"`
+
+	// The redirect URL to be used in the OIDC
+	// [Authentication Request](https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest).
+	RedirectURL string `json:"redirectURL,omitempty"`
+
+	// The path part of the redirect URL
+	RedirectPath string `json:"redirectPath,omitempty"`
+
+	// The path to log a user out, clearing their credential cookies.
+	LogoutPath string `json:"logoutPath,omitempty"`
+
+	// CookieSuffix will be added to the name of the cookies set by the oauth filter.
+	// Adding a suffix avoids multiple oauth filters from overwriting each other's cookies.
+	// These cookies are set by the oauth filter, including: BearerToken,
+	// OauthHMAC, OauthExpires, IdToken, and RefreshToken.
+	CookieSuffix string `json:"cookieSuffix,omitempty"`
+}
+
+type OIDCProvider struct {
+	// The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).
+	AuthorizationEndpoint string `json:"authorizationEndpoint,omitempty"`
+
+	// The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).
+	TokenEndpoint string `json:"tokenEndpoint,omitempty"`
+}
+
+// BasicAuth defines the schema for the HTTP Basic Authentication.
+//
+// +k8s:deepcopy-gen=true
+type BasicAuth struct {
+	// The username-password pairs in htpasswd format.
+	Users []byte `json:"users,omitempty" yaml:"users,omitempty"`
+}
+
+// ExtAuth defines the schema for the external authorization.
+//
+// +k8s:deepcopy-gen=true
+type ExtAuth struct {
+	// GRPC defines the gRPC External Authorization service.
+	// Only one of GRPCService or HTTPService may be specified.
+	GRPC *GRPCExtAuthService `json:"grpc,omitempty"`
+
+	// HTTP defines the HTTP External Authorization service.
+	// Only one of GRPCService or HTTPService may be specified.
+	HTTP *HTTPExtAuthService `json:"http,omitempty"`
+
+	// HeadersToExtAuth defines the client request headers that will be included
+	// in the request to the external authorization service.
+	// Note: If not specified, the default behavior for gRPC and HTTP external
+	// authorization services is different due to backward compatibility reasons.
+	// All headers will be included in the check request to a gRPC authorization server.
+	// Only the following headers will be included in the check request to an HTTP
+	// authorization server: Host, Method, Path, Content-Length, and Authorization.
+	// And these headers will always be included to the check request to an HTTP
+	// authorization server by default, no matter whether they are specified
+	// in HeadersToExtAuth or not.
+	// +optional
+	HeadersToExtAuth []string `json:"headersToExtAuth,omitempty"`
+}
+
+// HTTPExtAuthService defines the HTTP External Authorization service
+// +k8s:deepcopy-gen=true
+type HTTPExtAuthService struct {
+	// Destination defines the destination for the HTTP External Authorization service.
+	Destination RouteDestination `json:"destination"`
+
+	// Authority is the hostname:port of the HTTP External Authorization service.
+	Authority string `json:"authority"`
+
+	// Path is the path of the HTTP External Authorization service.
+	// If path is not empty, the authorization request will be sent to that path,
+	// or else the authorization request will be sent to the root path.
+	Path string `json:"path"`
+
+	// HeadersToBackend are the authorization response headers that will be added
+	// to the original client request before sending it to the backend server.
+	// Note that coexisting headers will be overridden.
+	// If not specified, no authorization response headers will be added to the
+	// original client request.
+	// +optional
+	HeadersToBackend []string `json:"headersToBackend,omitempty"`
+}
+
+// GRPCExtAuthService defines the gRPC External Authorization service
+// The authorization request message is defined in
+// https://www.envoyproxy.io/docs/envoy/latest/api-v3/service/auth/v3/external_auth.proto
+// +k8s:deepcopy-gen=true
+type GRPCExtAuthService struct {
+	// Destination defines the destination for the gRPC External Authorization service.
+	Destination RouteDestination `json:"destination"`
+
+	// Authority is the hostname:port of the gRPC External Authorization service.
+	Authority string `json:"authority"`
+}
+
+// FaultInjection defines the schema for injecting faults into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjection struct {
+	// Delay defines the fault injection delay.
+	Delay *FaultInjectionDelay `json:"delay,omitempty" yaml:"delay,omitempty"`
+	// Abort defines the fault injection abort.
+	Abort *FaultInjectionAbort `json:"abort,omitempty" yaml:"abort,omitempty"`
+}
+
+// FaultInjectionDelay defines the schema for injecting delay into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjectionDelay struct {
+	// FixedDelay defines the fixed delay duration.
+	FixedDelay *metav1.Duration `json:"fixedDelay,omitempty" yaml:"fixedDelay,omitempty"`
+	// Percentage defines the percentage of requests to be delayed.
+	Percentage *float32 `json:"percentage,omitempty" yaml:"percentage,omitempty"`
+}
+
+// FaultInjectionAbort defines the schema for injecting abort into requests.
+//
+// +k8s:deepcopy-gen=true
+type FaultInjectionAbort struct {
+	// HTTPStatus defines the HTTP status code to be returned.
+	HTTPStatus *int32 `json:"httpStatus,omitempty" yaml:"httpStatus,omitempty"`
+	// GrpcStatus defines the gRPC status code to be returned.
+	GrpcStatus *int32 `json:"grpcStatus,omitempty" yaml:"grpcStatus,omitempty"`
+	// Percentage defines the percentage of requests to be aborted.
+	Percentage *float32 `json:"percentage,omitempty" yaml:"percentage,omitempty"`
+}
+
+// Validate the fields within the HTTPRoute structure
+func (h HTTPRoute) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrHTTPRouteNameEmpty)
+	}
+	if h.Hostname == "" {
+		errs = errors.Join(errs, ErrHTTPRouteHostnameEmpty)
+	}
+	if h.PathMatch != nil {
+		if err := h.PathMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, hMatch := range h.HeaderMatches {
+		if err := hMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	for _, qMatch := range h.QueryParamMatches {
+		if err := qMatch.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Redirect != nil {
+		if err := h.Redirect.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.DirectResponse != nil {
+		if err := h.DirectResponse.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.URLRewrite != nil {
+		if err := h.URLRewrite.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if h.Mirrors != nil {
+		for _, mirror := range h.Mirrors {
+			if err := mirror.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+	if len(h.AddRequestHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.AddRequestHeaders {
+			if err := header.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+			if occurred.Has(header.Name) {
+				errs = errors.Join(errs, ErrAddHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header.Name)
+		}
+	}
+	if len(h.RemoveRequestHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.RemoveRequestHeaders {
+			if occurred.Has(header) {
+				errs = errors.Join(errs, ErrRemoveHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header)
+		}
+	}
+	if len(h.AddResponseHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.AddResponseHeaders {
+			if err := header.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+			if occurred.Has(header.Name) {
+				errs = errors.Join(errs, ErrAddHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header.Name)
+		}
+	}
+	if len(h.RemoveResponseHeaders) > 0 {
+		occurred := sets.NewString()
+		for _, header := range h.RemoveResponseHeaders {
+			if occurred.Has(header) {
+				errs = errors.Join(errs, ErrRemoveHeaderDuplicate)
+				break
+			}
+			occurred.Insert(header)
+		}
+	}
+	if h.LoadBalancer != nil {
+		if err := h.LoadBalancer.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	// if h.JWT != nil {
+	// 	if err := h.JWT.validate(); err != nil {
+	// 		errs = errors.Join(errs, err)
+	// 	}
+	// }
+	if h.HealthCheck != nil {
+		if err := h.HealthCheck.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// func (j *JWT) validate() error {
+// 	var errs error
+
+// 	if err := egv1a1validation.ValidateJWTProvider(j.Providers); err != nil {
+// 		errs = errors.Join(errs, err)
+// 	}
+
+// 	return errs
+// }
+
+// RouteDestination holds the destination details associated with the route
+// +kubebuilder:object:generate=true
+type RouteDestination struct {
+	// Name of the destination. This field allows the xds layer
+	// to check if this route destination already exists and can be
+	// reused
+	Name     string                `json:"name" yaml:"name"`
+	Settings []*DestinationSetting `json:"settings,omitempty" yaml:"settings,omitempty"`
+}
+
+// Validate the fields within the RouteDestination structure
+func (r RouteDestination) Validate() error {
+	var errs error
+	if len(r.Name) == 0 {
+		errs = errors.Join(errs, ErrDestinationNameEmpty)
+	}
+	for _, s := range r.Settings {
+		if err := s.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// DestinationSetting holds the settings associated with the destination
+// +kubebuilder:object:generate=true
+type DestinationSetting struct {
+	// Weight associated with this destination.
+	// Note: Weight is not used in TCP/UDP route.
+	Weight *uint32 `json:"weight,omitempty" yaml:"weight,omitempty"`
+	// Protocol associated with this destination/port.
+	Protocol  AppProtocol            `json:"protocol" yaml:"protocol"`
+	Endpoints []*DestinationEndpoint `json:"endpoints,omitempty" yaml:"endpoints,omitempty"`
+	// AddressTypeState specifies the state of DestinationEndpoint address type.
+	AddressType *DestinationAddressType `json:"addressType,omitempty" yaml:"addressType,omitempty"`
+
+	TLS *TLSUpstreamConfig `json:"tls,omitempty" yaml:"tls,omitempty"`
+}
+
+// Validate the fields within the RouteDestination structure
+func (d DestinationSetting) Validate() error {
+	var errs error
+	for _, ep := range d.Endpoints {
+		if err := ep.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// DestinationAddressType describes the address type state for a group of DestinationEndpoint
+type DestinationAddressType string
+
+const (
+	IP    DestinationAddressType = "IP"
+	FQDN  DestinationAddressType = "FQDN"
+	MIXED DestinationAddressType = "Mixed"
+)
+
+// DestinationEndpoint holds the endpoint details associated with the destination
+// +kubebuilder:object:generate=true
+type DestinationEndpoint struct {
+	// Host refers to the FQDN or IP address of the backend service.
+	Host string `json:"host" yaml:"host"`
+	// Port on the service to forward the request to.
+	Port uint32 `json:"port" yaml:"port"`
+}
+
+// Validate the fields within the DestinationEndpoint structure
+func (d DestinationEndpoint) Validate() error {
+	var errs error
+
+	err := validation.IsDNS1123Subdomain(d.Host)
+	_, pErr := netip.ParseAddr(d.Host)
+
+	if err != nil && pErr != nil {
+		errs = errors.Join(errs, ErrDestEndpointHostInvalid)
+	}
+
+	if d.Port == 0 {
+		errs = errors.Join(errs, ErrDestEndpointPortInvalid)
+	}
+
+	return errs
+}
+
+// NewDestEndpoint creates a new DestinationEndpoint.
+func NewDestEndpoint(host string, port uint32) *DestinationEndpoint {
+	return &DestinationEndpoint{
+		Host: host,
+		Port: port,
+	}
+}
+
+// AddHeader configures a header to be added to a request or response.
+// +k8s:deepcopy-gen=true
+type AddHeader struct {
+	Name   string `json:"name" yaml:"name"`
+	Value  string `json:"value" yaml:"value"`
+	Append bool   `json:"append" yaml:"append"`
+}
+
+// Validate the fields within the AddHeader structure
+func (h AddHeader) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrAddHeaderEmptyName)
+	}
+
+	return errs
+}
+
+// DirectResponse holds the details for returning a body and status code for a route.
+// +k8s:deepcopy-gen=true
+type DirectResponse struct {
+	// Body configures the body of the direct response. Currently only a string response
+	// is supported, but in the future a config.core.v3.DataSource may replace it.
+	Body *string `json:"body,omitempty" yaml:"body,omitempty"`
+	// StatusCode will be used for the direct response's status code.
+	StatusCode uint32 `json:"statusCode" yaml:"statusCode"`
+}
+
+// Validate the fields within the DirectResponse structure
+func (r DirectResponse) Validate() error {
+	var errs error
+	if status := r.StatusCode; status > 599 || status < 100 {
+		errs = errors.Join(errs, ErrDirectResponseStatusInvalid)
+	}
+
+	return errs
+}
+
+// URLRewrite holds the details for how to rewrite a request
+// +k8s:deepcopy-gen=true
+type URLRewrite struct {
+	// Path contains config for rewriting the path of the request.
+	Path *HTTPPathModifier `json:"path,omitempty" yaml:"path,omitempty"`
+	// Hostname configures the replacement of the request's hostname.
+	Hostname *string `json:"hostname,omitempty" yaml:"hostname,omitempty"`
+}
+
+// Validate the fields within the URLRewrite structure
+func (r URLRewrite) Validate() error {
+	var errs error
+
+	if r.Path != nil {
+		if err := r.Path.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// Redirect holds the details for how and where to redirect a request
+// +k8s:deepcopy-gen=true
+type Redirect struct {
+	// Scheme configures the replacement of the request's scheme.
+	Scheme *string `json:"scheme" yaml:"scheme"`
+	// Hostname configures the replacement of the request's hostname.
+	Hostname *string `json:"hostname" yaml:"hostname"`
+	// Path contains config for rewriting the path of the request.
+	Path *HTTPPathModifier `json:"path" yaml:"path"`
+	// Port configures the replacement of the request's port.
+	Port *uint32 `json:"port" yaml:"port"`
+	// Status code configures the redirection response's status code.
+	StatusCode *int32 `json:"statusCode" yaml:"statusCode"`
+}
+
+// Validate the fields within the Redirect structure
+func (r Redirect) Validate() error {
+	var errs error
+
+	if r.Scheme != nil {
+		if *r.Scheme != "http" && *r.Scheme != "https" {
+			errs = errors.Join(errs, ErrRedirectUnsupportedScheme)
+		}
+	}
+
+	if r.Path != nil {
+		if err := r.Path.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if r.StatusCode != nil {
+		if *r.StatusCode != 301 && *r.StatusCode != 302 {
+			errs = errors.Join(errs, ErrRedirectUnsupportedStatus)
+		}
+	}
+
+	return errs
+}
+
+// HTTPPathModifier holds instructions for how to modify the path of a request on a redirect response
+// +k8s:deepcopy-gen=true
+type HTTPPathModifier struct {
+	// FullReplace provides a string to replace the full path of the request.
+	FullReplace *string `json:"fullReplace" yaml:"fullReplace"`
+	// PrefixMatchReplace provides a string to replace the matched prefix of the request.
+	PrefixMatchReplace *string `json:"prefixMatchReplace" yaml:"prefixMatchReplace"`
+}
+
+// Validate the fields within the HTTPPathModifier structure
+func (r HTTPPathModifier) Validate() error {
+	var errs error
+
+	if r.FullReplace != nil && r.PrefixMatchReplace != nil {
+		errs = errors.Join(errs, ErrHTTPPathModifierDoubleReplace)
+	}
+
+	if r.FullReplace == nil && r.PrefixMatchReplace == nil {
+		errs = errors.Join(errs, ErrHTTPPathModifierNoReplace)
+	}
+
+	return errs
+}
+
+// StringMatch holds the various match conditions.
+// Only one of Exact, Prefix, SafeRegex or Distinct can be set.
+// +k8s:deepcopy-gen=true
+type StringMatch struct {
+	// Name of the field to match on.
+	Name string `json:"name" yaml:"name"`
+	// Exact match condition.
+	Exact *string `json:"exact,omitempty" yaml:"exact,omitempty"`
+	// Prefix match condition.
+	Prefix *string `json:"prefix,omitempty" yaml:"prefix,omitempty"`
+	// Suffix match condition.
+	Suffix *string `json:"suffix,omitempty" yaml:"suffix,omitempty"`
+	// SafeRegex match condition.
+	SafeRegex *string `json:"safeRegex,omitempty" yaml:"safeRegex,omitempty"`
+	// Distinct match condition.
+	// Used to match any and all possible unique values encountered within the Name field.
+	Distinct bool `json:"distinct" yaml:"distinct"`
+}
+
+// Validate the fields within the StringMatch structure
+func (s StringMatch) Validate() error {
+	var errs error
+	matchCount := 0
+	if s.Exact != nil {
+		matchCount++
+	}
+	if s.Prefix != nil {
+		matchCount++
+	}
+	if s.Suffix != nil {
+		matchCount++
+	}
+	if s.SafeRegex != nil {
+		matchCount++
+	}
+	if s.Distinct {
+		if s.Name == "" {
+			errs = errors.Join(errs, ErrStringMatchNameIsEmpty)
+		}
+		matchCount++
+	}
+
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrStringMatchConditionInvalid)
+	}
+
+	return errs
+}
+
+// TCPListener holds the TCP listener configuration.
+// +k8s:deepcopy-gen=true
+type TCPListener struct {
+	// Name of the TCPListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// TLS holds information for configuring TLS on a listener
+	TLS *TLS `json:"tls,omitempty" yaml:"tls,omitempty"`
+	// Destinations associated with TCP traffic to the service.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+	// TCPKeepalive configuration for the listener
+	TCPKeepalive *TCPKeepalive `json:"tcpKeepalive,omitempty" yaml:"tcpKeepalive,omitempty"`
+}
+
+// TLS holds information for configuring TLS on a listener
+// +k8s:deepcopy-gen=true
+type TLS struct {
+	// TLS information required for TLS Passthrough, If provided, incoming
+	// connections' server names are inspected and routed to backends accordingly.
+	Passthrough *TLSInspectorConfig `json:"passthrough,omitempty" yaml:"passthrough,omitempty"`
+	// TLS information required for TLS Termination
+	Terminate *TLSConfig `json:"terminate,omitempty" yaml:"terminate,omitempty"`
+}
+
+// Validate the fields within the TCPListener structure
+func (h TCPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if h.TLS != nil && h.TLS.Passthrough != nil {
+		if err := h.TLS.Passthrough.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if h.TLS != nil && h.TLS.Terminate != nil {
+		if err := h.TLS.Terminate.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// TLSInspectorConfig holds the configuration required for inspecting TLS
+// passthrough connections.
+// +k8s:deepcopy-gen=true
+type TLSInspectorConfig struct {
+	// Server names that are compared against the server names of a new connection.
+	// Wildcard hosts are supported in the prefix form. Partial wildcards are not
+	// supported, and values like *w.example.com are invalid.
+	// SNIs are used only in case of TLS Passthrough.
+	SNIs []string `json:"snis,omitempty" yaml:"snis,omitempty"`
+}
+
+func (t TLSInspectorConfig) Validate() error {
+	var errs error
+	if len(t.SNIs) == 0 {
+		errs = errors.Join(errs, ErrTCPListenerSNIsEmpty)
+	}
+	return errs
+}
+
+// UDPListener holds the UDP listener configuration.
+// +k8s:deepcopy-gen=true
+type UDPListener struct {
+	// Name of the UDPListener
+	Name string `json:"name" yaml:"name"`
+	// Address that the listener should listen on.
+	Address string `json:"address" yaml:"address"`
+	// Port on which the service can be expected to be accessed by clients.
+	Port uint32 `json:"port" yaml:"port"`
+	// Destination associated with UDP traffic to the service.
+	Destination *RouteDestination `json:"destination,omitempty" yaml:"destination,omitempty"`
+}
+
+// Validate the fields within the UDPListener structure
+func (h UDPListener) Validate() error {
+	var errs error
+	if h.Name == "" {
+		errs = errors.Join(errs, ErrListenerNameEmpty)
+	}
+	if _, err := netip.ParseAddr(h.Address); err != nil {
+		errs = errors.Join(errs, ErrListenerAddressInvalid)
+	}
+	if h.Port == 0 {
+		errs = errors.Join(errs, ErrListenerPortInvalid)
+	}
+	if h.Destination != nil {
+		if err := h.Destination.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// RateLimit holds the rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type RateLimit struct {
+	// Global rate limit settings.
+	Global *GlobalRateLimit `json:"global,omitempty" yaml:"global,omitempty"`
+
+	// Local rate limit settings.
+	Local *LocalRateLimit `json:"local,omitempty" yaml:"local,omitempty"`
+}
+
+// GlobalRateLimit holds the global rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type GlobalRateLimit struct {
+	// TODO zhaohuabing: add default values for Global rate limiting.
+
+	// Rules for rate limiting.
+	Rules []*RateLimitRule `json:"rules,omitempty" yaml:"rules,omitempty"`
+}
+
+// LocalRateLimit holds the local rate limiting configuration.
+// +k8s:deepcopy-gen=true
+type LocalRateLimit struct {
+	// Default rate limiting values.
+	// If a request does not match any of the rules, the default values are used.
+	Default RateLimitValue `json:"default,omitempty" yaml:"default,omitempty"`
+
+	// Rules for rate limiting.
+	Rules []*RateLimitRule `json:"rules,omitempty" yaml:"rules,omitempty"`
+}
+
+// RateLimitRule holds the match and limit configuration for ratelimiting.
+// +k8s:deepcopy-gen=true
+type RateLimitRule struct {
+	// HeaderMatches define the match conditions on the request headers for this route.
+	HeaderMatches []*StringMatch `json:"headerMatches" yaml:"headerMatches"`
+	// CIDRMatch define the match conditions on the source IP's CIDR for this route.
+	CIDRMatch *CIDRMatch `json:"cidrMatch,omitempty" yaml:"cidrMatch,omitempty"`
+	// Limit holds the rate limit values.
+	Limit RateLimitValue `json:"limit,omitempty" yaml:"limit,omitempty"`
+}
+
+type CIDRMatch struct {
+	CIDR    string `json:"cidr" yaml:"cidr"`
+	IPv6    bool   `json:"ipv6" yaml:"ipv6"`
+	MaskLen int    `json:"maskLen" yaml:"maskLen"`
+	// Distinct means that each IP Address within the specified Source IP CIDR is treated as a distinct client selector
+	// and uses a separate rate limit bucket/counter.
+	Distinct bool `json:"distinct" yaml:"distinct"`
+}
+
+// TODO zhaohuabing: remove this function
+func (r *RateLimitRule) IsMatchSet() bool {
+	return len(r.HeaderMatches) != 0 || r.CIDRMatch != nil
+}
+
+// type RateLimitUnit egv1a1.RateLimitUnit
+
+// RateLimitValue holds the
+// +k8s:deepcopy-gen=true
+type RateLimitValue struct {
+	// Requests are the number of requests that need to be rate limited.
+	Requests uint `json:"requests" yaml:"requests"`
+	// Unit of rate limiting.
+	// Unit RateLimitUnit `json:"unit" yaml:"unit"`
+}
+
+// AccessLog holds the access logging configuration.
+// +k8s:deepcopy-gen=true
+type AccessLog struct {
+	Text          []*TextAccessLog          `json:"text,omitempty" yaml:"text,omitempty"`
+	JSON          []*JSONAccessLog          `json:"json,omitempty" yaml:"json,omitempty"`
+	OpenTelemetry []*OpenTelemetryAccessLog `json:"openTelemetry,omitempty" yaml:"openTelemetry,omitempty"`
+}
+
+// TextAccessLog holds the configuration for text access logging.
+// +k8s:deepcopy-gen=true
+type TextAccessLog struct {
+	Format *string `json:"format,omitempty" yaml:"format,omitempty"`
+	Path   string  `json:"path" yaml:"path"`
+}
+
+// JSONAccessLog holds the configuration for JSON access logging.
+// +k8s:deepcopy-gen=true
+type JSONAccessLog struct {
+	JSON map[string]string `json:"json,omitempty" yaml:"json,omitempty"`
+	Path string            `json:"path" yaml:"path"`
+}
+
+// OpenTelemetryAccessLog holds the configuration for OpenTelemetry access logging.
+// +k8s:deepcopy-gen=true
+type OpenTelemetryAccessLog struct {
+	Text       *string           `json:"text,omitempty" yaml:"text,omitempty"`
+	Attributes map[string]string `json:"attributes,omitempty" yaml:"attributes,omitempty"`
+	Host       string            `json:"host" yaml:"host"`
+	Port       uint32            `json:"port" yaml:"port"`
+	Resources  map[string]string `json:"resources,omitempty" yaml:"resources,omitempty"`
+}
+
+// JSONPatchConfig defines the configuration for patching a Envoy xDS Resource
+// using JSONPatch semantics
+// +k8s:deepcopy-gen=true
+type JSONPatchConfig struct {
+	// Type is the typed URL of the Envoy xDS Resource
+	Type string `json:"type" yaml:"type"`
+	// Name is the name of the resource
+	Name string `json:"name" yaml:"name"`
+	// Patch defines the JSON Patch Operation
+	Operation JSONPatchOperation `json:"operation" yaml:"operation"`
+}
+
+// JSONPatchOperation defines the JSON Patch Operation as defined in
+// https://datatracker.ietf.org/doc/html/rfc6902
+// +k8s:deepcopy-gen=true
+type JSONPatchOperation struct {
+	// Op is the type of operation to perform
+	Op string `json:"op" yaml:"op"`
+	// Path is the location of the target document/field where the operation will be performed
+	// Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
+	Path string `json:"path" yaml:"path"`
+	// From is the source location of the value to be copied or moved. Only valid
+	// for move or copy operations
+	// Refer to https://datatracker.ietf.org/doc/html/rfc6901 for more details.
+	// +optional
+	From *string `json:"from,omitempty" yaml:"from,omitempty"`
+	// Value is the new value of the path location.
+	Value *apiextensionsv1.JSON `json:"value,omitempty" yaml:"value,omitempty"`
+}
+
+// Tracing defines the configuration for tracing a Envoy xDS Resource
+// +k8s:deepcopy-gen=true
+type Tracing struct {
+	ServiceName string `json:"serviceName"`
+
+	egv1a1.ProxyTracing
+}
+
+// Metrics defines the configuration for metrics generated by Envoy
+// +k8s:deepcopy-gen=true
+type Metrics struct {
+	EnableVirtualHostStats bool `json:"enableVirtualHostStats" yaml:"enableVirtualHostStats"`
+}
+
+// TCPKeepalive define the TCP Keepalive configuration.
+// +k8s:deepcopy-gen=true
+type TCPKeepalive struct {
+	// The total number of unacknowledged probes to send before deciding
+	// the connection is dead.
+	// Defaults to 9.
+	Probes *uint32 `json:"probes,omitempty" yaml:"probes,omitempty"`
+	// The duration, in seconds, a connection needs to be idle before keep-alive
+	// probes start being sent.
+	// Defaults to `7200s`.
+	IdleTime *uint32 `json:"idleTime,omitempty" yaml:"idleTime,omitempty"`
+	// The duration, in seconds, between keep-alive probes.
+	// Defaults to `75s`.
+	Interval *uint32 `json:"interval,omitempty" yaml:"interval,omitempty"`
+}
+
+// LoadBalancer defines the load balancer settings.
+// +k8s:deepcopy-gen=true
+type LoadBalancer struct {
+	// RoundRobin load balacning policy
+	RoundRobin *RoundRobin `json:"roundRobin,omitempty" yaml:"roundRobin,omitempty"`
+	// LeastRequest load balancer policy
+	LeastRequest *LeastRequest `json:"leastRequest,omitempty" yaml:"leastRequest,omitempty"`
+	// Random load balancer policy
+	Random *Random `json:"random,omitempty" yaml:"random,omitempty"`
+	// ConsistentHash load balancer policy
+	ConsistentHash *ConsistentHash `json:"consistentHash,omitempty" yaml:"consistentHash,omitempty"`
+}
+
+// Validate the fields within the LoadBalancer structure
+func (l *LoadBalancer) Validate() error {
+	var errs error
+	matchCount := 0
+	if l.RoundRobin != nil {
+		matchCount++
+	}
+	if l.LeastRequest != nil {
+		matchCount++
+	}
+	if l.Random != nil {
+		matchCount++
+	}
+	if l.ConsistentHash != nil {
+		matchCount++
+	}
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrLoadBalancerInvalid)
+	}
+
+	return errs
+}
+
+// RoundRobin load balancer settings
+// +k8s:deepcopy-gen=true
+type RoundRobin struct {
+	// SlowStart defines the slow start configuration.
+	// If set, slow start mode is enabled for newly added hosts in the cluster.
+	SlowStart *SlowStart `json:"slowStart,omitempty" yaml:"slowStart,omitempty"`
+}
+
+// LeastRequest load balancer settings
+// +k8s:deepcopy-gen=true
+type LeastRequest struct {
+	// SlowStart defines the slow start configuration.
+	// If set, slow start mode is enabled for newly added hosts in the cluster.
+	SlowStart *SlowStart `json:"slowStart,omitempty" yaml:"slowStart,omitempty"`
+}
+
+// Random load balancer settings
+// +k8s:deepcopy-gen=true
+type Random struct{}
+
+// ConsistentHash load balancer settings
+// +k8s:deepcopy-gen=true
+type ConsistentHash struct {
+	// Hash based on the Source IP Address
+	SourceIP *bool `json:"sourceIP,omitempty" yaml:"sourceIP,omitempty"`
+}
+
+type ProxyProtocolVersion string
+
+const (
+	// ProxyProtocolVersionV1 is the PROXY protocol version 1 (human readable format).
+	ProxyProtocolVersionV1 ProxyProtocolVersion = "V1"
+	// ProxyProtocolVersionV2 is the PROXY protocol version 2 (binary format).
+	ProxyProtocolVersionV2 ProxyProtocolVersion = "V2"
+)
+
+// ProxyProtocol upstream settings
+// +k8s:deepcopy-gen=true
+type ProxyProtocol struct {
+	// Version of proxy protocol to use
+	Version ProxyProtocolVersion `json:"version,omitempty" yaml:"version,omitempty"`
+}
+
+// SlowStart defines the slow start configuration.
+// +k8s:deepcopy-gen=true
+type SlowStart struct {
+	// Window defines the duration of the warm up period for newly added host.
+	Window *metav1.Duration `json:"window" yaml:"window"`
+}
+
+// Backend CircuitBreaker settings for the DEFAULT routing priority
+// +k8s:deepcopy-gen=true
+type CircuitBreaker struct {
+	// The maximum number of connections that Envoy will establish.
+	MaxConnections *uint32 `json:"maxConnections,omitempty" yaml:"maxConnections,omitempty"`
+
+	// The maximum number of pending requests that Envoy will queue.
+	MaxPendingRequests *uint32 `json:"maxPendingRequests,omitempty" yaml:"maxPendingRequests,omitempty"`
+
+	// The maximum number of parallel requests that Envoy will make.
+	MaxParallelRequests *uint32 `json:"maxParallelRequests,omitempty" yaml:"maxParallelRequests,omitempty"`
+
+	// The maximum number of parallel requests that Envoy will make.
+	MaxRequestsPerConnection *uint32 `json:"maxRequestsPerConnection,omitempty" yaml:"maxRequestsPerConnection,omitempty"`
+
+	// The maximum number of parallel retries that Envoy will make.
+	MaxParallelRetries *uint32 `json:"maxParallelRetries,omitempty" yaml:"maxParallelRetries,omitempty"`
+}
+
+// HealthCheck defines health check settings
+// +k8s:deepcopy-gen=true
+type HealthCheck struct {
+	Active *ActiveHealthCheck `json:"active,omitempty" yaml:"active,omitempty"`
+
+	Passive *OutlierDetection `json:"passive,omitempty" yaml:"passive,omitempty"`
+}
+
+// OutlierDetection defines passive health check settings
+// +k8s:deepcopy-gen=true
+type OutlierDetection struct {
+	// Interval defines the time between passive health checks.
+	Interval *metav1.Duration `json:"interval,omitempty"`
+	// SplitExternalLocalOriginErrors enables splitting of errors between external and local origin.
+	SplitExternalLocalOriginErrors *bool `json:"splitExternalLocalOriginErrors,omitempty" yaml:"splitExternalLocalOriginErrors,omitempty"`
+	// ConsecutiveLocalOriginFailures sets the number of consecutive local origin failures triggering ejection.
+	ConsecutiveLocalOriginFailures *uint32 `json:"consecutiveLocalOriginFailures,omitempty" yaml:"consecutiveLocalOriginFailures,omitempty"`
+	// ConsecutiveGatewayErrors sets the number of consecutive gateway errors triggering ejection.
+	ConsecutiveGatewayErrors *uint32 `json:"consecutiveGatewayErrors,omitempty" yaml:"consecutiveGatewayErrors,omitempty"`
+	// Consecutive5xxErrors sets the number of consecutive 5xx errors triggering ejection.
+	Consecutive5xxErrors *uint32 `json:"consecutive5XxErrors,omitempty" yaml:"consecutive5XxErrors,omitempty"`
+	// BaseEjectionTime defines the base duration for which a host will be ejected on consecutive failures.
+	BaseEjectionTime *metav1.Duration `json:"baseEjectionTime,omitempty" yaml:"baseEjectionTime,omitempty"`
+	// MaxEjectionPercent sets the maximum percentage of hosts in a cluster that can be ejected.
+	MaxEjectionPercent *int32 `json:"maxEjectionPercent,omitempty" yaml:"maxEjectionPercent,omitempty"`
+}
+
+// ActiveHealthCheck defines active health check settings
+// +k8s:deepcopy-gen=true
+type ActiveHealthCheck struct {
+	// Timeout defines the time to wait for a health check response.
+	Timeout *metav1.Duration `json:"timeout"`
+	// Interval defines the time between active health checks.
+	Interval *metav1.Duration `json:"interval"`
+	// UnhealthyThreshold defines the number of unhealthy health checks required before a backend host is marked unhealthy.
+	UnhealthyThreshold *uint32 `json:"unhealthyThreshold"`
+	// HealthyThreshold defines the number of healthy health checks required before a backend host is marked healthy.
+	HealthyThreshold *uint32 `json:"healthyThreshold"`
+	// HTTP defines the configuration of http health checker.
+	HTTP *HTTPHealthChecker `json:"http,omitempty" yaml:"http,omitempty"`
+	// TCP defines the configuration of tcp health checker.
+	TCP *TCPHealthChecker `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+}
+
+func (h *HealthCheck) SetHTTPHostIfAbsent(host string) {
+	if h != nil && h.Active != nil && h.Active.HTTP != nil && h.Active.HTTP.Host == "" {
+		h.Active.HTTP.Host = host
+	}
+}
+
+// Validate the fields within the HealthCheck structure.
+func (h *HealthCheck) Validate() error {
+	var errs error
+	if h.Active != nil {
+		if h.Active.Timeout != nil && h.Active.Timeout.Duration == 0 {
+			errs = errors.Join(errs, ErrHealthCheckTimeoutInvalid)
+		}
+		if h.Active.Interval != nil && h.Active.Interval.Duration == 0 {
+			errs = errors.Join(errs, ErrHealthCheckIntervalInvalid)
+		}
+		if h.Active.UnhealthyThreshold != nil && *h.Active.UnhealthyThreshold == 0 {
+			errs = errors.Join(errs, ErrHealthCheckUnhealthyThresholdInvalid)
+		}
+		if h.Active.HealthyThreshold != nil && *h.Active.HealthyThreshold == 0 {
+			errs = errors.Join(errs, ErrHealthCheckHealthyThresholdInvalid)
+		}
+
+		matchCount := 0
+		if h.Active.HTTP != nil {
+			matchCount++
+		}
+		if h.Active.TCP != nil {
+			matchCount++
+		}
+		if matchCount > 1 {
+			errs = errors.Join(errs, ErrHealthCheckerInvalid)
+		}
+
+		if h.Active.HTTP != nil {
+			if err := h.Active.HTTP.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+		if h.Active.TCP != nil {
+			if err := h.Active.TCP.Validate(); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	if h.Passive != nil {
+		if h.Passive.BaseEjectionTime != nil && h.Passive.BaseEjectionTime.Duration == 0 {
+			errs = errors.Join(errs, ErrOutlierDetectionBaseEjectionTimeInvalid)
+		}
+
+		if h.Passive.Interval != nil && h.Passive.Interval.Duration == 0 {
+			errs = errors.Join(errs, ErrOutlierDetectionIntervalInvalid)
+		}
+	}
+
+	return errs
+}
+
+// HTTPHealthChecker defines the settings of http health check.
+// +k8s:deepcopy-gen=true
+type HTTPHealthChecker struct {
+	// Host defines the value of the host header in the HTTP health check request.
+	Host string `json:"host" yaml:"host"`
+	// Path defines the HTTP path that will be requested during health checking.
+	Path string `json:"path" yaml:"path"`
+	// Method defines the HTTP method used for health checking.
+	Method *string `json:"method,omitempty" yaml:"method,omitempty"`
+	// ExpectedStatuses defines a list of HTTP response statuses considered healthy.
+	ExpectedStatuses []HTTPStatus `json:"expectedStatuses,omitempty" yaml:"expectedStatuses,omitempty"`
+	// ExpectedResponse defines a list of HTTP expected responses to match.
+	ExpectedResponse *HealthCheckPayload `json:"expectedResponse,omitempty" yaml:"expectedResponses,omitempty"`
+}
+
+// Validate the fields within the HTTPHealthChecker structure.
+func (c *HTTPHealthChecker) Validate() error {
+	var errs error
+	if c.Host == "" {
+		errs = errors.Join(errs, ErrHCHTTPHostInvalid)
+	}
+	if c.Path == "" {
+		errs = errors.Join(errs, ErrHCHTTPPathInvalid)
+	}
+	if c.Method != nil {
+		switch *c.Method {
+		case http.MethodGet:
+		case http.MethodHead:
+		case http.MethodPost:
+		case http.MethodPut:
+		case http.MethodDelete:
+		case http.MethodOptions:
+		case http.MethodTrace:
+		case http.MethodPatch:
+		case "":
+		default:
+			errs = errors.Join(errs, ErrHCHTTPMethodInvalid)
+		}
+	}
+	if len(c.ExpectedStatuses) == 0 {
+		errs = errors.Join(errs, ErrHCHTTPExpectedStatusesInvalid)
+	}
+	for _, r := range c.ExpectedStatuses {
+		if err := r.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if c.ExpectedResponse != nil {
+		if err := c.ExpectedResponse.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// HTTPStatus represents http status code.
+type HTTPStatus int
+
+func (h HTTPStatus) Validate() error {
+	if h < 100 || h >= 600 {
+		return ErrHTTPStatusInvalid
+	}
+	return nil
+}
+
+// TCPHealthChecker defines the settings of tcp health check.
+// +k8s:deepcopy-gen=true
+type TCPHealthChecker struct {
+	Send    *HealthCheckPayload `json:"send,omitempty" yaml:"send,omitempty"`
+	Receive *HealthCheckPayload `json:"receive,omitempty" yaml:"receive,omitempty"`
+}
+
+// Validate the fields within the TCPHealthChecker structure.
+func (c *TCPHealthChecker) Validate() error {
+	var errs error
+	if c.Send != nil {
+		if err := c.Send.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	if c.Receive != nil {
+		if err := c.Receive.Validate(); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// HealthCheckPayload defines the encoding of the payload bytes in the payload.
+// +k8s:deepcopy-gen=true
+type HealthCheckPayload struct {
+	// Text payload in plain text.
+	Text *string `json:"text,omitempty" yaml:"text,omitempty"`
+	// Binary payload base64 encoded
+	Binary []byte `json:"binary,omitempty" yaml:"binary,omitempty"`
+}
+
+// Validate the fields in the HealthCheckPayload.
+func (p *HealthCheckPayload) Validate() error {
+	var errs error
+	matchCount := 0
+	if p.Text != nil && *p.Text != "" {
+		matchCount++
+	}
+	if len(p.Binary) > 0 {
+		matchCount++
+	}
+	if matchCount != 1 {
+		errs = errors.Join(errs, ErrHealthCheckPayloadInvalid)
+	}
+	return errs
+}
+
+// Backend connection timeout settings
+// +k8s:deepcopy-gen=true
+type Timeout struct {
+	// Timeout settings for TCP.
+	TCP *TCPTimeout `json:"tcp,omitempty" yaml:"tcp,omitempty"`
+
+	// Timeout settings for HTTP.
+	HTTP *HTTPTimeout `json:"http,omitempty" yaml:"tcp,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type TCPTimeout struct {
+	// The timeout for network connection establishment, including TCP and TLS handshakes.
+	ConnectTimeout *metav1.Duration `json:"connectTimeout,omitempty" yaml:"connectTimeout,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPTimeout struct {
+	// RequestTimeout is the time until which entire response is received from the upstream.
+	RequestTimeout *metav1.Duration `json:"requestTimeout,omitempty" yaml:"requestTimeout,omitempty"`
+
+	// The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+	ConnectionIdleTimeout *metav1.Duration `json:"connectionIdleTimeout,omitempty" yaml:"connectionIdleTimeout,omitempty"`
+
+	// The maximum duration of an HTTP connection.
+	MaxConnectionDuration *metav1.Duration `json:"maxConnectionDuration,omitempty" yaml:"maxConnectionDuration,omitempty"`
+}
+
+// Retry define the retry policy configuration.
+// +k8s:deepcopy-gen=true
+type Retry struct {
+	// NumRetries is the number of retries to be attempted. Defaults to 2.
+	NumRetries *uint32 `json:"numRetries,omitempty"`
+
+	// RetryOn specifies the retry trigger condition.
+	RetryOn *RetryOn `json:"retryOn,omitempty"`
+
+	// PerRetry is the retry policy to be applied per retry attempt.
+	PerRetry *PerRetryPolicy `json:"perRetry,omitempty"`
+}
+
+type TriggerEnum egv1a1.TriggerEnum
+
+const (
+	Error5XX             = TriggerEnum(egv1a1.Error5XX)
+	GatewayError         = TriggerEnum(egv1a1.GatewayError)
+	Reset                = TriggerEnum(egv1a1.Reset)
+	ConnectFailure       = TriggerEnum(egv1a1.ConnectFailure)
+	Retriable4XX         = TriggerEnum(egv1a1.Retriable4XX)
+	RefusedStream        = TriggerEnum(egv1a1.RefusedStream)
+	RetriableStatusCodes = TriggerEnum(egv1a1.RetriableStatusCodes)
+	Cancelled            = TriggerEnum(egv1a1.Cancelled)
+	DeadlineExceeded     = TriggerEnum(egv1a1.DeadlineExceeded)
+	Internal             = TriggerEnum(egv1a1.Internal)
+	ResourceExhausted    = TriggerEnum(egv1a1.ResourceExhausted)
+	Unavailable          = TriggerEnum(egv1a1.Unavailable)
+)
+
+// +k8s:deepcopy-gen=true
+type RetryOn struct {
+	// Triggers specifies the retry trigger condition(Http/Grpc).
+	Triggers []TriggerEnum `json:"triggers,omitempty"`
+
+	// HttpStatusCodes specifies the http status codes to be retried.
+	HTTPStatusCodes []HTTPStatus `json:"httpStatusCodes,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type PerRetryPolicy struct {
+	// Timeout is the timeout per retry attempt.
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Backoff is the backoff policy to be applied per retry attempt.
+	BackOff *BackOffPolicy `json:"backOff,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type BackOffPolicy struct {
+	// BaseInterval is the base interval between retries.
+	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// MaxInterval is the maximum interval between retries.
+	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+}
+
+// TLSUpstreamConfig contains sni and ca file in []byte format.
+// +k8s:deepcopy-gen=true
+type TLSUpstreamConfig struct {
+	SNI                 string            `json:"sni,omitempty" yaml:"sni,omitempty"`
+	UseSystemTrustStore bool              `json:"useSystemTrustStore,omitempty" yaml:"useSystemTrustStore,omitempty"`
+	CACertificate       *TLSCACertificate `json:"caCertificate,omitempty" yaml:"caCertificate,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/ir/xds_test.go b/adapter/internal/operator/gateway-api/ir/xds_test.go
new file mode 100644
index 000000000..c2c9b1aac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/xds_test.go
@@ -0,0 +1,1438 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package ir
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+)
+
+var (
+	// HTTPListener
+	happyHTTPListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&happyHTTPRoute},
+	}
+	happyHTTPSListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		TLS: &TLSConfig{
+			Certificates: []TLSCertificate{{
+
+				Name:              "happy",
+				ServerCertificate: []byte{1, 2, 3},
+				PrivateKey:        []byte{1, 2, 3},
+			}}},
+		Routes: []*HTTPRoute{&happyHTTPRoute},
+	}
+	redactedHappyHTTPSListener = HTTPListener{
+		Name:      "happy",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		TLS: &TLSConfig{
+			Certificates: []TLSCertificate{{
+
+				Name:              "happy",
+				ServerCertificate: []byte{1, 2, 3},
+				PrivateKey:        redacted,
+			}}},
+		Routes: []*HTTPRoute{&happyHTTPRoute},
+	}
+	invalidAddrHTTPListener = HTTPListener{
+		Name:      "invalid-addr",
+		Address:   "1.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&happyHTTPRoute},
+	}
+	invalidBackendHTTPListener = HTTPListener{
+		Name:      "invalid-backend-match",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&invalidBackendHTTPRoute},
+	}
+	weightedInvalidBackendsHTTPListener = HTTPListener{
+		Name:      "weighted-invalid-backends-match",
+		Address:   "0.0.0.0",
+		Port:      80,
+		Hostnames: []string{"example.com"},
+		Routes:    []*HTTPRoute{&weightedInvalidBackendsHTTPRoute},
+	}
+
+	// TCPListener
+	happyTCPListenerTLSPassthrough = TCPListener{
+		Name:        "happy",
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+
+	happyTCPListenerTLSTerminate = TCPListener{
+		Name:    "happy",
+		Address: "0.0.0.0",
+		Port:    80,
+		TLS: &TLS{Terminate: &TLSConfig{
+			Certificates: []TLSCertificate{{
+				Name:              "happy",
+				ServerCertificate: []byte("server-cert"),
+				PrivateKey:        []byte("priv-key"),
+			}}}},
+		Destination: &happyRouteDestination,
+	}
+
+	emptySNITCPListenerTLSPassthrough = TCPListener{
+		Name:        "empty-sni",
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidNameTCPListenerTLSPassthrough = TCPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+	invalidAddrTCPListenerTLSPassthrough = TCPListener{
+		Name:        "invalid-addr",
+		Address:     "1.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{"example.com"}}},
+		Destination: &happyRouteDestination,
+	}
+	invalidSNITCPListenerTLSPassthrough = TCPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		TLS:         &TLS{Passthrough: &TLSInspectorConfig{SNIs: []string{}}},
+		Destination: &happyRouteDestination,
+	}
+
+	// UDPListener
+	happyUDPListener = UDPListener{
+		Name:        "happy",
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidNameUDPListener = UDPListener{
+		Address:     "0.0.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidAddrUDPListener = UDPListener{
+		Name:        "invalid-addr",
+		Address:     "1.0.0",
+		Port:        80,
+		Destination: &happyRouteDestination,
+	}
+	invalidPortUDPListenerT = UDPListener{
+		Name:        "invalid-port",
+		Address:     "0.0.0.0",
+		Port:        0,
+		Destination: &happyRouteDestination,
+	}
+
+	// HTTPRoute
+	happyHTTPRoute = HTTPRoute{
+		Name:     "happy",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("example"),
+		},
+		Destination: &happyRouteDestination,
+	}
+	invalidBackendHTTPRoute = HTTPRoute{
+		Name:     "invalid-backend",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("invalid-backend"),
+		},
+		BackendWeights: BackendWeights{
+			Invalid: 1,
+		},
+	}
+	weightedInvalidBackendsHTTPRoute = HTTPRoute{
+		Name:     "weighted-invalid-backends",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("invalid-backends"),
+		},
+		Destination: &happyRouteDestination,
+		BackendWeights: BackendWeights{
+			Invalid: 1,
+			Valid:   1,
+		},
+	}
+
+	redirectHTTPRoute = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:   ptr.To("https"),
+			Hostname: ptr.To("redirect.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace: ptr.To("/redirect"),
+			},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](301),
+		},
+	}
+	// A direct response error is used when an invalid filter type is supplied
+	invalidFilterHTTPRoute = HTTPRoute{
+		Name:     "filter-error",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("filter-error"),
+		},
+		DirectResponse: &DirectResponse{
+			Body:       ptr.To("invalid filter type"),
+			StatusCode: uint32(500),
+		},
+	}
+
+	redirectFilterInvalidStatus = HTTPRoute{
+		Name:     "redirect-bad-status-scheme-nopat",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:     ptr.To("err"),
+			Hostname:   ptr.To("redirect.example.com"),
+			Path:       &HTTPPathModifier{},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](305),
+		},
+	}
+	redirectFilterBadPath = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		Redirect: &Redirect{
+			Scheme:   ptr.To("https"),
+			Hostname: ptr.To("redirect.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace:        ptr.To("/redirect"),
+				PrefixMatchReplace: ptr.To("/redirect"),
+			},
+			Port:       ptr.To(uint32(8443)),
+			StatusCode: ptr.To[int32](301),
+		},
+	}
+	directResponseBadStatus = HTTPRoute{
+		Name:     "redirect",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("redirect"),
+		},
+		DirectResponse: &DirectResponse{
+			Body:       ptr.To("invalid filter type"),
+			StatusCode: uint32(799),
+		},
+	}
+
+	urlRewriteHTTPRoute = HTTPRoute{
+		Name:     "rewrite",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("rewrite"),
+		},
+		URLRewrite: &URLRewrite{
+			Hostname: ptr.To("rewrite.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace: ptr.To("/rewrite"),
+			},
+		},
+	}
+
+	urlRewriteFilterBadPath = HTTPRoute{
+		Name:     "rewrite",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("rewrite"),
+		},
+		URLRewrite: &URLRewrite{
+			Hostname: ptr.To("rewrite.example.com"),
+			Path: &HTTPPathModifier{
+				FullReplace:        ptr.To("/rewrite"),
+				PrefixMatchReplace: ptr.To("/rewrite"),
+			},
+		},
+	}
+
+	addRequestHeaderHTTPRoute = HTTPRoute{
+		Name:     "addheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header-2",
+				Value:  "example-value-2",
+				Append: false,
+			},
+			{
+				Name:   "empty-header",
+				Value:  "",
+				Append: false,
+			},
+		},
+	}
+
+	removeRequestHeaderHTTPRoute = HTTPRoute{
+		Name:     "remheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("remheader"),
+		},
+		RemoveRequestHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"another-header",
+		},
+	}
+
+	addAndRemoveRequestHeadersDupeHTTPRoute = HTTPRoute{
+		Name:     "duplicateheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("duplicateheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header",
+				Value:  "example-value-2",
+				Append: false,
+			},
+		},
+		RemoveRequestHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"example-header",
+		},
+	}
+
+	addRequestHeaderEmptyHTTPRoute = HTTPRoute{
+		Name:     "addemptyheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addemptyheader"),
+		},
+		AddRequestHeaders: []AddHeader{
+			{
+				Name:   "",
+				Value:  "example-value",
+				Append: true,
+			},
+		},
+	}
+
+	addResponseHeaderHTTPRoute = HTTPRoute{
+		Name:     "addheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header-2",
+				Value:  "example-value-2",
+				Append: false,
+			},
+			{
+				Name:   "empty-header",
+				Value:  "",
+				Append: false,
+			},
+		},
+	}
+
+	removeResponseHeaderHTTPRoute = HTTPRoute{
+		Name:     "remheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("remheader"),
+		},
+		RemoveResponseHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"another-header",
+		},
+	}
+
+	addAndRemoveResponseHeadersDupeHTTPRoute = HTTPRoute{
+		Name:     "duplicateheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("duplicateheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "example-header",
+				Value:  "example-value",
+				Append: true,
+			},
+			{
+				Name:   "example-header",
+				Value:  "example-value-2",
+				Append: false,
+			},
+		},
+		RemoveResponseHeaders: []string{
+			"x-request-header",
+			"example-header",
+			"example-header",
+		},
+	}
+
+	addResponseHeaderEmptyHTTPRoute = HTTPRoute{
+		Name:     "addemptyheader",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("addemptyheader"),
+		},
+		AddResponseHeaders: []AddHeader{
+			{
+				Name:   "",
+				Value:  "example-value",
+				Append: true,
+			},
+		},
+	}
+
+	jwtAuthenHTTPRoute = HTTPRoute{
+		Name:     "jwtauthen",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("jwtauthen"),
+		},
+	}
+	requestMirrorFilter = HTTPRoute{
+		Name:     "mirrorfilter",
+		Hostname: "*",
+		PathMatch: &StringMatch{
+			Exact: ptr.To("mirrorfilter"),
+		},
+		Mirrors: []*RouteDestination{&happyRouteDestination},
+	}
+
+	// RouteDestination
+	happyRouteDestination = RouteDestination{
+		Name: "happy-dest",
+		Settings: []*DestinationSetting{
+			{
+				Endpoints: []*DestinationEndpoint{
+					{
+						Host: "10.11.12.13",
+						Port: 8080,
+					},
+				},
+			},
+		},
+	}
+)
+
+func TestValidateXds(t *testing.T) {
+	tests := []struct {
+		name  string
+		input Xds
+		want  []error
+	}{
+		{
+			name: "happy",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+			want: nil,
+		},
+		{
+			name: "happy tls passthrough",
+			input: Xds{
+				TCP: []*TCPListener{&happyTCPListenerTLSPassthrough},
+			},
+			want: nil,
+		},
+		{
+			name: "happy tls terminate",
+			input: Xds{
+				TCP: []*TCPListener{&happyTCPListenerTLSTerminate},
+			},
+			want: nil,
+		},
+		{
+			name: "invalid listener",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &invalidAddrHTTPListener},
+			},
+			want: []error{ErrListenerAddressInvalid},
+		},
+		{
+			name: "invalid backend",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &invalidBackendHTTPListener},
+			},
+			want: nil,
+		},
+		{
+			name: "weighted invalid backend",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener, &weightedInvalidBackendsHTTPListener},
+			},
+			want: nil,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateHTTPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HTTPListener
+		want  []error
+	}{
+		{
+			name:  "happy",
+			input: happyHTTPListener,
+			want:  nil,
+		},
+		{
+			name: "invalid name",
+			input: HTTPListener{
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes:    []*HTTPRoute{&happyHTTPRoute},
+			},
+			want: []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "invalid addr",
+			input: invalidAddrHTTPListener,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name: "invalid port and hostnames",
+			input: HTTPListener{
+				Name:    "invalid-port-and-hostnames",
+				Address: "1.0.0",
+				Routes:  []*HTTPRoute{&happyHTTPRoute},
+			},
+			want: []error{ErrListenerPortInvalid, ErrHTTPListenerHostnamesEmpty},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTCPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input TCPListener
+		want  []error
+	}{
+		{
+			name:  "tls passthrough happy",
+			input: happyTCPListenerTLSPassthrough,
+			want:  nil,
+		},
+		{
+			name:  "tcp empty SNIs",
+			input: emptySNITCPListenerTLSPassthrough,
+			want:  nil,
+		},
+		{
+			name:  "tls passthrough invalid name",
+			input: invalidNameTCPListenerTLSPassthrough,
+			want:  []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "tls passthrough invalid addr",
+			input: invalidAddrTCPListenerTLSPassthrough,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name:  "tls passthrough empty SNIs",
+			input: invalidSNITCPListenerTLSPassthrough,
+			want:  []error{ErrTCPListenerSNIsEmpty},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateTLSListenerConfig(t *testing.T) {
+	tests := []struct {
+		name  string
+		input TLSConfig
+		want  error
+	}{
+		{
+			name: "happy",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					ServerCertificate: []byte("server-cert"),
+					PrivateKey:        []byte("priv-key"),
+				}}},
+			want: nil,
+		},
+		{
+			name: "invalid server cert",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					PrivateKey: []byte("priv-key"),
+				}}},
+			want: ErrTLSServerCertEmpty,
+		},
+		{
+			name: "invalid private key",
+			input: TLSConfig{
+				Certificates: []TLSCertificate{{
+					ServerCertificate: []byte("server-cert"),
+				}}},
+			want: ErrTLSPrivateKey,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestEqualXds(t *testing.T) {
+	tests := []struct {
+		desc  string
+		a     *Xds
+		b     *Xds
+		equal bool
+	}{
+		{
+			desc: "out of order http routes are equal",
+			a: &Xds{
+				HTTP: []*HTTPListener{
+					{
+						Name: "listener-1",
+						Routes: []*HTTPRoute{
+							{Name: "route-1"},
+							{Name: "route-2"},
+						},
+					},
+				},
+			},
+			b: &Xds{
+				HTTP: []*HTTPListener{
+					{
+						Name: "listener-1",
+						Routes: []*HTTPRoute{
+							{Name: "route-2"},
+							{Name: "route-1"},
+						},
+					},
+				},
+			},
+			equal: true,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.desc, func(t *testing.T) {
+			require.Equal(t, tc.equal, cmp.Equal(tc.a, tc.b))
+		})
+	}
+}
+
+func TestValidateUDPListener(t *testing.T) {
+	tests := []struct {
+		name  string
+		input UDPListener
+		want  []error
+	}{
+		{
+			name:  "udp happy",
+			input: happyUDPListener,
+			want:  nil,
+		},
+		{
+			name:  "udp invalid name",
+			input: invalidNameUDPListener,
+			want:  []error{ErrListenerNameEmpty},
+		},
+		{
+			name:  "udp invalid addr",
+			input: invalidAddrUDPListener,
+			want:  []error{ErrListenerAddressInvalid},
+		},
+		{
+			name:  "udp invalid port",
+			input: invalidPortUDPListenerT,
+			want:  []error{ErrListenerPortInvalid},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateHTTPRoute(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HTTPRoute
+		want  []error
+	}{
+		{
+			name:  "happy",
+			input: happyHTTPRoute,
+			want:  nil,
+		},
+		{
+			name: "invalid name",
+			input: HTTPRoute{
+				Hostname: "*",
+				PathMatch: &StringMatch{
+					Exact: ptr.To("example"),
+				},
+				Destination: &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteNameEmpty},
+		},
+		{
+			name: "invalid hostname",
+			input: HTTPRoute{
+				Name: "invalid hostname",
+				PathMatch: &StringMatch{
+					Exact: ptr.To("example"),
+				},
+				Destination: &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteHostnameEmpty},
+		},
+		{
+			name:  "invalid backend",
+			input: invalidBackendHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "weighted invalid backends",
+			input: weightedInvalidBackendsHTTPRoute,
+			want:  nil,
+		},
+		{
+			name: "empty name and invalid match",
+			input: HTTPRoute{
+				Hostname:      "*",
+				HeaderMatches: []*StringMatch{ptr.To(StringMatch{})},
+				Destination:   &happyRouteDestination,
+			},
+			want: []error{ErrHTTPRouteNameEmpty, ErrStringMatchConditionInvalid},
+		},
+		{
+			name:  "redirect-httproute",
+			input: redirectHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "filter-error-httproute",
+			input: invalidFilterHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "redirect-bad-status-scheme-nopath",
+			input: redirectFilterInvalidStatus,
+			want:  []error{ErrRedirectUnsupportedStatus, ErrRedirectUnsupportedScheme, ErrHTTPPathModifierNoReplace},
+		},
+		{
+			name:  "redirect-bad-path",
+			input: redirectFilterBadPath,
+			want:  []error{ErrHTTPPathModifierDoubleReplace},
+		},
+		{
+			name:  "direct-response-bad-status",
+			input: directResponseBadStatus,
+			want:  []error{ErrDirectResponseStatusInvalid},
+		},
+		{
+			name:  "rewrite-httproute",
+			input: urlRewriteHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "rewrite-bad-path",
+			input: urlRewriteFilterBadPath,
+			want:  []error{ErrHTTPPathModifierDoubleReplace},
+		},
+		{
+			name:  "add-request-headers-httproute",
+			input: addRequestHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "remove-request-headers-httproute",
+			input: removeRequestHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "add-remove-request-headers-duplicate",
+			input: addAndRemoveRequestHeadersDupeHTTPRoute,
+			want:  []error{ErrAddHeaderDuplicate, ErrRemoveHeaderDuplicate},
+		},
+		{
+			name:  "add-request-header-empty",
+			input: addRequestHeaderEmptyHTTPRoute,
+			want:  []error{ErrAddHeaderEmptyName},
+		},
+		{
+			name:  "add-response-headers-httproute",
+			input: addResponseHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "remove-response-headers-httproute",
+			input: removeResponseHeaderHTTPRoute,
+			want:  nil,
+		},
+		{
+			name:  "add-remove-response-headers-duplicate",
+			input: addAndRemoveResponseHeadersDupeHTTPRoute,
+			want:  []error{ErrAddHeaderDuplicate, ErrRemoveHeaderDuplicate},
+		},
+		{
+			name:  "add-response-header-empty",
+			input: addResponseHeaderEmptyHTTPRoute,
+			want:  []error{ErrAddHeaderEmptyName},
+		},
+		{
+			name:  "jwt-authen-httproute",
+			input: jwtAuthenHTTPRoute,
+		},
+		{
+			name:  "mirror-filter",
+			input: requestMirrorFilter,
+			want:  nil,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				got := test.input.Validate()
+				for _, w := range test.want {
+					require.ErrorContains(t, got, w.Error())
+				}
+			}
+		})
+	}
+}
+
+func TestValidateRouteDestination(t *testing.T) {
+	tests := []struct {
+		name  string
+		input RouteDestination
+		want  error
+	}{
+		{
+			name:  "happy",
+			input: happyRouteDestination,
+			want:  nil,
+		},
+		{
+			name: "valid hostname",
+			input: RouteDestination{
+				Name: "valid hostname",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "example.com",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "valid ip",
+			input: RouteDestination{
+				Name: "valid ip",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "1.2.3.4",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: nil,
+		},
+		{
+			name: "invalid address",
+			input: RouteDestination{
+				Name: "invalid address",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "example.com::foo.bar",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointHostInvalid,
+		},
+		{
+			name: "missing ip",
+			input: RouteDestination{
+				Name: "missing ip",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointHostInvalid,
+		},
+		{
+			name: "missing port",
+			input: RouteDestination{
+				Name: "missing port",
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestEndpointPortInvalid,
+		},
+		{
+			name: "missing name",
+			input: RouteDestination{
+				Settings: []*DestinationSetting{
+					{
+						Endpoints: []*DestinationEndpoint{
+							{
+								Host: "10.11.12.13",
+								Port: 8080,
+							},
+						},
+					},
+				},
+			},
+			want: ErrDestinationNameEmpty,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestValidateStringMatch(t *testing.T) {
+	tests := []struct {
+		name  string
+		input StringMatch
+		want  error
+	}{
+		{
+			name: "happy",
+			input: StringMatch{
+				Exact: ptr.To("example"),
+			},
+			want: nil,
+		},
+		{
+			name:  "no fields set",
+			input: StringMatch{},
+			want:  ErrStringMatchConditionInvalid,
+		},
+		{
+			name: "multiple fields set",
+			input: StringMatch{
+				Exact:  ptr.To("example"),
+				Name:   "example",
+				Prefix: ptr.To("example"),
+			},
+			want: ErrStringMatchConditionInvalid,
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestValidateLoadBalancer(t *testing.T) {
+	tests := []struct {
+		name  string
+		input LoadBalancer
+		want  error
+	}{
+		{
+			name: "random",
+			input: LoadBalancer{
+				Random: &Random{},
+			},
+			want: nil,
+		},
+		{
+			name: "consistent hash",
+			input: LoadBalancer{
+				ConsistentHash: &ConsistentHash{
+					SourceIP: ptr.To(true),
+				},
+			},
+			want: nil,
+		},
+
+		{
+			name: "least request and random set",
+			input: LoadBalancer{
+				Random:       &Random{},
+				LeastRequest: &LeastRequest{},
+			},
+			want: ErrLoadBalancerInvalid,
+		},
+	}
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
+
+func TestPrintable(t *testing.T) {
+	tests := []struct {
+		name  string
+		input Xds
+		want  *Xds
+	}{
+		{
+			name:  "empty",
+			input: Xds{},
+			want:  &Xds{},
+		},
+		{
+			name: "http",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+			want: &Xds{
+				HTTP: []*HTTPListener{&happyHTTPListener},
+			},
+		},
+		{
+			name: "https",
+			input: Xds{
+				HTTP: []*HTTPListener{&happyHTTPSListener},
+			},
+			want: &Xds{
+				HTTP: []*HTTPListener{&redactedHappyHTTPSListener},
+			},
+		},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.name, func(t *testing.T) {
+			assert.Equal(t, *test.want, *test.input.Printable())
+		})
+	}
+}
+
+func TestValidateHealthCheck(t *testing.T) {
+	tests := []struct {
+		name  string
+		input HealthCheck
+		want  error
+	}{
+		{
+			name: "invalid timeout",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Duration(0)},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckTimeoutInvalid,
+		},
+		{
+			name: "invalid interval",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Duration(0)},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodGet),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckIntervalInvalid,
+		},
+		{
+			name: "invalid unhealthy threshold",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](0),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPatch),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckUnhealthyThresholdInvalid,
+		},
+		{
+			name: "invalid healthy threshold",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](0),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPost),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckHealthyThresholdInvalid,
+		},
+		{
+			name: "http-health-check: invalid host",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodPut),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPHostInvalid,
+		},
+		{
+			name: "http-health-check: invalid path",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To[uint32](3),
+				HealthyThreshold:   ptr.To[uint32](3),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "",
+					Method:           ptr.To(http.MethodPut),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPPathInvalid,
+		},
+		{
+			name: "http-health-check: invalid method",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodConnect),
+					ExpectedStatuses: []HTTPStatus{200, 400},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPMethodInvalid,
+		},
+		{
+			name: "http-health-check: invalid expected-statuses",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodDelete),
+					ExpectedStatuses: []HTTPStatus{},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHCHTTPExpectedStatusesInvalid,
+		},
+		{
+			name: "http-health-check: invalid range",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodHead),
+					ExpectedStatuses: []HTTPStatus{100, 600},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHTTPStatusInvalid,
+		},
+		{
+			name: "http-health-check: invalid expected-responses",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				HTTP: &HTTPHealthChecker{
+					Host:             "*",
+					Path:             "/healthz",
+					Method:           ptr.To(http.MethodOptions),
+					ExpectedStatuses: []HTTPStatus{200, 300},
+					ExpectedResponse: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "tcp-health-check: invalid send payload",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				TCP: &TCPHealthChecker{
+					Send: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+					Receive: &HealthCheckPayload{
+						Text: ptr.To("foo"),
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "tcp-health-check: invalid receive payload",
+			input: HealthCheck{&ActiveHealthCheck{
+				Timeout:            &metav1.Duration{Duration: time.Second},
+				Interval:           &metav1.Duration{Duration: time.Second},
+				UnhealthyThreshold: ptr.To(uint32(3)),
+				HealthyThreshold:   ptr.To(uint32(3)),
+				TCP: &TCPHealthChecker{
+					Send: &HealthCheckPayload{
+						Text: ptr.To("foo"),
+					},
+					Receive: &HealthCheckPayload{
+						Text:   ptr.To("foo"),
+						Binary: []byte{'f', 'o', 'o'},
+					},
+				},
+			},
+				&OutlierDetection{},
+			},
+			want: ErrHealthCheckPayloadInvalid,
+		},
+		{
+			name: "OutlierDetection invalid interval",
+			input: HealthCheck{&ActiveHealthCheck{},
+				&OutlierDetection{
+					Interval:         &metav1.Duration{Duration: time.Duration(0)},
+					BaseEjectionTime: &metav1.Duration{Duration: time.Second},
+				},
+			},
+			want: ErrOutlierDetectionIntervalInvalid,
+		},
+		{
+			name: "OutlierDetection invalid BaseEjectionTime",
+			input: HealthCheck{&ActiveHealthCheck{},
+				&OutlierDetection{
+					Interval:         &metav1.Duration{Duration: time.Second},
+					BaseEjectionTime: &metav1.Duration{Duration: time.Duration(0)},
+				},
+			},
+			want: ErrOutlierDetectionBaseEjectionTimeInvalid,
+		},
+	}
+	for i := range tests {
+		test := tests[i]
+		t.Run(test.name, func(t *testing.T) {
+			if test.want == nil {
+				require.NoError(t, test.input.Validate())
+			} else {
+				require.EqualError(t, test.input.Validate(), test.want.Error())
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
new file mode 100644
index 000000000..05c2e8eee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
@@ -0,0 +1,2221 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package ir
+
+import (
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AccessLog) DeepCopyInto(out *AccessLog) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = make([]*TextAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(TextAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make([]*JSONAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(JSONAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = make([]*OpenTelemetryAccessLog, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(OpenTelemetryAccessLog)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AccessLog.
+func (in *AccessLog) DeepCopy() *AccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(AccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ActiveHealthCheck) DeepCopyInto(out *ActiveHealthCheck) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.UnhealthyThreshold != nil {
+		in, out := &in.UnhealthyThreshold, &out.UnhealthyThreshold
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.HealthyThreshold != nil {
+		in, out := &in.HealthyThreshold, &out.HealthyThreshold
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPHealthChecker)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPHealthChecker)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ActiveHealthCheck.
+func (in *ActiveHealthCheck) DeepCopy() *ActiveHealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(ActiveHealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AddHeader) DeepCopyInto(out *AddHeader) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AddHeader.
+func (in *AddHeader) DeepCopy() *AddHeader {
+	if in == nil {
+		return nil
+	}
+	out := new(AddHeader)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackOffPolicy) DeepCopyInto(out *BackOffPolicy) {
+	*out = *in
+	if in.BaseInterval != nil {
+		in, out := &in.BaseInterval, &out.BaseInterval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxInterval != nil {
+		in, out := &in.MaxInterval, &out.MaxInterval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackOffPolicy.
+func (in *BackOffPolicy) DeepCopy() *BackOffPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(BackOffPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendWeights) DeepCopyInto(out *BackendWeights) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendWeights.
+func (in *BackendWeights) DeepCopy() *BackendWeights {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendWeights)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BasicAuth) DeepCopyInto(out *BasicAuth) {
+	*out = *in
+	if in.Users != nil {
+		in, out := &in.Users, &out.Users
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BasicAuth.
+func (in *BasicAuth) DeepCopy() *BasicAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(BasicAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CORS) DeepCopyInto(out *CORS) {
+	*out = *in
+	if in.AllowOrigins != nil {
+		in, out := &in.AllowOrigins, &out.AllowOrigins
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.AllowMethods != nil {
+		in, out := &in.AllowMethods, &out.AllowMethods
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AllowHeaders != nil {
+		in, out := &in.AllowHeaders, &out.AllowHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExposeHeaders != nil {
+		in, out := &in.ExposeHeaders, &out.ExposeHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.MaxAge != nil {
+		in, out := &in.MaxAge, &out.MaxAge
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CORS.
+func (in *CORS) DeepCopy() *CORS {
+	if in == nil {
+		return nil
+	}
+	out := new(CORS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CircuitBreaker) DeepCopyInto(out *CircuitBreaker) {
+	*out = *in
+	if in.MaxConnections != nil {
+		in, out := &in.MaxConnections, &out.MaxConnections
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxPendingRequests != nil {
+		in, out := &in.MaxPendingRequests, &out.MaxPendingRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxParallelRequests != nil {
+		in, out := &in.MaxParallelRequests, &out.MaxParallelRequests
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxRequestsPerConnection != nil {
+		in, out := &in.MaxRequestsPerConnection, &out.MaxRequestsPerConnection
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.MaxParallelRetries != nil {
+		in, out := &in.MaxParallelRetries, &out.MaxParallelRetries
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CircuitBreaker.
+func (in *CircuitBreaker) DeepCopy() *CircuitBreaker {
+	if in == nil {
+		return nil
+	}
+	out := new(CircuitBreaker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) {
+	*out = *in
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout.
+func (in *ClientTimeout) DeepCopy() *ClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ConsistentHash) DeepCopyInto(out *ConsistentHash) {
+	*out = *in
+	if in.SourceIP != nil {
+		in, out := &in.SourceIP, &out.SourceIP
+		*out = new(bool)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ConsistentHash.
+func (in *ConsistentHash) DeepCopy() *ConsistentHash {
+	if in == nil {
+		return nil
+	}
+	out := new(ConsistentHash)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DestinationEndpoint) DeepCopyInto(out *DestinationEndpoint) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DestinationEndpoint.
+func (in *DestinationEndpoint) DeepCopy() *DestinationEndpoint {
+	if in == nil {
+		return nil
+	}
+	out := new(DestinationEndpoint)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DestinationSetting) DeepCopyInto(out *DestinationSetting) {
+	*out = *in
+	if in.Weight != nil {
+		in, out := &in.Weight, &out.Weight
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Endpoints != nil {
+		in, out := &in.Endpoints, &out.Endpoints
+		*out = make([]*DestinationEndpoint, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(DestinationEndpoint)
+				**out = **in
+			}
+		}
+	}
+	if in.AddressType != nil {
+		in, out := &in.AddressType, &out.AddressType
+		*out = new(DestinationAddressType)
+		**out = **in
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSUpstreamConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DestinationSetting.
+func (in *DestinationSetting) DeepCopy() *DestinationSetting {
+	if in == nil {
+		return nil
+	}
+	out := new(DestinationSetting)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *DirectResponse) DeepCopyInto(out *DirectResponse) {
+	*out = *in
+	if in.Body != nil {
+		in, out := &in.Body, &out.Body
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new DirectResponse.
+func (in *DirectResponse) DeepCopy() *DirectResponse {
+	if in == nil {
+		return nil
+	}
+	out := new(DirectResponse)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ExtAuth) DeepCopyInto(out *ExtAuth) {
+	*out = *in
+	if in.GRPC != nil {
+		in, out := &in.GRPC, &out.GRPC
+		*out = new(GRPCExtAuthService)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPExtAuthService)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HeadersToExtAuth != nil {
+		in, out := &in.HeadersToExtAuth, &out.HeadersToExtAuth
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtAuth.
+func (in *ExtAuth) DeepCopy() *ExtAuth {
+	if in == nil {
+		return nil
+	}
+	out := new(ExtAuth)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjection) DeepCopyInto(out *FaultInjection) {
+	*out = *in
+	if in.Delay != nil {
+		in, out := &in.Delay, &out.Delay
+		*out = new(FaultInjectionDelay)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Abort != nil {
+		in, out := &in.Abort, &out.Abort
+		*out = new(FaultInjectionAbort)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjection.
+func (in *FaultInjection) DeepCopy() *FaultInjection {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjectionAbort) DeepCopyInto(out *FaultInjectionAbort) {
+	*out = *in
+	if in.HTTPStatus != nil {
+		in, out := &in.HTTPStatus, &out.HTTPStatus
+		*out = new(int32)
+		**out = **in
+	}
+	if in.GrpcStatus != nil {
+		in, out := &in.GrpcStatus, &out.GrpcStatus
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Percentage != nil {
+		in, out := &in.Percentage, &out.Percentage
+		*out = new(float32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjectionAbort.
+func (in *FaultInjectionAbort) DeepCopy() *FaultInjectionAbort {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjectionAbort)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FaultInjectionDelay) DeepCopyInto(out *FaultInjectionDelay) {
+	*out = *in
+	if in.FixedDelay != nil {
+		in, out := &in.FixedDelay, &out.FixedDelay
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.Percentage != nil {
+		in, out := &in.Percentage, &out.Percentage
+		*out = new(float32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FaultInjectionDelay.
+func (in *FaultInjectionDelay) DeepCopy() *FaultInjectionDelay {
+	if in == nil {
+		return nil
+	}
+	out := new(FaultInjectionDelay)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GRPCExtAuthService) DeepCopyInto(out *GRPCExtAuthService) {
+	*out = *in
+	in.Destination.DeepCopyInto(&out.Destination)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GRPCExtAuthService.
+func (in *GRPCExtAuthService) DeepCopy() *GRPCExtAuthService {
+	if in == nil {
+		return nil
+	}
+	out := new(GRPCExtAuthService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *GlobalRateLimit) DeepCopyInto(out *GlobalRateLimit) {
+	*out = *in
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]*RateLimitRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RateLimitRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new GlobalRateLimit.
+func (in *GlobalRateLimit) DeepCopy() *GlobalRateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(GlobalRateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTP10Settings) DeepCopyInto(out *HTTP10Settings) {
+	*out = *in
+	if in.DefaultHost != nil {
+		in, out := &in.DefaultHost, &out.DefaultHost
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTP10Settings.
+func (in *HTTP10Settings) DeepCopy() *HTTP10Settings {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTP10Settings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTP1Settings) DeepCopyInto(out *HTTP1Settings) {
+	*out = *in
+	if in.HTTP10 != nil {
+		in, out := &in.HTTP10, &out.HTTP10
+		*out = new(HTTP10Settings)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTP1Settings.
+func (in *HTTP1Settings) DeepCopy() *HTTP1Settings {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTP1Settings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
+	*out = *in
+	if in.RequestReceivedTimeout != nil {
+		in, out := &in.RequestReceivedTimeout, &out.RequestReceivedTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout.
+func (in *HTTPClientTimeout) DeepCopy() *HTTPClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPExtAuthService) DeepCopyInto(out *HTTPExtAuthService) {
+	*out = *in
+	in.Destination.DeepCopyInto(&out.Destination)
+	if in.HeadersToBackend != nil {
+		in, out := &in.HeadersToBackend, &out.HeadersToBackend
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPExtAuthService.
+func (in *HTTPExtAuthService) DeepCopy() *HTTPExtAuthService {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPExtAuthService)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPHealthChecker) DeepCopyInto(out *HTTPHealthChecker) {
+	*out = *in
+	if in.Method != nil {
+		in, out := &in.Method, &out.Method
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExpectedStatuses != nil {
+		in, out := &in.ExpectedStatuses, &out.ExpectedStatuses
+		*out = make([]HTTPStatus, len(*in))
+		copy(*out, *in)
+	}
+	if in.ExpectedResponse != nil {
+		in, out := &in.ExpectedResponse, &out.ExpectedResponse
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPHealthChecker.
+func (in *HTTPHealthChecker) DeepCopy() *HTTPHealthChecker {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPHealthChecker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPListener) DeepCopyInto(out *HTTPListener) {
+	*out = *in
+	if in.Hostnames != nil {
+		in, out := &in.Hostnames, &out.Hostnames
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Routes != nil {
+		in, out := &in.Routes, &out.Routes
+		*out = make([]*HTTPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HTTPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Headers != nil {
+		in, out := &in.Headers, &out.Headers
+		*out = new(HeaderSettings)
+		**out = **in
+	}
+	if in.HTTP3 != nil {
+		in, out := &in.HTTP3, &out.HTTP3
+		*out = new(HTTP3Settings)
+		**out = **in
+	}
+	out.Path = in.Path
+	if in.HTTP1 != nil {
+		in, out := &in.HTTP1, &out.HTTP1
+		*out = new(HTTP1Settings)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(ClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPListener.
+func (in *HTTPListener) DeepCopy() *HTTPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPPathModifier) DeepCopyInto(out *HTTPPathModifier) {
+	*out = *in
+	if in.FullReplace != nil {
+		in, out := &in.FullReplace, &out.FullReplace
+		*out = new(string)
+		**out = **in
+	}
+	if in.PrefixMatchReplace != nil {
+		in, out := &in.PrefixMatchReplace, &out.PrefixMatchReplace
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPPathModifier.
+func (in *HTTPPathModifier) DeepCopy() *HTTPPathModifier {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPPathModifier)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPRoute) DeepCopyInto(out *HTTPRoute) {
+	*out = *in
+	if in.PathMatch != nil {
+		in, out := &in.PathMatch, &out.PathMatch
+		*out = new(StringMatch)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HeaderMatches != nil {
+		in, out := &in.HeaderMatches, &out.HeaderMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.QueryParamMatches != nil {
+		in, out := &in.QueryParamMatches, &out.QueryParamMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	out.BackendWeights = in.BackendWeights
+	if in.AddRequestHeaders != nil {
+		in, out := &in.AddRequestHeaders, &out.AddRequestHeaders
+		*out = make([]AddHeader, len(*in))
+		copy(*out, *in)
+	}
+	if in.RemoveRequestHeaders != nil {
+		in, out := &in.RemoveRequestHeaders, &out.RemoveRequestHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.AddResponseHeaders != nil {
+		in, out := &in.AddResponseHeaders, &out.AddResponseHeaders
+		*out = make([]AddHeader, len(*in))
+		copy(*out, *in)
+	}
+	if in.RemoveResponseHeaders != nil {
+		in, out := &in.RemoveResponseHeaders, &out.RemoveResponseHeaders
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.DirectResponse != nil {
+		in, out := &in.DirectResponse, &out.DirectResponse
+		*out = new(DirectResponse)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Redirect != nil {
+		in, out := &in.Redirect, &out.Redirect
+		*out = new(Redirect)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Mirrors != nil {
+		in, out := &in.Mirrors, &out.Mirrors
+		*out = make([]*RouteDestination, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RouteDestination)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.URLRewrite != nil {
+		in, out := &in.URLRewrite, &out.URLRewrite
+		*out = new(URLRewrite)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RateLimit != nil {
+		in, out := &in.RateLimit, &out.RateLimit
+		*out = new(RateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.LoadBalancer != nil {
+		in, out := &in.LoadBalancer, &out.LoadBalancer
+		*out = new(LoadBalancer)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.CORS != nil {
+		in, out := &in.CORS, &out.CORS
+		*out = new(CORS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.OIDC != nil {
+		in, out := &in.OIDC, &out.OIDC
+		*out = new(OIDC)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ProxyProtocol != nil {
+		in, out := &in.ProxyProtocol, &out.ProxyProtocol
+		*out = new(ProxyProtocol)
+		**out = **in
+	}
+	if in.BasicAuth != nil {
+		in, out := &in.BasicAuth, &out.BasicAuth
+		*out = new(BasicAuth)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExtAuth != nil {
+		in, out := &in.ExtAuth, &out.ExtAuth
+		*out = new(ExtAuth)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HealthCheck != nil {
+		in, out := &in.HealthCheck, &out.HealthCheck
+		*out = new(HealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.FaultInjection != nil {
+		in, out := &in.FaultInjection, &out.FaultInjection
+		*out = new(FaultInjection)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.ExtensionRefs != nil {
+		in, out := &in.ExtensionRefs, &out.ExtensionRefs
+		*out = make([]*UnstructuredRef, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(UnstructuredRef)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.CircuitBreaker != nil {
+		in, out := &in.CircuitBreaker, &out.CircuitBreaker
+		*out = new(CircuitBreaker)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(Timeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Retry != nil {
+		in, out := &in.Retry, &out.Retry
+		*out = new(Retry)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPRoute.
+func (in *HTTPRoute) DeepCopy() *HTTPRoute {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPRoute)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPTimeout) DeepCopyInto(out *HTTPTimeout) {
+	*out = *in
+	if in.RequestTimeout != nil {
+		in, out := &in.RequestTimeout, &out.RequestTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.ConnectionIdleTimeout != nil {
+		in, out := &in.ConnectionIdleTimeout, &out.ConnectionIdleTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxConnectionDuration != nil {
+		in, out := &in.MaxConnectionDuration, &out.MaxConnectionDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPTimeout.
+func (in *HTTPTimeout) DeepCopy() *HTTPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HeaderSettings) DeepCopyInto(out *HeaderSettings) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HeaderSettings.
+func (in *HeaderSettings) DeepCopy() *HeaderSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(HeaderSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheck) DeepCopyInto(out *HealthCheck) {
+	*out = *in
+	if in.Active != nil {
+		in, out := &in.Active, &out.Active
+		*out = new(ActiveHealthCheck)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Passive != nil {
+		in, out := &in.Passive, &out.Passive
+		*out = new(OutlierDetection)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheck.
+func (in *HealthCheck) DeepCopy() *HealthCheck {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheck)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HealthCheckPayload) DeepCopyInto(out *HealthCheckPayload) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.Binary != nil {
+		in, out := &in.Binary, &out.Binary
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HealthCheckPayload.
+func (in *HealthCheckPayload) DeepCopy() *HealthCheckPayload {
+	if in == nil {
+		return nil
+	}
+	out := new(HealthCheckPayload)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Infra) DeepCopyInto(out *Infra) {
+	*out = *in
+	if in.Proxy != nil {
+		in, out := &in.Proxy, &out.Proxy
+		*out = new(ProxyInfra)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Infra.
+func (in *Infra) DeepCopy() *Infra {
+	if in == nil {
+		return nil
+	}
+	out := new(Infra)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *InfraMetadata) DeepCopyInto(out *InfraMetadata) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InfraMetadata.
+func (in *InfraMetadata) DeepCopy() *InfraMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(InfraMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONAccessLog) DeepCopyInto(out *JSONAccessLog) {
+	*out = *in
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONAccessLog.
+func (in *JSONAccessLog) DeepCopy() *JSONAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONPatchConfig) DeepCopyInto(out *JSONPatchConfig) {
+	*out = *in
+	in.Operation.DeepCopyInto(&out.Operation)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONPatchConfig.
+func (in *JSONPatchConfig) DeepCopy() *JSONPatchConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONPatchConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *JSONPatchOperation) DeepCopyInto(out *JSONPatchOperation) {
+	*out = *in
+	if in.From != nil {
+		in, out := &in.From, &out.From
+		*out = new(string)
+		**out = **in
+	}
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		*out = new(apiextensionsv1.JSON)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JSONPatchOperation.
+func (in *JSONPatchOperation) DeepCopy() *JSONPatchOperation {
+	if in == nil {
+		return nil
+	}
+	out := new(JSONPatchOperation)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LeastRequest) DeepCopyInto(out *LeastRequest) {
+	*out = *in
+	if in.SlowStart != nil {
+		in, out := &in.SlowStart, &out.SlowStart
+		*out = new(SlowStart)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LeastRequest.
+func (in *LeastRequest) DeepCopy() *LeastRequest {
+	if in == nil {
+		return nil
+	}
+	out := new(LeastRequest)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ListenerPort) DeepCopyInto(out *ListenerPort) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ListenerPort.
+func (in *ListenerPort) DeepCopy() *ListenerPort {
+	if in == nil {
+		return nil
+	}
+	out := new(ListenerPort)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LoadBalancer) DeepCopyInto(out *LoadBalancer) {
+	*out = *in
+	if in.RoundRobin != nil {
+		in, out := &in.RoundRobin, &out.RoundRobin
+		*out = new(RoundRobin)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.LeastRequest != nil {
+		in, out := &in.LeastRequest, &out.LeastRequest
+		*out = new(LeastRequest)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Random != nil {
+		in, out := &in.Random, &out.Random
+		*out = new(Random)
+		**out = **in
+	}
+	if in.ConsistentHash != nil {
+		in, out := &in.ConsistentHash, &out.ConsistentHash
+		*out = new(ConsistentHash)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LoadBalancer.
+func (in *LoadBalancer) DeepCopy() *LoadBalancer {
+	if in == nil {
+		return nil
+	}
+	out := new(LoadBalancer)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LocalRateLimit) DeepCopyInto(out *LocalRateLimit) {
+	*out = *in
+	out.Default = in.Default
+	if in.Rules != nil {
+		in, out := &in.Rules, &out.Rules
+		*out = make([]*RateLimitRule, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(RateLimitRule)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalRateLimit.
+func (in *LocalRateLimit) DeepCopy() *LocalRateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(LocalRateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Metrics) DeepCopyInto(out *Metrics) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Metrics.
+func (in *Metrics) DeepCopy() *Metrics {
+	if in == nil {
+		return nil
+	}
+	out := new(Metrics)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OIDC) DeepCopyInto(out *OIDC) {
+	*out = *in
+	out.Provider = in.Provider
+	if in.ClientSecret != nil {
+		in, out := &in.ClientSecret, &out.ClientSecret
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.HMACSecret != nil {
+		in, out := &in.HMACSecret, &out.HMACSecret
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.Scopes != nil {
+		in, out := &in.Scopes, &out.Scopes
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OIDC.
+func (in *OIDC) DeepCopy() *OIDC {
+	if in == nil {
+		return nil
+	}
+	out := new(OIDC)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OpenTelemetryAccessLog) DeepCopyInto(out *OpenTelemetryAccessLog) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.Attributes != nil {
+		in, out := &in.Attributes, &out.Attributes
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenTelemetryAccessLog.
+func (in *OpenTelemetryAccessLog) DeepCopy() *OpenTelemetryAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(OpenTelemetryAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OutlierDetection) DeepCopyInto(out *OutlierDetection) {
+	*out = *in
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.SplitExternalLocalOriginErrors != nil {
+		in, out := &in.SplitExternalLocalOriginErrors, &out.SplitExternalLocalOriginErrors
+		*out = new(bool)
+		**out = **in
+	}
+	if in.ConsecutiveLocalOriginFailures != nil {
+		in, out := &in.ConsecutiveLocalOriginFailures, &out.ConsecutiveLocalOriginFailures
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.ConsecutiveGatewayErrors != nil {
+		in, out := &in.ConsecutiveGatewayErrors, &out.ConsecutiveGatewayErrors
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Consecutive5xxErrors != nil {
+		in, out := &in.Consecutive5xxErrors, &out.Consecutive5xxErrors
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.BaseEjectionTime != nil {
+		in, out := &in.BaseEjectionTime, &out.BaseEjectionTime
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MaxEjectionPercent != nil {
+		in, out := &in.MaxEjectionPercent, &out.MaxEjectionPercent
+		*out = new(int32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OutlierDetection.
+func (in *OutlierDetection) DeepCopy() *OutlierDetection {
+	if in == nil {
+		return nil
+	}
+	out := new(OutlierDetection)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PathSettings) DeepCopyInto(out *PathSettings) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PathSettings.
+func (in *PathSettings) DeepCopy() *PathSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(PathSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PerRetryPolicy) DeepCopyInto(out *PerRetryPolicy) {
+	*out = *in
+	if in.Timeout != nil {
+		in, out := &in.Timeout, &out.Timeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.BackOff != nil {
+		in, out := &in.BackOff, &out.BackOff
+		*out = new(BackOffPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PerRetryPolicy.
+func (in *PerRetryPolicy) DeepCopy() *PerRetryPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(PerRetryPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyInfra) DeepCopyInto(out *ProxyInfra) {
+	*out = *in
+	if in.Metadata != nil {
+		in, out := &in.Metadata, &out.Metadata
+		*out = new(InfraMetadata)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Config != nil {
+		in, out := &in.Config, &out.Config
+		*out = new(v1alpha1.EnvoyProxy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Listeners != nil {
+		in, out := &in.Listeners, &out.Listeners
+		*out = make([]*ProxyListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(ProxyListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Addresses != nil {
+		in, out := &in.Addresses, &out.Addresses
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyInfra.
+func (in *ProxyInfra) DeepCopy() *ProxyInfra {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyInfra)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyListener) DeepCopyInto(out *ProxyListener) {
+	*out = *in
+	if in.Address != nil {
+		in, out := &in.Address, &out.Address
+		*out = new(string)
+		**out = **in
+	}
+	if in.Ports != nil {
+		in, out := &in.Ports, &out.Ports
+		*out = make([]ListenerPort, len(*in))
+		copy(*out, *in)
+	}
+	if in.HTTP3 != nil {
+		in, out := &in.HTTP3, &out.HTTP3
+		*out = new(HTTP3Settings)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyListener.
+func (in *ProxyListener) DeepCopy() *ProxyListener {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyProtocol) DeepCopyInto(out *ProxyProtocol) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyProtocol.
+func (in *ProxyProtocol) DeepCopy() *ProxyProtocol {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyProtocol)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Random) DeepCopyInto(out *Random) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Random.
+func (in *Random) DeepCopy() *Random {
+	if in == nil {
+		return nil
+	}
+	out := new(Random)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimit) DeepCopyInto(out *RateLimit) {
+	*out = *in
+	if in.Global != nil {
+		in, out := &in.Global, &out.Global
+		*out = new(GlobalRateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Local != nil {
+		in, out := &in.Local, &out.Local
+		*out = new(LocalRateLimit)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimit.
+func (in *RateLimit) DeepCopy() *RateLimit {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimit)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitRule) DeepCopyInto(out *RateLimitRule) {
+	*out = *in
+	if in.HeaderMatches != nil {
+		in, out := &in.HeaderMatches, &out.HeaderMatches
+		*out = make([]*StringMatch, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(StringMatch)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.CIDRMatch != nil {
+		in, out := &in.CIDRMatch, &out.CIDRMatch
+		*out = new(CIDRMatch)
+		**out = **in
+	}
+	out.Limit = in.Limit
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitRule.
+func (in *RateLimitRule) DeepCopy() *RateLimitRule {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RateLimitValue) DeepCopyInto(out *RateLimitValue) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RateLimitValue.
+func (in *RateLimitValue) DeepCopy() *RateLimitValue {
+	if in == nil {
+		return nil
+	}
+	out := new(RateLimitValue)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Redirect) DeepCopyInto(out *Redirect) {
+	*out = *in
+	if in.Scheme != nil {
+		in, out := &in.Scheme, &out.Scheme
+		*out = new(string)
+		**out = **in
+	}
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = new(HTTPPathModifier)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Port != nil {
+		in, out := &in.Port, &out.Port
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.StatusCode != nil {
+		in, out := &in.StatusCode, &out.StatusCode
+		*out = new(int32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Redirect.
+func (in *Redirect) DeepCopy() *Redirect {
+	if in == nil {
+		return nil
+	}
+	out := new(Redirect)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Retry) DeepCopyInto(out *Retry) {
+	*out = *in
+	if in.NumRetries != nil {
+		in, out := &in.NumRetries, &out.NumRetries
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.RetryOn != nil {
+		in, out := &in.RetryOn, &out.RetryOn
+		*out = new(RetryOn)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.PerRetry != nil {
+		in, out := &in.PerRetry, &out.PerRetry
+		*out = new(PerRetryPolicy)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Retry.
+func (in *Retry) DeepCopy() *Retry {
+	if in == nil {
+		return nil
+	}
+	out := new(Retry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RetryOn) DeepCopyInto(out *RetryOn) {
+	*out = *in
+	if in.Triggers != nil {
+		in, out := &in.Triggers, &out.Triggers
+		*out = make([]TriggerEnum, len(*in))
+		copy(*out, *in)
+	}
+	if in.HTTPStatusCodes != nil {
+		in, out := &in.HTTPStatusCodes, &out.HTTPStatusCodes
+		*out = make([]HTTPStatus, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RetryOn.
+func (in *RetryOn) DeepCopy() *RetryOn {
+	if in == nil {
+		return nil
+	}
+	out := new(RetryOn)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RoundRobin) DeepCopyInto(out *RoundRobin) {
+	*out = *in
+	if in.SlowStart != nil {
+		in, out := &in.SlowStart, &out.SlowStart
+		*out = new(SlowStart)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RoundRobin.
+func (in *RoundRobin) DeepCopy() *RoundRobin {
+	if in == nil {
+		return nil
+	}
+	out := new(RoundRobin)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RouteDestination) DeepCopyInto(out *RouteDestination) {
+	*out = *in
+	if in.Settings != nil {
+		in, out := &in.Settings, &out.Settings
+		*out = make([]*DestinationSetting, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(DestinationSetting)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RouteDestination.
+func (in *RouteDestination) DeepCopy() *RouteDestination {
+	if in == nil {
+		return nil
+	}
+	out := new(RouteDestination)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *SlowStart) DeepCopyInto(out *SlowStart) {
+	*out = *in
+	if in.Window != nil {
+		in, out := &in.Window, &out.Window
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SlowStart.
+func (in *SlowStart) DeepCopy() *SlowStart {
+	if in == nil {
+		return nil
+	}
+	out := new(SlowStart)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringMatch) DeepCopyInto(out *StringMatch) {
+	*out = *in
+	if in.Exact != nil {
+		in, out := &in.Exact, &out.Exact
+		*out = new(string)
+		**out = **in
+	}
+	if in.Prefix != nil {
+		in, out := &in.Prefix, &out.Prefix
+		*out = new(string)
+		**out = **in
+	}
+	if in.Suffix != nil {
+		in, out := &in.Suffix, &out.Suffix
+		*out = new(string)
+		**out = **in
+	}
+	if in.SafeRegex != nil {
+		in, out := &in.SafeRegex, &out.SafeRegex
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringMatch.
+func (in *StringMatch) DeepCopy() *StringMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(StringMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPHealthChecker) DeepCopyInto(out *TCPHealthChecker) {
+	*out = *in
+	if in.Send != nil {
+		in, out := &in.Send, &out.Send
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Receive != nil {
+		in, out := &in.Receive, &out.Receive
+		*out = new(HealthCheckPayload)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPHealthChecker.
+func (in *TCPHealthChecker) DeepCopy() *TCPHealthChecker {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPHealthChecker)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPKeepalive) DeepCopyInto(out *TCPKeepalive) {
+	*out = *in
+	if in.Probes != nil {
+		in, out := &in.Probes, &out.Probes
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.IdleTime != nil {
+		in, out := &in.IdleTime, &out.IdleTime
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(uint32)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPKeepalive.
+func (in *TCPKeepalive) DeepCopy() *TCPKeepalive {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPKeepalive)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPListener) DeepCopyInto(out *TCPListener) {
+	*out = *in
+	if in.TLS != nil {
+		in, out := &in.TLS, &out.TLS
+		*out = new(TLS)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.TCPKeepalive != nil {
+		in, out := &in.TCPKeepalive, &out.TCPKeepalive
+		*out = new(TCPKeepalive)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPListener.
+func (in *TCPListener) DeepCopy() *TCPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPTimeout) DeepCopyInto(out *TCPTimeout) {
+	*out = *in
+	if in.ConnectTimeout != nil {
+		in, out := &in.ConnectTimeout, &out.ConnectTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPTimeout.
+func (in *TCPTimeout) DeepCopy() *TCPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLS) DeepCopyInto(out *TLS) {
+	*out = *in
+	if in.Passthrough != nil {
+		in, out := &in.Passthrough, &out.Passthrough
+		*out = new(TLSInspectorConfig)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Terminate != nil {
+		in, out := &in.Terminate, &out.Terminate
+		*out = new(TLSConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS.
+func (in *TLS) DeepCopy() *TLS {
+	if in == nil {
+		return nil
+	}
+	out := new(TLS)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSCACertificate) DeepCopyInto(out *TLSCACertificate) {
+	*out = *in
+	if in.Certificate != nil {
+		in, out := &in.Certificate, &out.Certificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSCACertificate.
+func (in *TLSCACertificate) DeepCopy() *TLSCACertificate {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSCACertificate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSCertificate) DeepCopyInto(out *TLSCertificate) {
+	*out = *in
+	if in.ServerCertificate != nil {
+		in, out := &in.ServerCertificate, &out.ServerCertificate
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+	if in.PrivateKey != nil {
+		in, out := &in.PrivateKey, &out.PrivateKey
+		*out = make([]byte, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSCertificate.
+func (in *TLSCertificate) DeepCopy() *TLSCertificate {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSCertificate)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSConfig) DeepCopyInto(out *TLSConfig) {
+	*out = *in
+	if in.Certificates != nil {
+		in, out := &in.Certificates, &out.Certificates
+		*out = make([]TLSCertificate, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.CACertificate != nil {
+		in, out := &in.CACertificate, &out.CACertificate
+		*out = new(TLSCACertificate)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.MinVersion != nil {
+		in, out := &in.MinVersion, &out.MinVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.MaxVersion != nil {
+		in, out := &in.MaxVersion, &out.MaxVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.Ciphers != nil {
+		in, out := &in.Ciphers, &out.Ciphers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ECDHCurves != nil {
+		in, out := &in.ECDHCurves, &out.ECDHCurves
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SignatureAlgorithms != nil {
+		in, out := &in.SignatureAlgorithms, &out.SignatureAlgorithms
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ALPNProtocols != nil {
+		in, out := &in.ALPNProtocols, &out.ALPNProtocols
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSConfig.
+func (in *TLSConfig) DeepCopy() *TLSConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSInspectorConfig) DeepCopyInto(out *TLSInspectorConfig) {
+	*out = *in
+	if in.SNIs != nil {
+		in, out := &in.SNIs, &out.SNIs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSInspectorConfig.
+func (in *TLSInspectorConfig) DeepCopy() *TLSInspectorConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSInspectorConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSUpstreamConfig) DeepCopyInto(out *TLSUpstreamConfig) {
+	*out = *in
+	if in.CACertificate != nil {
+		in, out := &in.CACertificate, &out.CACertificate
+		*out = new(TLSCACertificate)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSUpstreamConfig.
+func (in *TLSUpstreamConfig) DeepCopy() *TLSUpstreamConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSUpstreamConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TextAccessLog) DeepCopyInto(out *TextAccessLog) {
+	*out = *in
+	if in.Format != nil {
+		in, out := &in.Format, &out.Format
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TextAccessLog.
+func (in *TextAccessLog) DeepCopy() *TextAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(TextAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timeout) DeepCopyInto(out *Timeout) {
+	*out = *in
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timeout.
+func (in *Timeout) DeepCopy() *Timeout {
+	if in == nil {
+		return nil
+	}
+	out := new(Timeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Tracing) DeepCopyInto(out *Tracing) {
+	*out = *in
+	in.ProxyTracing.DeepCopyInto(&out.ProxyTracing)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Tracing.
+func (in *Tracing) DeepCopy() *Tracing {
+	if in == nil {
+		return nil
+	}
+	out := new(Tracing)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UDPListener) DeepCopyInto(out *UDPListener) {
+	*out = *in
+	if in.Destination != nil {
+		in, out := &in.Destination, &out.Destination
+		*out = new(RouteDestination)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UDPListener.
+func (in *UDPListener) DeepCopy() *UDPListener {
+	if in == nil {
+		return nil
+	}
+	out := new(UDPListener)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *URLRewrite) DeepCopyInto(out *URLRewrite) {
+	*out = *in
+	if in.Path != nil {
+		in, out := &in.Path, &out.Path
+		*out = new(HTTPPathModifier)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Hostname != nil {
+		in, out := &in.Hostname, &out.Hostname
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new URLRewrite.
+func (in *URLRewrite) DeepCopy() *URLRewrite {
+	if in == nil {
+		return nil
+	}
+	out := new(URLRewrite)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *UnstructuredRef) DeepCopyInto(out *UnstructuredRef) {
+	*out = *in
+	if in.Object != nil {
+		in, out := &in.Object, &out.Object
+		*out = (*in).DeepCopy()
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UnstructuredRef.
+func (in *UnstructuredRef) DeepCopy() *UnstructuredRef {
+	if in == nil {
+		return nil
+	}
+	out := new(UnstructuredRef)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Xds) DeepCopyInto(out *Xds) {
+	*out = *in
+	if in.AccessLog != nil {
+		in, out := &in.AccessLog, &out.AccessLog
+		*out = new(AccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tracing != nil {
+		in, out := &in.Tracing, &out.Tracing
+		*out = new(Tracing)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = new(Metrics)
+		**out = **in
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = make([]*HTTPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(HTTPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = make([]*TCPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(TCPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.UDP != nil {
+		in, out := &in.UDP, &out.UDP
+		*out = make([]*UDPListener, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(UDPListener)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Xds.
+func (in *Xds) DeepCopy() *Xds {
+	if in == nil {
+		return nil
+	}
+	out := new(Xds)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/gateway-api/listener.go b/adapter/internal/operator/gateway-api/listener.go
new file mode 100644
index 000000000..81ef56d40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/listener.go
@@ -0,0 +1,191 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+var _ ListenersTranslator = (*Translator)(nil)
+
+type ListenersTranslator interface {
+	ProcessListeners(gateways []*GatewayContext, xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources)
+}
+
+func (t *Translator) ProcessListeners(gateways []*GatewayContext, xdsIR XdsIRMap, infraIR InfraIRMap, resources *Resources) {
+	// Infra IR proxy ports must be unique.
+	foundPorts := make(map[string][]*protocolPort)
+	t.validateConflictedLayer7Listeners(gateways)
+	t.validateConflictedLayer4Listeners(gateways, gwapiv1.TCPProtocolType, gwapiv1.TLSProtocolType)
+	t.validateConflictedLayer4Listeners(gateways, gwapiv1.UDPProtocolType)
+	if t.MergeGateways {
+		t.validateConflictedMergedListeners(gateways)
+	}
+
+	// Iterate through all listeners to validate spec
+	// and compute status for each, and add valid ones
+	// to the Xds IR.
+	for _, gateway := range gateways {
+		irKey := t.getIRKey(gateway.Gateway)
+
+		xdsIR[irKey].AccessLog = processAccessLog()
+		xdsIR[irKey].Tracing = processTracing()
+		xdsIR[irKey].Metrics = processMetrics()
+
+		for _, listener := range gateway.listeners {
+			// Process protocol & supported kinds
+			switch listener.Protocol {
+			case gwapiv1.TLSProtocolType:
+				if listener.TLS != nil {
+					switch *listener.TLS.Mode {
+					case gwapiv1.TLSModePassthrough:
+						t.validateAllowedRoutes(listener, KindTLSRoute)
+					case gwapiv1.TLSModeTerminate:
+						t.validateAllowedRoutes(listener, KindTCPRoute)
+					default:
+						t.validateAllowedRoutes(listener, KindTCPRoute, KindTLSRoute)
+					}
+				} else {
+					t.validateAllowedRoutes(listener, KindTCPRoute, KindTLSRoute)
+				}
+			case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType:
+				t.validateAllowedRoutes(listener, KindHTTPRoute, KindGRPCRoute)
+			case gwapiv1.TCPProtocolType:
+				t.validateAllowedRoutes(listener, KindTCPRoute)
+			case gwapiv1.UDPProtocolType:
+				t.validateAllowedRoutes(listener, KindUDPRoute)
+			default:
+				listener.SetCondition(
+					gwapiv1.ListenerConditionAccepted,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonUnsupportedProtocol,
+					fmt.Sprintf("Protocol %s is unsupported, must be %s, %s, %s or %s.", listener.Protocol,
+						gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType, gwapiv1.TCPProtocolType, gwapiv1.UDPProtocolType),
+				)
+			}
+
+			// Validate allowed namespaces
+			t.validateAllowedNamespaces(listener)
+
+			// Process TLS configuration
+			t.validateTLSConfiguration(listener, resources)
+
+			// Process Hostname configuration
+			t.validateHostName(listener)
+
+			// Process conditions and check if the listener is ready
+			isReady := t.validateListenerConditions(listener)
+			if !isReady {
+				continue
+			}
+			// Add the listener to the Xds IR
+			servicePort := &protocolPort{protocol: listener.Protocol, port: int32(listener.Port)}
+			containerPort := servicePortToContainerPort(servicePort.port)
+			switch listener.Protocol {
+			case gwapiv1.HTTPProtocolType, gwapiv1.HTTPSProtocolType:
+				irListener := &ir.HTTPListener{
+					Name:    irHTTPListenerName(listener),
+					Address: "0.0.0.0",
+					Port:    uint32(containerPort),
+					TLS:     irTLSConfigs(listener.tlsSecrets),
+					Path: ir.PathSettings{
+						MergeSlashes: true,
+					},
+				}
+				if listener.Hostname != nil {
+					irListener.Hostnames = append(irListener.Hostnames, string(*listener.Hostname))
+				} else {
+					// Hostname specifies the virtual hostname to match for protocol types that define this concept.
+					// When unspecified, all hostnames are matched. This field is ignored for protocols that don’t require hostname based matching.
+					// see more https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/gwapiv1.Listener.
+					irListener.Hostnames = append(irListener.Hostnames, "*")
+				}
+				xdsIR[irKey].HTTP = append(xdsIR[irKey].HTTP, irListener)
+			}
+
+			// Add the listener to the Infra IR. Infra IR ports must have a unique port number per layer-4 protocol
+			// (TCP or UDP).
+			if !containsPort(foundPorts[irKey], servicePort) {
+				t.processInfraIRListener(listener, infraIR, irKey, servicePort)
+				foundPorts[irKey] = append(foundPorts[irKey], servicePort)
+			}
+		}
+	}
+}
+
+func (t *Translator) processInfraIRListener(listener *ListenerContext, infraIR InfraIRMap, irKey string, servicePort *protocolPort) {
+	var proto ir.ProtocolType
+	switch listener.Protocol {
+	case gwapiv1.HTTPProtocolType:
+		proto = ir.HTTPProtocolType
+	case gwapiv1.HTTPSProtocolType:
+		proto = ir.HTTPSProtocolType
+	case gwapiv1.TLSProtocolType:
+		proto = ir.TLSProtocolType
+	case gwapiv1.TCPProtocolType:
+		proto = ir.TCPProtocolType
+	case gwapiv1.UDPProtocolType:
+		proto = ir.UDPProtocolType
+	}
+
+	infraPortName := string(listener.Name)
+	if t.MergeGateways {
+		infraPortName = irHTTPListenerName(listener)
+	}
+	infraPort := ir.ListenerPort{
+		Name:          infraPortName,
+		Protocol:      proto,
+		ServicePort:   servicePort.port,
+		ContainerPort: servicePortToContainerPort(servicePort.port),
+	}
+
+	proxyListener := &ir.ProxyListener{
+		Name:  irHTTPListenerName(listener),
+		Ports: []ir.ListenerPort{infraPort},
+	}
+
+	infraIR[irKey].Proxy.Listeners = append(infraIR[irKey].Proxy.Listeners, proxyListener)
+}
+
+func processAccessLog() *ir.AccessLog {
+	// use the default access log
+	return &ir.AccessLog{
+		Text: []*ir.TextAccessLog{
+			{
+				Path: "/dev/stdout",
+			},
+		},
+	}
+}
+
+func processTracing() *ir.Tracing {
+	return nil
+}
+
+func processMetrics() *ir.Metrics {
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
new file mode 100644
index 000000000..de30222c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -0,0 +1,744 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+// todo(amali) verify gateway api latest imports
+// todo(amali) fix formatting in logs
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/config"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/pkg/logging"
+	"github.com/wso2/apk/adapter/pkg/utils/stringutils"
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/types"
+
+	"github.com/wso2/apk/adapter/internal/operator/constants"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	k8errors "k8s.io/apimachinery/pkg/api/errors"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+type gatewayReconcilerNew struct {
+	client        client.Client
+	statusUpdater *status.UpdateHandler
+	mgr           manager.Manager
+	resources     *message.ProviderResources
+	extGVKs       []schema.GroupVersionKind
+	namespace     string
+	store         *kubernetesProviderStore
+}
+
+type resourceMappings struct {
+	// Map for storing namespaces for Route, Service and Gateway objects.
+	allAssociatedNamespaces map[string]struct{}
+	// Map for storing backendRefs' NamespaceNames referred by various Route objects.
+	allAssociatedBackendRefs map[gwapiv1.BackendObjectReference]struct{}
+	// extensionRefFilters is a map of filters managed by an extension.
+	// The key is the namespaced name of the filter and the value is the
+	// unstructured form of the resource.
+	extensionRefFilters map[types.NamespacedName]unstructured.Unstructured
+}
+
+const (
+	gatewayClassControllerName = "wso2.com/apk-gateway-default"
+	gatewayClassFinalizer      = gwapiv1.GatewayClassFinalizerGatewaysExist
+)
+
+// InitGatewayController creates a new Gateway controller instance. Gateway Controllers watches for gwapiv1.Gateway.
+func InitGatewayController(mgr manager.Manager, pResourses *message.ProviderResources, statusUpdater *status.UpdateHandler) error {
+	conf := config.ReadConfigs()
+	r := &gatewayReconcilerNew{
+		client:        mgr.GetClient(),
+		statusUpdater: statusUpdater,
+		mgr:           mgr,
+		resources:     pResourses,
+		namespace:     conf.Envoy.Namespace,
+		store:         newProviderStore(),
+	}
+	c, err := controller.New(constants.GatewayControllerNew, mgr, controller.Options{Reconciler: r})
+	if err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error3119, logging.BLOCKER, "Error creating API controller, error: %v", err))
+		return err
+	}
+
+	ctx := context.Background()
+	// Watch resources
+	if err := r.watchResources(ctx, mgr, c); err != nil {
+		return err
+	}
+	// Subscribe to status updates
+	r.subscribeAndUpdateStatus(ctx)
+	loggers.LoggerAPKOperator.Info("New Controller successfully started. Watching Gateway Objects....")
+	return nil
+}
+
+// Reconcile handles reconciling all resources in a single call. Any resource event should enqueue the
+// same reconcile.Request containing the gateway controller name. This allows multiple resource updates to
+// be handled by a single call to Reconcile. The reconcile.Request DOES NOT map to a specific resource.
+func (r *gatewayReconcilerNew) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
+	var (
+		managedGCs []*gwapiv1.GatewayClass
+		err        error
+	)
+
+	loggers.LoggerAPKOperator.Infof("Reconciling all gateways due to change in %s:%s", req.Namespace, req.Name)
+
+	// Get the GatewayClasses managed by the Envoy Gateway Controller.
+	managedGCs, err = r.managedGatewayClasses(ctx)
+	if err != nil {
+		return reconcile.Result{}, err
+	}
+
+	// The gatewayclass was already deleted/finalized and there are stale queue entries.
+	if managedGCs == nil {
+		r.resources.GatewayAPIResources.Delete(string(gatewayClassControllerName))
+		loggers.LoggerAPKOperator.Info("no accepted gatewayclass")
+		return reconcile.Result{}, nil
+	}
+
+	// we only manage one gatewayclass
+	managedGC := managedGCs[0]
+
+	// Collect all the Gateway API resources, Envoy Gateway customized resources,
+	// and their referenced resources for the managed GatewayClasses, and store
+	// them per GatewayClass.
+	// For example:
+	// - Gateway API resources: Gateways, xRoutes ...
+	// - Referenced resources: Services, ServiceImports, EndpointSlices, Secrets, ConfigMaps ...
+	gwcResource := gatewayapi.NewResources()
+	gwcResource.GatewayClass = managedGC
+	gwcResources := gatewayapi.ControllerResources{gwcResource}
+	resourceMappings := newResourceMapping()
+
+	// Add all Gateways, their associated Routes, and referenced resources to the resourceTree
+	if err = r.processGateways(ctx, managedGC, resourceMappings, gwcResource); err != nil {
+		return reconcile.Result{}, err
+	}
+
+	// Add the referenced services, ServiceImports, and EndpointSlices in
+	// the collected BackendRefs to the resourceTree.
+	// BackendRefs are referred by various Route objects and the ExtAuth in SecurityPolicies.
+	r.processBackendRefs(ctx, gwcResource, resourceMappings)
+
+	// For this particular Gateway, and all associated objects, check whether the
+	// namespace exists. Add to the resourceTree.
+	for ns := range resourceMappings.allAssociatedNamespaces {
+		namespace, err := r.getNamespace(ctx, ns)
+		if err != nil {
+			loggers.LoggerAPKOperator.Error("Unable to find the namespace ", err)
+			if k8errors.IsNotFound(err) {
+				return reconcile.Result{}, nil
+			}
+			return reconcile.Result{}, err
+		}
+
+		gwcResource.Namespaces = append(gwcResource.Namespaces, namespace)
+	}
+
+	if err := r.updateStatusForGatewayClass(ctx, managedGC, true, string(gwapiv1.GatewayClassReasonAccepted), status.MsgValidGatewayClass); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Unable to update GatewayClass %s status %v", managedGC.Name, err)
+		return reconcile.Result{}, err
+	}
+	if len(gwcResource.Gateways) == 0 {
+		loggers.LoggerAPKOperator.Info("No gateways found for accepted gatewayclass ", managedGC.Name)
+
+		// If needed, remove the finalizer from the accepted GatewayClass.
+		if err := r.removeFinalizer(ctx, managedGC); err != nil {
+			loggers.LoggerAPKOperator.Errorf("Failed to remove finalizer from gatewayclass %s, %v",
+				managedGC.Name, err)
+			return reconcile.Result{}, err
+		}
+	} else {
+		// finalize the accepted GatewayClass.
+		if err := r.addFinalizer(ctx, managedGC); err != nil {
+			loggers.LoggerAPKOperator.Errorf("Failed adding finalizer to gatewayclass %s, %v",
+				managedGC.Name, err)
+			return reconcile.Result{}, err
+		}
+	}
+
+	// Store the Gateway Resources for the GatewayClass.
+	// The Store is triggered even when there are no Gateways associated to the
+	// GatewayClass. This would happen in case the last Gateway is removed and the
+	// Store will be required to trigger a cleanup of envoy infra resources.
+	r.resources.GatewayAPIResources.Store(gatewayClassControllerName, &gwcResources)
+
+	return ctrl.Result{}, nil
+}
+
+// managedGatewayClasses returns a list of GatewayClass objects that are managed by the Envoy Gateway Controller.
+func (r *gatewayReconcilerNew) managedGatewayClasses(ctx context.Context) ([]*gwapiv1.GatewayClass, error) {
+	var gatewayClasses gwapiv1.GatewayClassList
+	if err := r.client.List(ctx, &gatewayClasses); err != nil {
+		return nil, fmt.Errorf("error listing gatewayclasses: %w", err)
+	}
+
+	var cc controlledClasses
+
+	for _, gwClass := range gatewayClasses.Items {
+		gwClass := gwClass
+		if gwClass.Spec.ControllerName == gatewayClassControllerName {
+			// The gatewayclass was marked for deletion and the finalizer removed,
+			// so clean-up dependents.
+			if !gwClass.DeletionTimestamp.IsZero() &&
+				!stringutils.StringInSlice(gatewayClassFinalizer, gwClass.Finalizers) {
+				loggers.LoggerAPKOperator.Info("Gatewayclass marked for deletion")
+				cc.removeMatch(&gwClass)
+				continue
+			}
+
+			cc.addMatch(&gwClass)
+		}
+	}
+
+	return cc.matchedClasses, nil
+}
+
+func newResourceMapping() *resourceMappings {
+	return &resourceMappings{
+		allAssociatedNamespaces:  map[string]struct{}{},
+		allAssociatedBackendRefs: map[gwapiv1.BackendObjectReference]struct{}{},
+		extensionRefFilters:      map[types.NamespacedName]unstructured.Unstructured{},
+	}
+}
+
+func (r *gatewayReconcilerNew) processGateways(ctx context.Context, managedGC *gwapiv1.GatewayClass, resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	// Find gateways for the managedGC
+	// Find the Gateways that reference this Class.
+	gatewayList := &gwapiv1.GatewayList{}
+	if err := r.client.List(ctx, gatewayList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(classGatewayIndex, managedGC.Name),
+	}); err != nil || len(gatewayList.Items) < 1 {
+		loggers.LoggerAPKOperator.Infof("No associated Gateways found for GatewayClass name %s, %v", managedGC.Name, err)
+		return err
+	}
+
+	for _, gtw := range gatewayList.Items {
+		loggers.LoggerAPKOperator.Infof("Processing Gateway namespace %s: Name %s", gtw.Namespace, gtw.Name)
+		resourceMap.allAssociatedNamespaces[gtw.Namespace] = struct{}{}
+
+		for _, listener := range gtw.Spec.Listeners {
+			// Get Secret for gateway if it exists.
+			if terminatesTLS(&listener) {
+				for _, certRef := range listener.TLS.CertificateRefs {
+					certRef := certRef
+					if refsSecret(&certRef) {
+						if err := r.processSecretRef(ctx, resourceMap, resourceTree, gatewayapi.KindGateway, gtw.Namespace,
+							gtw.Name, certRef); err != nil {
+							loggers.LoggerAPKOperator.Errorf("Failed to process TLS SecretRef for gateway %+v, secretRef %+v, Error: %v", gtw, certRef, err)
+						}
+					}
+				}
+			}
+		}
+
+		// Get HTTPRoute objects and check if it exists.
+		if err := r.processHTTPRoutes(ctx, utils.NamespacedName(&gtw).String(), resourceMap, resourceTree); err != nil {
+			return err
+		}
+
+		// Discard Status to reduce memory consumption in watchable
+		// It will be recomputed by the gateway-api layer
+		gtw.Status = gwapiv1.GatewayStatus{}
+		resourceTree.Gateways = append(resourceTree.Gateways, &gtw)
+	}
+
+	return nil
+}
+
+// processSecretRef adds the referenced Secret to the resourceTree if it's valid.
+// - If it exists in the same namespace as the owner.
+// - If it exists in a different namespace, and there is a ReferenceGrant.
+func (r *gatewayReconcilerNew) processSecretRef(
+	ctx context.Context,
+	resourceMap *resourceMappings,
+	resourceTree *gatewayapi.Resources,
+	ownerKind string,
+	ownerNS string,
+	ownerName string,
+	secretRef gwapiv1.SecretObjectReference,
+) error {
+	secret := new(corev1.Secret)
+	secretNS := gatewayapi.NamespaceDerefOr(secretRef.Namespace, ownerNS)
+	err := r.client.Get(ctx,
+		types.NamespacedName{Namespace: secretNS, Name: string(secretRef.Name)},
+		secret,
+	)
+	if err != nil {
+		return fmt.Errorf("unable to find the Secret: %s/%s, Error: %v", secretNS, string(secretRef.Name), err)
+	}
+	if secretNS != ownerNS {
+		from := ObjectKindNamespacedName{
+			kind:      ownerKind,
+			namespace: ownerNS,
+			name:      ownerName,
+		}
+		to := ObjectKindNamespacedName{
+			kind:      gatewayapi.KindSecret,
+			namespace: secretNS,
+			name:      secret.Name,
+		}
+		refGrant, err := r.findReferenceGrant(ctx, from, to)
+		switch {
+		case err != nil:
+			return fmt.Errorf("failed to find ReferenceGrant: %w", err)
+		case refGrant == nil:
+			return fmt.Errorf(
+				"no matching ReferenceGrants found: from %s/%s to %s/%s",
+				from.kind, from.namespace, to.kind, to.namespace)
+		default:
+			// RefGrant found
+			resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+			loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map namespace %s, name %s",
+				refGrant.Namespace, refGrant.Name)
+		}
+	}
+	resourceMap.allAssociatedNamespaces[secretNS] = struct{}{} // TODO Zhaohuabing do we need this line?
+	resourceTree.Secrets = append(resourceTree.Secrets, secret)
+	loggers.LoggerAPKOperator.Infof("Processing Secret namespace %s name %s", secretNS, string(secretRef.Name))
+	return nil
+}
+
+func (r *gatewayReconcilerNew) findReferenceGrant(ctx context.Context, from, to ObjectKindNamespacedName) (*gwapiv1b1.ReferenceGrant, error) {
+	refGrantList := new(gwapiv1b1.ReferenceGrantList)
+	opts := &client.ListOptions{FieldSelector: fields.OneTermEqualSelector(targetRefGrantRouteIndex, to.kind)}
+	if err := r.client.List(ctx, refGrantList, opts); err != nil {
+		return nil, fmt.Errorf("failed to list ReferenceGrants: %w", err)
+	}
+
+	refGrants := refGrantList.Items
+
+	for _, refGrant := range refGrants {
+		if refGrant.Namespace == to.namespace {
+			for _, src := range refGrant.Spec.From {
+				if src.Kind == gwapiv1.Kind(from.kind) && string(src.Namespace) == from.namespace {
+					return &refGrant, nil
+				}
+			}
+		}
+	}
+
+	// No ReferenceGrant found.
+	return nil, nil
+}
+
+func (r *gatewayReconcilerNew) enqueueClass(_ context.Context, _ client.Object) []reconcile.Request {
+	return []reconcile.Request{{NamespacedName: types.NamespacedName{
+		Name: string(gatewayClassControllerName),
+	}}}
+}
+
+// watchResources watches gateway api resources.
+func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.Manager, c controller.Controller) error {
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.GatewayClass{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.hasMatchingController),
+	); err != nil {
+		return err
+	}
+
+	// Watch Gateway CRUDs and reconcile affected GatewayClass.
+	gPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.validateGatewayForReconcile),
+	}
+
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.Gateway{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		gPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addGatewayIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// Watch HTTPRoute CRUDs and process affected Gateways.
+	httprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1.HTTPRoute{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		httprPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addHTTPRouteIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// // Watch GRPCRoute CRUDs and process affected Gateways.
+	// grpcrPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.GRPCRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	grpcrPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addGRPCRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch TLSRoute CRUDs and process affected Gateways.
+	// tlsrPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	tlsrPredicates = append(tlsrPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.TLSRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	tlsrPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addTLSRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch UDPRoute CRUDs and process affected Gateways.
+	// udprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	udprPredicates = append(udprPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.UDPRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	udprPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addUDPRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// // Watch TCPRoute CRUDs and process affected Gateways.
+	// tcprPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	tcprPredicates = append(tcprPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.TCPRoute{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	tcprPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+	// if err := addTCPRouteIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// Watch Service CRUDs and process affected *Route objects and services belongs to gateways
+	servicePredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateServiceForReconcile)}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Service{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		servicePredicates...,
+	); err != nil {
+		return err
+	}
+
+	// serviceImportCRDExists := r.serviceImportCRDExists(mgr)
+	// if !serviceImportCRDExists {
+	// 	loggers.LoggerAPKOperator.Info("ServiceImport CRD not found, skipping ServiceImport watch")
+	// }
+
+	// // Watch ServiceImport CRUDs and process affected *Route objects.
+	// if serviceImportCRDExists {
+	// 	if err := c.Watch(
+	// 		source.Kind(mgr.GetCache(), &mcsapi.ServiceImport{}),
+	// 		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 		predicate.GenerationChangedPredicate{},
+	// 		predicate.NewPredicateFuncs(r.validateServiceImportForReconcile)); err != nil {
+	// 		// ServiceImport is not available in the cluster, skip the watch and not throw error.
+	// 		loggers.LoggerAPKOperator.Info("unable to watch ServiceImport: %s", err.Error())
+	// 	}
+	// }
+
+	// // Watch EndpointSlice CRUDs and process affected *Route objects.
+	// esPredicates := []predicate.Predicate{
+	// 	predicate.GenerationChangedPredicate{},
+	// 	predicate.NewPredicateFuncs(r.validateEndpointSliceForReconcile),
+	// }
+	// if r.namespaceLabel != nil {
+	// 	esPredicates = append(esPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &discoveryv1.EndpointSlice{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	esPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// Watch Node CRUDs to update Gateway Address exposed by Service of type NodePort.
+	// Node creation/deletion and ExternalIP updates would require update in the Gateway
+	nPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.handleNode),
+	}
+	// resource address.
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Node{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		nPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// Watch Secret CRUDs and process affected EG CRs (Gateway, SecurityPolicy, more in the future).
+	secretPredicates := []predicate.Predicate{
+		predicate.GenerationChangedPredicate{},
+		predicate.NewPredicateFuncs(r.validateSecretForReconcile),
+	}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &corev1.Secret{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		secretPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// // Watch ConfigMap CRUDs and process affected ClienTraffiPolicies and BackendTLSPolicies.
+	// configMapPredicates := []predicate.Predicate{
+	// 	predicate.GenerationChangedPredicate{},
+	// 	predicate.NewPredicateFuncs(r.validateConfigMapForReconcile),
+	// }
+	// if r.namespaceLabel != nil {
+	// 	configMapPredicates = append(configMapPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &corev1.ConfigMap{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	configMapPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// Watch ReferenceGrant CRUDs and process affected Gateways.
+	rgPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &gwapiv1b1.ReferenceGrant{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		rgPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addReferenceGrantIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
+	// Watch Deployment CRUDs and process affected Gateways.
+	dPredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateDeploymentForReconcile)}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &appsv1.Deployment{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		dPredicates...,
+	); err != nil {
+		return err
+	}
+
+	// // Watch BackendTLSPolicy
+	// btlsPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	btlsPredicates = append(btlsPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+
+	// if err := c.Watch(
+	// 	source.Kind(mgr.GetCache(), &gwapiv1a2.BackendTLSPolicy{}),
+	// 	handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 	btlsPredicates...,
+	// ); err != nil {
+	// 	return err
+	// }
+
+	// if err := addBtlsIndexers(ctx, mgr); err != nil {
+	// 	return err
+	// }
+
+	// loggers.LoggerAPKOperator.Info("Watching gatewayAPI related objects")
+
+	// // Watch any additional GVKs from the registered extension.
+	// uPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	// if r.namespaceLabel != nil {
+	// 	uPredicates = append(uPredicates, predicate.NewPredicateFuncs(r.hasMatchingNamespaceLabels))
+	// }
+	// for _, gvk := range r.extGVKs {
+	// 	u := &unstructured.Unstructured{}
+	// 	u.SetGroupVersionKind(gvk)
+	// 	if err := c.Watch(source.Kind(mgr.GetCache(), u),
+	// 		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+	// 		uPredicates...,
+	// 	); err != nil {
+	// 		return err
+	// 	}
+	// 	loggers.LoggerAPKOperator.Info("Watching additional resource", "resource", gvk.String())
+	// }
+	return nil
+}
+
+// processBackendRefs adds the referenced resources in BackendRefs to the resourceTree, including:
+// - Services
+// - ServiceImports
+// - EndpointSlices
+func (r *gatewayReconcilerNew) processBackendRefs(ctx context.Context, gwcResource *gatewayapi.Resources, resourceMappings *resourceMappings) {
+	for backendRef := range resourceMappings.allAssociatedBackendRefs {
+		backendRefKind := gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService)
+		loggers.LoggerAPKOperator.Infof("Processing Backend kind %s, namespace %s, name %s", backendRefKind,
+			string(*backendRef.Namespace), string(backendRef.Name))
+
+		var endpointSliceLabelKey string
+		switch backendRefKind {
+		case gatewayapi.KindService:
+			service := new(corev1.Service)
+			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, service)
+			if err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get Service namespace %s, name: %s, Error: %v",
+					string(*backendRef.Namespace), string(backendRef.Name), err)
+			} else {
+				resourceMappings.allAssociatedNamespaces[service.Namespace] = struct{}{}
+				gwcResource.Services = append(gwcResource.Services, service)
+				loggers.LoggerAPKOperator.Infof("Added Service to resource tree namespace %s, name: %s",
+					string(*backendRef.Namespace), string(backendRef.Name))
+			}
+			endpointSliceLabelKey = discoveryv1.LabelServiceName
+
+		case gatewayapi.KindBackend:
+			backend := new(dpv1alpha1.Backend)
+			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, backend)
+			if err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get Backend namespace %s, name %s, Error: %v", string(*backendRef.Namespace),
+					string(backendRef.Name), err)
+			} else {
+				resourceMappings.allAssociatedNamespaces[backend.Namespace] = struct{}{}
+				gwcResource.Backends = append(gwcResource.Backends, backend)
+				loggers.LoggerAPKOperator.Infof("Added Backend to resource tree namespace %s, name %s",
+					string(*backendRef.Namespace), string(backendRef.Name))
+			}
+		}
+
+		if endpointSliceLabelKey != "" {
+			// Retrieve the EndpointSlices associated with the service
+			endpointSliceList := new(discoveryv1.EndpointSliceList)
+			opts := []client.ListOption{
+				client.MatchingLabels(map[string]string{
+					endpointSliceLabelKey: string(backendRef.Name),
+				}),
+				client.InNamespace(string(*backendRef.Namespace)),
+			}
+			if err := r.client.List(ctx, endpointSliceList, opts...); err != nil {
+				loggers.LoggerAPKOperator.Errorf("Failed to get EndpointSlices namespace %s, kind %s, name %s, Error %v",
+					string(*backendRef.Namespace), backendRefKind, string(backendRef.Name), err)
+			} else {
+				for _, endpointSlice := range endpointSliceList.Items {
+					endpointSlice := endpointSlice
+					loggers.LoggerAPKOperator.Infof("Added EndpointSlice to resource tree namespace %s, name %s",
+						endpointSlice.Namespace, endpointSlice.Name)
+					gwcResource.EndpointSlices = append(gwcResource.EndpointSlices, &endpointSlice)
+				}
+			}
+		}
+	}
+}
+
+func (r *gatewayReconcilerNew) getNamespace(ctx context.Context, name string) (*corev1.Namespace, error) {
+	nsKey := types.NamespacedName{Name: name}
+	ns := new(corev1.Namespace)
+	if err := r.client.Get(ctx, nsKey, ns); err != nil {
+		loggers.LoggerAPKOperator.Error("Unable to get Namespace ", err)
+		return nil, err
+	}
+	return ns, nil
+}
+
+func (r *gatewayReconcilerNew) updateStatusForGatewayClass(
+	ctx context.Context,
+	gc *gwapiv1.GatewayClass,
+	accepted bool,
+	reason,
+	msg string) error {
+	if r.statusUpdater != nil {
+		r.statusUpdater.Send(status.Update{
+			NamespacedName: types.NamespacedName{Name: gc.Name},
+			Resource:       &gwapiv1.GatewayClass{},
+			UpdateStatus: func(obj client.Object) client.Object {
+				gc, ok := obj.(*gwapiv1.GatewayClass)
+				if !ok {
+					panic(fmt.Sprintf("unsupported object type %T", obj))
+				}
+
+				return status.SetGatewayClassAccepted(gc.DeepCopy(), accepted, reason, msg)
+			},
+		})
+	} else {
+		// this branch makes testing easier by not going through the status.Updater.
+		duplicate := status.SetGatewayClassAccepted(gc.DeepCopy(), accepted, reason, msg)
+
+		if err := r.client.Status().Update(ctx, duplicate); err != nil && !k8errors.IsNotFound(err) {
+			return fmt.Errorf("error updating status of gatewayclass %s: %w", duplicate.Name, err)
+		}
+	}
+	return nil
+}
+
+// removeFinalizer removes the gatewayclass finalizer from the provided gc, if it exists.
+func (r *gatewayReconcilerNew) removeFinalizer(ctx context.Context, gc *gwapiv1.GatewayClass) error {
+	if stringutils.StringInSlice(gatewayClassFinalizer, gc.Finalizers) {
+		base := client.MergeFrom(gc.DeepCopy())
+		gc.Finalizers = stringutils.RemoveString(gc.Finalizers, gatewayClassFinalizer)
+		if err := r.client.Patch(ctx, gc, base); err != nil {
+			return fmt.Errorf("failed to remove finalizer from gatewayclass %s: %w", gc.Name, err)
+		}
+	}
+	return nil
+}
+
+// addFinalizer adds the gatewayclass finalizer to the provided gc, if it doesn't exist.
+func (r *gatewayReconcilerNew) addFinalizer(ctx context.Context, gc *gwapiv1.GatewayClass) error {
+	if !stringutils.StringInSlice(gatewayClassFinalizer, gc.Finalizers) {
+		base := client.MergeFrom(gc.DeepCopy())
+		gc.Finalizers = append(gc.Finalizers, gatewayClassFinalizer)
+		if err := r.client.Patch(ctx, gc, base); err != nil {
+			return fmt.Errorf("failed to add finalizer to gatewayclass %s: %w", gc.Name, err)
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
new file mode 100644
index 000000000..c31d2dc4e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
@@ -0,0 +1,151 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/constants"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type controlledClasses struct {
+	// matchedClasses holds all GatewayClass objects with matching controllerName.
+	matchedClasses []*gwapiv1.GatewayClass
+}
+
+func (cc *controlledClasses) addMatch(gc *gwapiv1.GatewayClass) {
+	cc.matchedClasses = append(cc.matchedClasses, gc)
+}
+
+func (cc *controlledClasses) removeMatch(gc *gwapiv1.GatewayClass) {
+	// First remove gc from matchedClasses.
+	for i, matchedGC := range cc.matchedClasses {
+		if matchedGC.Name == gc.Name {
+			cc.matchedClasses[i] = cc.matchedClasses[len(cc.matchedClasses)-1]
+			cc.matchedClasses = cc.matchedClasses[:len(cc.matchedClasses)-1]
+			break
+		}
+	}
+}
+
+// terminatesTLS returns true if the provided gateway contains a listener configured
+// for TLS termination.
+func terminatesTLS(listener *gwapiv1.Listener) bool {
+	if listener.TLS != nil &&
+		(listener.Protocol == gwapiv1.HTTPSProtocolType ||
+			listener.Protocol == gwapiv1.TLSProtocolType) &&
+		listener.TLS.Mode != nil &&
+		*listener.TLS.Mode == gwapiv1.TLSModeTerminate {
+		return true
+	}
+	return false
+}
+
+// refsSecret returns true if ref refers to a Secret.
+func refsSecret(ref *gwapiv1.SecretObjectReference) bool {
+	return (ref.Group == nil || *ref.Group == corev1.GroupName) &&
+		(ref.Kind == nil || *ref.Kind == gatewayapi.KindSecret)
+}
+
+type ObjectKindNamespacedName struct {
+	kind      string
+	namespace string
+	name      string
+}
+
+// validateParentRefs validates the provided routeParentReferences, returning the
+// referenced Gateways managed by Envoy Gateway. The only supported parentRef
+// is a Gateway.
+func validateParentRefs(ctx context.Context, client client.Client, namespace string,
+	gatewayClassController gwapiv1.GatewayController,
+	routeParentReferences []gwapiv1.ParentReference) ([]gwapiv1.Gateway, error) {
+
+	var gateways []gwapiv1.Gateway
+	for i := range routeParentReferences {
+		ref := routeParentReferences[i]
+		if ref.Kind != nil && *ref.Kind != "Gateway" {
+			return nil, fmt.Errorf("invalid Kind %q", *ref.Kind)
+		}
+		if ref.Group != nil && *ref.Group != gwapiv1.GroupName {
+			return nil, fmt.Errorf("invalid Group %q", *ref.Group)
+		}
+
+		// Ensure the referenced Gateway exists, using the route's namespace unless
+		// specified by the parentRef.
+		ns := namespace
+		if ref.Namespace != nil {
+			ns = string(*ref.Namespace)
+		}
+		gwKey := types.NamespacedName{
+			Namespace: ns,
+			Name:      string(ref.Name),
+		}
+
+		gw := new(gwapiv1.Gateway)
+		if err := client.Get(ctx, gwKey, gw); err != nil {
+			return nil, fmt.Errorf("failed to get gateway %s/%s: %w", gwKey.Namespace, gwKey.Name, err)
+		}
+
+		gcKey := types.NamespacedName{Name: string(gw.Spec.GatewayClassName)}
+		gc := new(gwapiv1.GatewayClass)
+		if err := client.Get(ctx, gcKey, gc); err != nil {
+			return nil, fmt.Errorf("failed to get gatewayclass %s: %w", gcKey.Name, err)
+		}
+		if gc.Spec.ControllerName == gatewayClassController {
+			gateways = append(gateways, *gw)
+		}
+	}
+
+	return gateways, nil
+}
+
+// validateBackendRef validates that ref is a reference to a local Service.
+// TODO: Add support for:
+//   - Validating weights.
+//   - Validating ports.
+//   - Referencing HTTPRoutes.
+func validateBackendRef(ref *gwapiv1.BackendRef) error {
+	switch {
+	case ref == nil:
+		return nil
+	case gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName) != corev1.GroupName && gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName) != constants.GroupName:
+		return fmt.Errorf("invalid group; must be nil, empty string or %q, given %q", constants.GroupName, gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName))
+	case gatewayapi.KindDerefOr(ref.Kind, gatewayapi.KindService) != gatewayapi.KindService && gatewayapi.KindDerefOr(ref.Kind, gatewayapi.KindService) != constants.KindBackend:
+		return fmt.Errorf("invalid kind %q; must be %q or %q, given %q",
+			*ref.BackendObjectReference.Kind, gatewayapi.KindService, constants.KindBackend, gatewayapi.GroupDerefOr(ref.Group, corev1.GroupName))
+	}
+
+	return nil
+}
+
+// infraName returns expected name for the EnvoyProxy infra resources.
+// By default it returns hashed string from {GatewayNamespace}/{GatewayName},
+func infraName(gateway *gwapiv1.Gateway) string {
+	namespace := gateway.Namespace
+	if len(namespace) > 5 {
+		namespace = namespace[:5]
+	}
+	infraName := fmt.Sprintf("%s/%s", namespace, gateway.Name)
+	return proxy.ExpectedResourceHashedName(infraName)
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
new file mode 100644
index 000000000..620c75089
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
@@ -0,0 +1,399 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+const (
+	classGatewayIndex          = "classGatewayIndex"
+	gatewayTLSRouteIndex       = "gatewayTLSRouteIndex"
+	gatewayHTTPRouteIndex      = "gatewayHTTPRouteIndex"
+	gatewayGRPCRouteIndex      = "gatewayGRPCRouteIndex"
+	gatewayTCPRouteIndex       = "gatewayTCPRouteIndex"
+	gatewayUDPRouteIndex       = "gatewayUDPRouteIndex"
+	secretGatewayIndex         = "secretGatewayIndex"
+	targetRefGrantRouteIndex   = "targetRefGrantRouteIndex"
+	backendHTTPRouteIndex      = "backendHTTPRouteIndex"
+	serviceHTTPRouteIndex      = "serviceHTTPRouteIndex"
+	backendGRPCRouteIndex      = "backendGRPCRouteIndex"
+	backendTLSRouteIndex       = "backendTLSRouteIndex"
+	backendTCPRouteIndex       = "backendTCPRouteIndex"
+	backendUDPRouteIndex       = "backendUDPRouteIndex"
+	secretSecurityPolicyIndex  = "secretSecurityPolicyIndex"
+	backendSecurityPolicyIndex = "backendSecurityPolicyIndex"
+	configMapCtpIndex          = "configMapCtpIndex"
+	secretCtpIndex             = "secretCtpIndex"
+	configMapBtlsIndex         = "configMapBtlsIndex"
+)
+
+func addReferenceGrantIndexers(ctx context.Context, mgr manager.Manager) error {
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1b1.ReferenceGrant{}, targetRefGrantRouteIndex, func(rawObj client.Object) []string {
+		refGrant := rawObj.(*gwapiv1b1.ReferenceGrant)
+		var referredServices []string
+		for _, target := range refGrant.Spec.To {
+			referredServices = append(referredServices, string(target.Kind))
+		}
+		return referredServices
+	})
+}
+
+// addHTTPRouteIndexers adds indexing on HTTPRoute.
+//   - For Service, ServiceImports objects that are referenced in HTTPRoute objects via `.spec.rules.backendRefs`.
+//     This helps in querying for HTTPRoutes that are affected by a particular Service CRUD.
+func addHTTPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, gatewayHTTPRouteIndex, gatewayHTTPRouteIndexFunc); err != nil {
+		return err
+	}
+	// Backend to HTTPRoute indexer
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, backendHTTPRouteIndex, backendHTTPRouteIndexFunc); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, serviceHTTPRouteIndex, serviceHTTPRouteIndexFunc)
+}
+
+func gatewayHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var gateways []string
+	for _, parent := range httproute.Spec.ParentRefs {
+		if parent.Kind == nil || string(*parent.Kind) == gatewayapi.KindGateway {
+			// If an explicit Gateway namespace is not provided, use the HTTPRoute namespace to
+			// lookup the provided Gateway Name.
+			gateways = append(gateways,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(parent.Namespace, httproute.Namespace),
+					Name:      string(parent.Name),
+				}.String(),
+			)
+		}
+	}
+	return gateways
+}
+
+func serviceHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var backendRefs []string
+	for _, rule := range httproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the HTTPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, httproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+func backendHTTPRouteIndexFunc(rawObj client.Object) []string {
+	httproute := rawObj.(*gwapiv1.HTTPRoute)
+	var backendRefs []string
+	for _, rule := range httproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindBackend {
+				// If an explicit Backend namespace is not provided, use the HTTPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, httproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addGRPCRouteIndexers adds indexing on GRPCRoute, for Service objects that are
+// referenced in GRPCRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for GRPCRoutes that are affected by a particular Service CRUD.
+func addGRPCRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.GRPCRoute{}, gatewayGRPCRouteIndex, gatewayGRPCRouteIndexFunc); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.GRPCRoute{}, backendGRPCRouteIndex, backendGRPCRouteIndexFunc)
+}
+
+func gatewayGRPCRouteIndexFunc(rawObj client.Object) []string {
+	grpcroute := rawObj.(*gwapiv1a2.GRPCRoute)
+	var gateways []string
+	for _, parent := range grpcroute.Spec.ParentRefs {
+		if parent.Kind == nil || string(*parent.Kind) == gatewayapi.KindGateway {
+			// If an explicit Gateway namespace is not provided, use the GRPCRoute namespace to
+			// lookup the provided Gateway Name.
+			gateways = append(gateways,
+				types.NamespacedName{
+					Namespace: gatewayapi.NamespaceDerefOr(parent.Namespace, grpcroute.Namespace),
+					Name:      string(parent.Name),
+				}.String(),
+			)
+		}
+	}
+	return gateways
+}
+
+func backendGRPCRouteIndexFunc(rawObj client.Object) []string {
+	grpcroute := rawObj.(*gwapiv1a2.GRPCRoute)
+	var backendRefs []string
+	for _, rule := range grpcroute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the GRPCRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(backend.Namespace, grpcroute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addTLSRouteIndexers adds indexing on TLSRoute, for Service objects that are
+// referenced in TLSRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for TLSRoutes that are affected by a particular Service CRUD.
+func addTLSRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TLSRoute{}, gatewayTLSRouteIndex, func(rawObj client.Object) []string {
+		tlsRoute := rawObj.(*gwapiv1a2.TLSRoute)
+		var gateways []string
+		for _, parent := range tlsRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the TLSRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, tlsRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TLSRoute{}, backendTLSRouteIndex, backendTLSRouteIndexFunc)
+}
+
+func backendTLSRouteIndexFunc(rawObj client.Object) []string {
+	tlsroute := rawObj.(*gwapiv1a2.TLSRoute)
+	var backendRefs []string
+	for _, rule := range tlsroute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the TLSRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, tlsroute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addTCPRouteIndexers adds indexing on TCPRoute, for Service objects that are
+// referenced in TCPRoute objects via `.spec.rules.backendRefs`. This helps in
+// querying for TCPRoutes that are affected by a particular Service CRUD.
+func addTCPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TCPRoute{}, gatewayTCPRouteIndex, func(rawObj client.Object) []string {
+		tcpRoute := rawObj.(*gwapiv1a2.TCPRoute)
+		var gateways []string
+		for _, parent := range tcpRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the TCPRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, tcpRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.TCPRoute{}, backendTCPRouteIndex, backendTCPRouteIndexFunc)
+}
+
+func backendTCPRouteIndexFunc(rawObj client.Object) []string {
+	tcpRoute := rawObj.(*gwapiv1a2.TCPRoute)
+	var backendRefs []string
+	for _, rule := range tcpRoute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the TCPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, tcpRoute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addUDPRouteIndexers adds indexing on UDPRoute.
+//   - For Gateway objects that are referenced in UDPRoute objects via `.spec.parentRefs`. This helps in
+//     querying for UDPRoutes that are affected by a particular Gateway CRUD.
+//   - For Service objects that are referenced in UDPRoute objects via `.spec.rules.backendRefs`. This helps in
+//     querying for UDPRoutes that are affected by a particular Service CRUD.
+func addUDPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.UDPRoute{}, gatewayUDPRouteIndex, func(rawObj client.Object) []string {
+		udpRoute := rawObj.(*gwapiv1a2.UDPRoute)
+		var gateways []string
+		for _, parent := range udpRoute.Spec.ParentRefs {
+			if string(*parent.Kind) == gatewayapi.KindGateway {
+				// If an explicit Gateway namespace is not provided, use the UDPRoute namespace to
+				// lookup the provided Gateway Name.
+				gateways = append(gateways,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(parent.Namespace, udpRoute.Namespace),
+						Name:      string(parent.Name),
+					}.String(),
+				)
+			}
+		}
+		return gateways
+	}); err != nil {
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.UDPRoute{}, backendUDPRouteIndex, backendUDPRouteIndexFunc)
+}
+
+func backendUDPRouteIndexFunc(rawObj client.Object) []string {
+	udproute := rawObj.(*gwapiv1a2.UDPRoute)
+	var backendRefs []string
+	for _, rule := range udproute.Spec.Rules {
+		for _, backend := range rule.BackendRefs {
+			if backend.Kind == nil || string(*backend.Kind) == gatewayapi.KindService {
+				// If an explicit Backend namespace is not provided, use the UDPRoute namespace to
+				// lookup the provided Gateway Name.
+				backendRefs = append(backendRefs,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOrAlpha(backend.Namespace, udproute.Namespace),
+						Name:      string(backend.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return backendRefs
+}
+
+// addGatewayIndexers adds indexing on Gateway, for Secret objects and gatewayclass that are
+// referenced in Gateway objects. This helps in querying for Gateways that are
+// affected by a particular Secret CRUD.
+func addGatewayIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.Gateway{}, secretGatewayIndex, secretGatewayIndexFunc); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Error while adding index %s, %v ", secretGatewayIndex, err)
+		return err
+	}
+
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.Gateway{}, classGatewayIndex, func(rawObj client.Object) []string {
+		gateway := rawObj.(*gwapiv1.Gateway)
+		loggers.LoggerAPKOperator.Infof("Index %s added for %s:%s to %s", classGatewayIndex, gateway.Namespace, gateway.Name,
+			gateway.Spec.GatewayClassName)
+		return []string{string(gateway.Spec.GatewayClassName)}
+	})
+}
+
+func secretGatewayIndexFunc(rawObj client.Object) []string {
+	gateway := rawObj.(*gwapiv1.Gateway)
+	var secretReferences []string
+	for _, listener := range gateway.Spec.Listeners {
+		if listener.TLS == nil || *listener.TLS.Mode != gwapiv1.TLSModeTerminate {
+			continue
+		}
+		for _, cert := range listener.TLS.CertificateRefs {
+			if *cert.Kind == gatewayapi.KindSecret {
+				// If an explicit Secret namespace is not provided, use the Gateway namespace to
+				// lookup the provided Secret Name.
+				secretReferences = append(secretReferences,
+					types.NamespacedName{
+						Namespace: gatewayapi.NamespaceDerefOr(cert.Namespace, gateway.Namespace),
+						Name:      string(cert.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return secretReferences
+}
+
+// addBtlsIndexers adds indexing on BackendTLSPolicy, for ConfigMap objects that are
+// referenced in BackendTLSPolicy objects. This helps in querying for BackendTLSPolicies that are
+// affected by a particular ConfigMap CRUD.
+func addBtlsIndexers(ctx context.Context, mgr manager.Manager) error {
+	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1a2.BackendTLSPolicy{}, configMapBtlsIndex, configMapBtlsIndexFunc)
+}
+
+func configMapBtlsIndexFunc(rawObj client.Object) []string {
+	btls := rawObj.(*gwapiv1a2.BackendTLSPolicy)
+	var configMapReferences []string
+	if btls.Spec.TLS.CACertRefs != nil {
+		for _, caCertRef := range btls.Spec.TLS.CACertRefs {
+			if string(caCertRef.Kind) == gatewayapi.KindConfigMap {
+				configMapReferences = append(configMapReferences,
+					types.NamespacedName{
+						Namespace: btls.Namespace,
+						Name:      string(caCertRef.Name),
+					}.String(),
+				)
+			}
+		}
+	}
+	return configMapReferences
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
new file mode 100644
index 000000000..d72604230
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
@@ -0,0 +1,112 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"flag"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/provider"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"k8s.io/client-go/rest"
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/healthz"
+	"sigs.k8s.io/controller-runtime/pkg/log"
+	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
+)
+
+// Provider is the scaffolding for the Kubernetes provider. It sets up dependencies
+// and defines the topology of the provider and its managed components, wiring
+// them together.
+type Provider struct {
+	client  client.Client
+	manager manager.Manager
+}
+
+// New creates a new Provider from the provided EnvoyGateway.
+func New(cfg *rest.Config, resources *message.ProviderResources) (*Provider, error) {
+	opts := zap.Options{
+		Development: true,
+	}
+	opts.BindFlags(flag.CommandLine)
+	flag.Parse()
+	log.SetLogger(zap.New(zap.UseFlagOptions(&opts)))
+
+	// TODO: Decide which mgr opts should be exposed through envoygateway.provider.kubernetes API.
+	mgrOpts := manager.Options{
+		LeaderElection:         false,
+		Scheme:                 provider.GetScheme(),
+		HealthProbeBindAddress: ":8081",
+		LeaderElectionID:       "operator-lease.apk.wso2.com",
+	}
+
+	mgr, err := ctrl.NewManager(cfg, mgrOpts)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create manager: %w", err)
+	}
+
+	updateHandler := status.NewUpdateHandler(mgr.GetClient())
+	if err := mgr.Add(updateHandler); err != nil {
+		return nil, fmt.Errorf("failed to add status update handler %w", err)
+	}
+
+	// Create and register the controllers with the manager.
+	if err := InitGatewayController(mgr, resources, updateHandler); err != nil {
+		return nil, fmt.Errorf("failted to create gatewayapi controller: %w", err)
+	}
+
+	// Add health check health probes.
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("unable to set up health check: %w", err)
+	}
+
+	// Add ready check health probes.
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		return nil, fmt.Errorf("unable to set up ready check: %w", err)
+	}
+
+	return &Provider{
+		manager: mgr,
+		client:  mgr.GetClient(),
+	}, nil
+}
+
+// Start starts the Provider synchronously until a message is received from ctx.
+func (p *Provider) Start(ctx context.Context) error {
+	errChan := make(chan error)
+	go func() {
+		errChan <- p.manager.Start(ctx)
+	}()
+
+	// Wait for the manager to exit or an explicit stop.
+	select {
+	case <-ctx.Done():
+		return nil
+	case err := <-errChan:
+		return err
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
new file mode 100644
index 000000000..156fb9f3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -0,0 +1,262 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+
+	appsv1 "k8s.io/api/apps/v1"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	corev1 "k8s.io/api/core/v1"
+	k8errors "k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// hasMatchingController returns true if the provided object is a GatewayClass
+// with a Spec.Controller string matching this Envoy Gateway's controller string,
+// or false otherwise.
+func (r *gatewayReconcilerNew) hasMatchingController(obj client.Object) bool {
+	gc, ok := obj.(*gwapiv1.GatewayClass)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("bypassing reconciliation due to unexpected object type ", obj)
+		return false
+	}
+
+	if gc.Spec.ControllerName == gatewayClassControllerName {
+		loggers.LoggerAPKOperator.Infof("gatewayclass has matching controller name %s, hence processing",
+			gc.Name)
+		return true
+	}
+
+	loggers.LoggerAPKOperator.Info("bypassing reconciliation due to controller name",
+		gc.Spec.ControllerName)
+	return false
+}
+
+// validateGatewayForReconcile returns true if the provided object is a Gateway
+// using a GatewayClass matching the configured gatewayclass controller name.
+func (r *gatewayReconcilerNew) validateGatewayForReconcile(obj client.Object) bool {
+	gw, ok := obj.(*gwapiv1.Gateway)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation object", obj)
+		return false
+	}
+
+	gatewayClass := &gwapiv1.GatewayClass{}
+	key := types.NamespacedName{Name: string(gw.Spec.GatewayClassName)}
+	if err := r.client.Get(context.Background(), key, gatewayClass); err != nil {
+		loggers.LoggerAPKOperator.Errorf("failed to get gatewayclass name %s, %+v", gw.Spec.GatewayClassName, err)
+		return false
+	}
+
+	if gatewayClass.Spec.ControllerName != gatewayClassControllerName {
+		loggers.LoggerAPKOperator.Infof("gatewayclass name %s for gateway doesn't match configured name %s in %s/%s ",
+			string(gatewayClass.Spec.ControllerName), gatewayClassControllerName, gw.Namespace, gw.Name)
+		return false
+	}
+	loggers.LoggerAPKOperator.Info("Gateway CR change is detected for ", gw.Name)
+	return true
+}
+
+// validateServiceForReconcile tries finding the owning Gateway of the Service
+// if it exists, finds the Gateway's Deployment, and further updates the Gateway
+// status Ready condition. All Services are pushed for reconciliation.
+func (r *gatewayReconcilerNew) validateServiceForReconcile(obj client.Object) bool {
+	ctx := context.Background()
+	svc, ok := obj.(*corev1.Service)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation for object", obj)
+		return false
+	}
+	labels := svc.GetLabels()
+
+	// Check if the Service belongs to a Gateway, if so, update the Gateway status.
+	gtw := r.findOwningGateway(ctx, labels)
+	if gtw != nil {
+		r.updateStatusForGateway(ctx, gtw)
+		return false
+	}
+
+	nsName := utils.NamespacedName(svc)
+	return r.isRouteReferencingBackend(&nsName)
+
+}
+
+// findOwningGateway attempts finds a Gateway using "labels".
+func (r *gatewayReconcilerNew) findOwningGateway(ctx context.Context, labels map[string]string) *gwapiv1.Gateway {
+	gwName, ok := labels[gatewayapi.OwningGatewayNameLabel]
+	if !ok {
+		return nil
+	}
+
+	gwNamespace, ok := labels[gatewayapi.OwningGatewayNamespaceLabel]
+	if !ok {
+		return nil
+	}
+
+	gatewayKey := types.NamespacedName{Namespace: gwNamespace, Name: gwName}
+	gtw := new(gwapiv1.Gateway)
+	if err := r.client.Get(ctx, gatewayKey, gtw); err != nil {
+		loggers.LoggerAPKOperator.Infof("Gateway %+v not found : %v", gatewayKey, err)
+		return nil
+	}
+	return gtw
+}
+
+// isRouteReferencingBackend returns true if the backend(service and serviceImport) is referenced by any of the xRoutes
+// in the system, else returns false.
+func (r *gatewayReconcilerNew) isRouteReferencingBackend(nsName *types.NamespacedName) bool {
+	ctx := context.Background()
+	httpRouteList := &gwapiv1.HTTPRouteList{}
+	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(serviceHTTPRouteIndex, nsName.String()),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error("unable to find associated HTTPRoutes for the service ", err)
+		return false
+	}
+
+	// Check how many Route objects refer this Backend
+	allAssociatedRoutes := len(httpRouteList.Items)
+
+	return allAssociatedRoutes != 0
+}
+
+// envoyServiceForGateway returns the Envoy service, returning nil if the service doesn't exist.
+func (r *gatewayReconcilerNew) envoyServiceForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (*corev1.Service, error) {
+	key := types.NamespacedName{
+		Namespace: r.namespace,
+		Name:      infraName(gateway),
+	}
+	svc := new(corev1.Service)
+	if err := r.client.Get(ctx, key, svc); err != nil {
+		if k8errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return svc, nil
+}
+
+// envoyDeploymentForGateway returns the Envoy Deployment, returning nil if the Deployment doesn't exist.
+func (r *gatewayReconcilerNew) envoyDeploymentForGateway(ctx context.Context, gateway *gwapiv1.Gateway) (*appsv1.Deployment, error) {
+	key := types.NamespacedName{
+		Namespace: r.namespace,
+		Name:      infraName(gateway),
+	}
+	deployment := new(appsv1.Deployment)
+	if err := r.client.Get(ctx, key, deployment); err != nil {
+		if k8errors.IsNotFound(err) {
+			return nil, nil
+		}
+		return nil, err
+	}
+	return deployment, nil
+}
+
+func (r *gatewayReconcilerNew) handleNode(obj client.Object) bool {
+	ctx := context.Background()
+	node, ok := obj.(*corev1.Node)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+
+	key := types.NamespacedName{Name: node.Name}
+	if err := r.client.Get(ctx, key, node); err != nil {
+		if k8errors.IsNotFound(err) {
+			r.store.removeNode(node)
+			return true
+		}
+		loggers.LoggerAPKOperator.Error(err, "unable to find node ", node.Name)
+		return false
+	}
+
+	r.store.addNode(node)
+	return true
+}
+
+// validateSecretForReconcile checks whether the Secret belongs to a valid Gateway.
+func (r *gatewayReconcilerNew) validateSecretForReconcile(obj client.Object) bool {
+	secret, ok := obj.(*corev1.Secret)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+
+	nsName := utils.NamespacedName(secret)
+
+	if r.isGatewayReferencingSecret(&nsName) {
+		return true
+	}
+
+	return false
+}
+
+func (r *gatewayReconcilerNew) isGatewayReferencingSecret(nsName *types.NamespacedName) bool {
+	gwList := &gwapiv1.GatewayList{}
+	if err := r.client.List(context.Background(), gwList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(secretGatewayIndex, nsName.String()),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "unable to find associated Gateways")
+		return false
+	}
+
+	if len(gwList.Items) == 0 {
+		return false
+	}
+
+	for _, gw := range gwList.Items {
+		gw := gw
+		if !r.validateGatewayForReconcile(&gw) {
+			return false
+		}
+	}
+	return true
+}
+
+// validateDeploymentForReconcile tries finding the owning Gateway of the Deployment
+// if it exists, finds the Gateway's Service, and further updates the Gateway
+// status Ready condition. No Deployments are pushed for reconciliation.
+func (r *gatewayReconcilerNew) validateDeploymentForReconcile(obj client.Object) bool {
+	ctx := context.Background()
+	deployment, ok := obj.(*appsv1.Deployment)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation", obj)
+		return false
+	}
+	labels := deployment.GetLabels()
+
+	// Only deployments in the configured namespace should be reconciled.
+	if deployment.Namespace == r.namespace {
+		// Check if the deployment belongs to a Gateway, if so, update the Gateway status.
+		gtw := r.findOwningGateway(ctx, labels)
+		if gtw != nil {
+			r.updateStatusForGateway(ctx, gtw)
+			return false
+		}
+	}
+
+	// There is no need to reconcile the Deployment any further.
+	return false
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
new file mode 100644
index 000000000..3b405680e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates_test.go
@@ -0,0 +1,89 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type GroupKindNamespacedName struct {
+	Group     gwapiv1.Group
+	Kind      gwapiv1.Kind
+	Namespace gwapiv1.Namespace
+	Name      gwapiv1.ObjectName
+}
+
+// TestGatewayClassHasMatchingController tests the hasMatchingController
+// predicate function.
+func TestGatewayClassHasMatchingController(t *testing.T) {
+	testCases := []struct {
+		name   string
+		obj    client.Object
+		client client.Client
+		expect bool
+	}{
+		{
+			name:   "matching controller name",
+			obj:    GetGatewayClass("test-gc", gatewayClassControllerName, nil),
+			expect: true,
+		},
+		{
+			name:   "non-matching controller name",
+			obj:    GetGatewayClass("test-gc", "not.configured/controller", nil),
+			expect: false,
+		},
+	}
+
+	r := gatewayReconcilerNew{}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			res := r.hasMatchingController(tc.obj)
+			require.Equal(t, tc.expect, res)
+		})
+	}
+}
+
+// GetGatewayClass returns a sample GatewayClass.
+func GetGatewayClass(name string, controller gwapiv1.GatewayController, envoyProxy *GroupKindNamespacedName) *gwapiv1.GatewayClass {
+	gwc := &gwapiv1.GatewayClass{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+		Spec: gwapiv1.GatewayClassSpec{
+			ControllerName: controller,
+		},
+	}
+
+	if envoyProxy != nil {
+		gwc.Spec.ParametersRef = &gwapiv1.ParametersReference{
+			Group:     envoyProxy.Group,
+			Kind:      envoyProxy.Kind,
+			Name:      string(envoyProxy.Name),
+			Namespace: &envoyProxy.Namespace,
+		}
+	}
+
+	return gwc
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
new file mode 100644
index 000000000..c63353bf6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -0,0 +1,189 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"errors"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// processHTTPRoutes finds HTTPRoutes corresponding to a gatewayNamespaceName, further checks for
+// the backend references and pushes the HTTPRoutes to the resourceTree.
+func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNamespaceName string,
+	resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
+	httpRouteList := &gwapiv1.HTTPRouteList{}
+
+	// extensionRefFilters, err := r.getExtensionRefFilters(ctx)
+	// if err != nil {
+	// 	return err
+	// }
+	// for i := range extensionRefFilters {
+	// 	filter := extensionRefFilters[i]
+	// 	resourceMap.extensionRefFilters[utils.NamespacedName(&filter)] = filter
+	// }
+
+	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(gatewayHTTPRouteIndex, gatewayNamespaceName),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error("Failed to list HTTPRoutes", err)
+		return err
+	}
+
+	for _, httpRoute := range httpRouteList.Items {
+		loggers.LoggerAPKOperator.Infof("Processing HTTPRoute %s:%s", httpRoute.Namespace, httpRoute.Name)
+
+		for _, rule := range httpRoute.Spec.Rules {
+			for _, backendRef := range rule.BackendRefs {
+				backendRef := backendRef
+				if err := validateBackendRef(&backendRef.BackendRef); err != nil {
+					loggers.LoggerAPKOperator.Error("Invalid backendRef ", err)
+					continue
+				}
+
+				backendNamespace := gatewayapi.NamespaceDerefOr(backendRef.Namespace, httpRoute.Namespace)
+				resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+					Group:     backendRef.BackendObjectReference.Group,
+					Kind:      backendRef.BackendObjectReference.Kind,
+					Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+					Name:      backendRef.Name,
+				}] = struct{}{}
+
+				if backendNamespace != httpRoute.Namespace {
+					from := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindHTTPRoute,
+						namespace: httpRoute.Namespace,
+						name:      httpRoute.Name,
+					}
+					to := ObjectKindNamespacedName{
+						kind:      gatewayapi.KindDerefOr(backendRef.Kind, gatewayapi.KindService),
+						namespace: backendNamespace,
+						name:      string(backendRef.Name),
+					}
+					refGrant, err := r.findReferenceGrant(ctx, from, to)
+					switch {
+					case err != nil:
+						loggers.LoggerAPKOperator.Error("Failed to find ReferenceGrant", err)
+					case refGrant == nil:
+						loggers.LoggerAPKOperator.Infof("No matching ReferenceGrants found for kind %s:%s to %s:%s",
+							from.kind, from.namespace, to.kind, to.namespace)
+					default:
+						resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+						loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map %s:%s",
+							refGrant.Namespace, refGrant.Name)
+					}
+				}
+			}
+
+			for i := range rule.Filters {
+				filter := rule.Filters[i]
+
+				if err := gatewayapi.ValidateHTTPRouteFilter(&filter); err != nil {
+					loggers.LoggerAPKOperator.Errorf("Bypassing filter rule for index %v, %v", i, err)
+					continue
+				}
+
+				// Load in the backendRefs from any requestMirrorFilters on the HTTPRoute
+				if filter.Type == gwapiv1.HTTPRouteFilterRequestMirror {
+					// Make sure the config actually exists
+					mirrorFilter := filter.RequestMirror
+					if mirrorFilter == nil {
+						loggers.LoggerAPKOperator.Error(errors.New("invalid requestMirror filter"), "bypassing filter rule", "index", i)
+						continue
+					}
+
+					mirrorBackendObj := mirrorFilter.BackendRef
+					// Wrap the filter's BackendObjectReference into a BackendRef so we can use existing tooling to check it
+					weight := int32(1)
+					mirrorBackendRef := gwapiv1.BackendRef{
+						BackendObjectReference: mirrorBackendObj,
+						Weight:                 &weight,
+					}
+
+					if err := validateBackendRef(&mirrorBackendRef); err != nil {
+						loggers.LoggerAPKOperator.Error("Invalid backendRef ", err)
+						continue
+					}
+
+					backendNamespace := gatewayapi.NamespaceDerefOr(mirrorBackendRef.Namespace,
+						httpRoute.Namespace)
+					resourceMap.allAssociatedBackendRefs[gwapiv1.BackendObjectReference{
+						Group:     mirrorBackendRef.BackendObjectReference.Group,
+						Kind:      mirrorBackendRef.BackendObjectReference.Kind,
+						Namespace: gatewayapi.NamespacePtrV1Alpha2(backendNamespace),
+						Name:      mirrorBackendRef.Name,
+					}] = struct{}{}
+
+					if backendNamespace != httpRoute.Namespace {
+						from := ObjectKindNamespacedName{
+							kind:      gatewayapi.KindHTTPRoute,
+							namespace: httpRoute.Namespace,
+							name:      httpRoute.Name,
+						}
+						to := ObjectKindNamespacedName{
+							kind:      gatewayapi.KindDerefOr(mirrorBackendRef.Kind, gatewayapi.KindService),
+							namespace: backendNamespace,
+							name:      string(mirrorBackendRef.Name),
+						}
+						refGrant, err := r.findReferenceGrant(ctx, from, to)
+						switch {
+						case err != nil:
+							loggers.LoggerAPKOperator.Error("Failed to find ReferenceGrant", err)
+						case refGrant == nil:
+							loggers.LoggerAPKOperator.Infof("No matching ReferenceGrants found from %s:%s target %s:%s",
+								from.kind, from.namespace, to.kind, to.namespace)
+						default:
+							resourceTree.ReferenceGrants = append(resourceTree.ReferenceGrants, refGrant)
+							loggers.LoggerAPKOperator.Infof("Added ReferenceGrant to resource map %s:%s",
+								refGrant.Namespace, refGrant.Name)
+						}
+					}
+				} else if filter.Type == gwapiv1.HTTPRouteFilterExtensionRef {
+					// NOTE: filters must be in the same namespace as the HTTPRoute
+					// Check if it's a Kind managed by an extension and add to resourceTree
+					key := types.NamespacedName{
+						Namespace: httpRoute.Namespace,
+						Name:      string(filter.ExtensionRef.Name),
+					}
+					extRefFilter, ok := resourceMap.extensionRefFilters[key]
+					if !ok {
+						loggers.LoggerAPKOperator.Errorf("Filter not found; bypassing rule name %v for index %v",
+							filter.ExtensionRef.Name, i)
+						continue
+					}
+
+					resourceTree.ExtensionRefFilters = append(resourceTree.ExtensionRefFilters, extRefFilter)
+				}
+			}
+		}
+
+		resourceMap.allAssociatedNamespaces[httpRoute.Namespace] = struct{}{}
+		// Discard Status to reduce memory consumption in watchable
+		// It will be recomputed by the gateway-api layer
+		httpRoute.Status = gwapiv1.HTTPRouteStatus{}
+		resourceTree.HTTPRoutes = append(resourceTree.HTTPRoutes, &httpRoute)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/status.go b/adapter/internal/operator/gateway-api/provider/kubernetes/status.go
new file mode 100644
index 000000000..f20ceb9b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/status.go
@@ -0,0 +1,137 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+package kubernetes
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// subscribeAndUpdateStatus subscribes to gateway API object status updates and
+// writes it into the Kubernetes API Server.
+func (r *gatewayReconcilerNew) subscribeAndUpdateStatus(ctx context.Context) {
+	// Gateway object status updater
+	go func() {
+		message.HandleSubscription(
+			message.Metadata{Runner: "provider", Message: "gateway-status"},
+			r.resources.GatewayStatuses.Subscribe(ctx),
+			func(update message.Update[types.NamespacedName, *gwapiv1.GatewayStatus], errChan chan error) {
+				// skip delete updates.
+				if update.Delete {
+					return
+				}
+				// Get gateway object
+				gtw := new(gwapiv1.Gateway)
+				if err := r.client.Get(ctx, update.Key, gtw); err != nil {
+					loggers.LoggerAPKOperator.Error(err, "gateway not found", "namespace", gtw.Namespace, "name", gtw.Name)
+					errChan <- err
+					return
+				}
+				// Set the updated Status and call the status update
+				gtw.Status = *update.Value
+				r.updateStatusForGateway(ctx, gtw)
+			},
+		)
+		loggers.LoggerAPKOperator.Info("gateway status subscriber shutting down")
+	}()
+
+	// HTTPRoute object status updater
+	go func() {
+		message.HandleSubscription(
+			message.Metadata{Runner: "provider", Message: "httproute-status"},
+			r.resources.HTTPRouteStatuses.Subscribe(ctx),
+			func(update message.Update[types.NamespacedName, *gwapiv1.HTTPRouteStatus], errChan chan error) {
+				// skip delete updates.
+				if update.Delete {
+					return
+				}
+				key := update.Key
+				val := update.Value
+				r.statusUpdater.Send(status.Update{
+					NamespacedName: key,
+					Resource:       new(gwapiv1.HTTPRoute),
+					UpdateStatus: func(obj client.Object) client.Object {
+						h, ok := obj.(*gwapiv1.HTTPRoute)
+						if !ok {
+							err := fmt.Errorf("unsupported object type %T", obj)
+							errChan <- err
+							panic(err)
+						}
+						hCopy := h.DeepCopy()
+						hCopy.Status.Parents = val.Parents
+						return hCopy
+					},
+				})
+			},
+		)
+		loggers.LoggerAPKOperator.Info("HttpRoute status subscriber shutting down")
+	}()
+
+}
+
+func (r *gatewayReconcilerNew) updateStatusForGateway(ctx context.Context, gtw *gwapiv1.Gateway) {
+	// nil check for unit tests.
+	if r.statusUpdater == nil {
+		return
+	}
+
+	// Get deployment
+	deploy, err := r.envoyDeploymentForGateway(ctx, gtw)
+	if err != nil || deploy == nil {
+		loggers.LoggerAPKOperator.Infof("Failed to get Deployment for gateway %s/%s, %+v",
+			gtw.Namespace, gtw.Name, err)
+	}
+
+	// Get service
+	svc, err := r.envoyServiceForGateway(ctx, gtw)
+	if err != nil || svc == nil {
+		loggers.LoggerAPKOperator.Infof("Failed to get Service for gateway %s:%s, %+v",
+			gtw.Namespace, gtw.Name, err)
+	}
+	// update accepted condition
+	status.UpdateGatewayStatusAcceptedCondition(gtw, true)
+	// update address field and programmed condition
+	status.UpdateGatewayStatusProgrammedCondition(gtw, svc, deploy, r.store.listNodeAddresses()...)
+
+	key := utils.NamespacedName(gtw)
+
+	// publish status
+	r.statusUpdater.Send(status.Update{
+		NamespacedName: key,
+		Resource:       new(gwapiv1.Gateway),
+		UpdateStatus: func(obj client.Object) client.Object {
+			g, ok := obj.(*gwapiv1.Gateway)
+			if !ok {
+				panic(fmt.Sprintf("unsupported object type %T", obj))
+			}
+			gCopy := g.DeepCopy()
+			gCopy.Status.Conditions = gtw.Status.Conditions
+			gCopy.Status.Addresses = gtw.Status.Addresses
+			gCopy.Status.Listeners = gtw.Status.Listeners
+			return gCopy
+		},
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/store.go b/adapter/internal/operator/gateway-api/provider/kubernetes/store.go
new file mode 100644
index 000000000..ffc571852
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/store.go
@@ -0,0 +1,93 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"sync"
+
+	corev1 "k8s.io/api/core/v1"
+)
+
+type nodeDetails struct {
+	name    string
+	address string
+}
+
+// kubernetesProviderStore holds cached information for the kubernetes provider.
+type kubernetesProviderStore struct {
+	// nodes holds information required for updating Gateway status with the Node
+	// addresses, in case the Gateway is exposed on every Node of the cluster, using
+	// Service of type NodePort.
+	nodes map[string]nodeDetails
+	mu    sync.Mutex
+}
+
+func newProviderStore() *kubernetesProviderStore {
+	return &kubernetesProviderStore{
+		nodes: make(map[string]nodeDetails),
+	}
+}
+
+func (p *kubernetesProviderStore) addNode(n *corev1.Node) {
+	details := nodeDetails{name: n.Name}
+
+	var internalIP, externalIP string
+	for _, addr := range n.Status.Addresses {
+		if addr.Type == corev1.NodeExternalIP {
+			externalIP = addr.Address
+		}
+		if addr.Type == corev1.NodeInternalIP {
+			internalIP = addr.Address
+		}
+	}
+
+	// In certain scenarios (like in local KinD clusters), the Node
+	// externalIP is not provided, in that case we default back
+	// to the internalIP of the Node.
+	if externalIP != "" {
+		details.address = externalIP
+	} else if internalIP != "" {
+		details.address = internalIP
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.nodes[n.Name] = details
+}
+
+func (p *kubernetesProviderStore) removeNode(n *corev1.Node) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	delete(p.nodes, n.Name)
+}
+
+func (p *kubernetesProviderStore) listNodeAddresses() []string {
+	addrs := []string{}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	for _, n := range p.nodes {
+		if n.address != "" {
+			addrs = append(addrs, n.address)
+		}
+	}
+	return addrs
+}
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go b/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
new file mode 100644
index 000000000..3dea80e26
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/store_test.go
@@ -0,0 +1,111 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package kubernetes
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	corev1 "k8s.io/api/core/v1"
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func TestNodeDetailsAddressStore(t *testing.T) {
+	store := newProviderStore()
+	testCases := []struct {
+		name              string
+		nodeObject        *corev1.Node
+		expectedAddresses []string
+	}{
+		{
+			name: "No node addresses",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status:     corev1.NodeStatus{Addresses: []corev1.NodeAddress{{}}},
+			},
+			expectedAddresses: []string{},
+		},
+		{
+			name: "only external address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{{
+					Address: "1.1.1.1",
+					Type:    corev1.NodeExternalIP,
+				}}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+		{
+			name: "only internal address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{{
+					Address: "1.1.1.1",
+					Type:    corev1.NodeInternalIP,
+				}}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+		{
+			name: "prefer external address",
+			nodeObject: &corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status: corev1.NodeStatus{Addresses: []corev1.NodeAddress{
+					{
+						Address: "1.1.1.1",
+						Type:    corev1.NodeExternalIP,
+					},
+					{
+						Address: "2.2.2.2",
+						Type:    corev1.NodeInternalIP,
+					},
+				}},
+			},
+			expectedAddresses: []string{"1.1.1.1"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			store.addNode(tc.nodeObject)
+			assert.Equal(t, tc.expectedAddresses, store.listNodeAddresses())
+			store.removeNode(tc.nodeObject)
+		})
+	}
+}
+
+func TestRace(t *testing.T) {
+	s := newProviderStore()
+
+	go func() {
+		for {
+			s.addNode(&corev1.Node{
+				ObjectMeta: v1.ObjectMeta{Name: "node1"},
+				Status:     corev1.NodeStatus{Addresses: []corev1.NodeAddress{{}}},
+			})
+		}
+	}()
+
+	_ = s.listNodeAddresses()
+}
diff --git a/adapter/internal/operator/gateway-api/provider/scheme.go b/adapter/internal/operator/gateway-api/provider/scheme.go
new file mode 100644
index 000000000..ebbeb2631
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/provider/scheme.go
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package provider
+
+import (
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	"k8s.io/apimachinery/pkg/runtime"
+	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+var (
+	// scheme contains all the API types necessary for the provider's dynamic
+	// clients to work. Any new non-core types must be added here.
+	//
+	// NOTE: The discovery mechanism used by the client doesn't automatically
+	// refresh, so only add types here that are guaranteed to exist before the
+	// provider starts.
+	scheme = runtime.NewScheme()
+)
+
+func init() {
+	if err := clientgoscheme.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	// Add Gateway API types.
+	if err := gwapiv1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := gwapiv1b1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := gwapiv1a2.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := dpv1alpha1.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+	if err := dpv1alpha2.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
+}
+
+// GetScheme returns a scheme with types supported by the Kubernetes provider.
+func GetScheme() *runtime.Scheme {
+	return scheme
+}
diff --git a/adapter/internal/operator/gateway-api/resource.go b/adapter/internal/operator/gateway-api/resource.go
new file mode 100644
index 000000000..7e407b0d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/resource.go
@@ -0,0 +1,168 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"cmp"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	"golang.org/x/exp/slices"
+	v1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+type XdsIRMap map[string]*ir.Xds
+type InfraIRMap map[string]*ir.Infra
+
+// Resources holds the Gateway API and related
+// resources that the translators needs as inputs.
+// +k8s:deepcopy-gen=true
+type Resources struct {
+	// This field is only used for marshalling/unmarshalling purposes and is not used by
+	// the translator
+	GatewayClass        *gwapiv1.GatewayClass         `json:"gatewayClass,omitempty" yaml:"gatewayClass,omitempty"`
+	Gateways            []*gwapiv1.Gateway            `json:"gateways,omitempty" yaml:"gateways,omitempty"`
+	HTTPRoutes          []*gwapiv1.HTTPRoute          `json:"httpRoutes,omitempty" yaml:"httpRoutes,omitempty"`
+	GRPCRoutes          []*gwapiv1a2.GRPCRoute        `json:"grpcRoutes,omitempty" yaml:"grpcRoutes,omitempty"`
+	TLSRoutes           []*gwapiv1a2.TLSRoute         `json:"tlsRoutes,omitempty" yaml:"tlsRoutes,omitempty"`
+	TCPRoutes           []*gwapiv1a2.TCPRoute         `json:"tcpRoutes,omitempty" yaml:"tcpRoutes,omitempty"`
+	UDPRoutes           []*gwapiv1a2.UDPRoute         `json:"udpRoutes,omitempty" yaml:"udpRoutes,omitempty"`
+	ReferenceGrants     []*gwapiv1b1.ReferenceGrant   `json:"referenceGrants,omitempty" yaml:"referenceGrants,omitempty"`
+	Namespaces          []*v1.Namespace               `json:"namespaces,omitempty" yaml:"namespaces,omitempty"`
+	Services            []*v1.Service                 `json:"services,omitempty" yaml:"services,omitempty"`
+	Backends            []*dpv1alpha1.Backend         `json:"backends,omitempty" yaml:"backends,omitempty"`
+	EndpointSlices      []*discoveryv1.EndpointSlice  `json:"endpointSlices,omitempty" yaml:"endpointSlices,omitempty"`
+	Secrets             []*v1.Secret                  `json:"secrets,omitempty" yaml:"secrets,omitempty"`
+	ConfigMaps          []*v1.ConfigMap               `json:"configMaps,omitempty" yaml:"configMaps,omitempty"`
+	ExtensionRefFilters []unstructured.Unstructured   `json:"extensionRefFilters,omitempty" yaml:"extensionRefFilters,omitempty"`
+	BackendTLSPolicies  []*gwapiv1a2.BackendTLSPolicy `json:"backendTLSPolicies,omitempty" yaml:"backendTLSPolicies,omitempty"`
+}
+
+func NewResources() *Resources {
+	return &Resources{
+		Gateways:            []*gwapiv1.Gateway{},
+		HTTPRoutes:          []*gwapiv1.HTTPRoute{},
+		GRPCRoutes:          []*gwapiv1a2.GRPCRoute{},
+		TLSRoutes:           []*gwapiv1a2.TLSRoute{},
+		Services:            []*v1.Service{},
+		EndpointSlices:      []*discoveryv1.EndpointSlice{},
+		Secrets:             []*v1.Secret{},
+		ConfigMaps:          []*v1.ConfigMap{},
+		ReferenceGrants:     []*gwapiv1b1.ReferenceGrant{},
+		Namespaces:          []*v1.Namespace{},
+		ExtensionRefFilters: []unstructured.Unstructured{},
+		BackendTLSPolicies:  []*gwapiv1a2.BackendTLSPolicy{},
+	}
+}
+
+func (r *Resources) GetNamespace(name string) *v1.Namespace {
+	for _, ns := range r.Namespaces {
+		if ns.Name == name {
+			return ns
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetService(namespace, name string) *v1.Service {
+	for _, svc := range r.Services {
+		if svc.Namespace == namespace && svc.Name == name {
+			return svc
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetSecret(namespace, name string) *v1.Secret {
+	for _, secret := range r.Secrets {
+		if secret.Namespace == namespace && secret.Name == name {
+			return secret
+		}
+	}
+
+	return nil
+}
+
+func (r *Resources) GetConfigMap(namespace, name string) *v1.ConfigMap {
+	for _, configMap := range r.ConfigMaps {
+		if configMap.Namespace == namespace && configMap.Name == name {
+			return configMap
+		}
+	}
+
+	return nil
+}
+
+// ControllerResources holds all the GatewayAPI resources per GatewayClass
+type ControllerResources []*Resources
+
+// DeepCopy creates a new ControllerResources.
+// It is handwritten since the tooling was unable to copy into a new slice
+func (c *ControllerResources) DeepCopy() *ControllerResources {
+	if c == nil {
+		return nil
+	}
+	out := make(ControllerResources, len(*c))
+	copy(out, *c)
+	return &out
+}
+
+// Equal implements the Comparable interface used by watchable.DeepEqual to skip unnecessary updates.
+func (c *ControllerResources) Equal(y *ControllerResources) bool {
+	// Deep copy to avoid modifying the original ordering.
+	c = c.DeepCopy()
+	c.sort()
+	y = y.DeepCopy()
+	y.sort()
+	return reflect.DeepEqual(c, y)
+}
+
+func (c *ControllerResources) sort() {
+	slices.SortFunc(*c, func(c1, c2 *Resources) int {
+		return cmp.Compare(c1.GatewayClass.Name, c2.GatewayClass.Name)
+	})
+}
+
+func (r *Resources) GetEndpointSlicesForBackend(svcNamespace, svcName string, backendKind string) []*discoveryv1.EndpointSlice {
+	var endpointSlices []*discoveryv1.EndpointSlice
+	for _, endpointSlice := range r.EndpointSlices {
+		var backendSelectorLabel string
+		switch backendKind {
+		case KindService:
+			backendSelectorLabel = discoveryv1.LabelServiceName
+		}
+		if svcNamespace == endpointSlice.Namespace &&
+			endpointSlice.GetLabels()[backendSelectorLabel] == svcName {
+			endpointSlices = append(endpointSlices, endpointSlice)
+		}
+	}
+	return endpointSlices
+}
diff --git a/adapter/internal/operator/gateway-api/route.go b/adapter/internal/operator/gateway-api/route.go
new file mode 100644
index 000000000..2a12e3615
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/route.go
@@ -0,0 +1,1340 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/pkg/utils/regex"
+	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+)
+
+const (
+	// Following the description in `timeout` section of https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto
+	// Request timeout, which is defined as Duration, specifies the upstream timeout for the route
+	// If not specified, the default is 15s
+	HTTPRequestTimeout = "15s"
+)
+
+var (
+	_                RoutesTranslator = (*Translator)(nil)
+	validServiceName                  = `(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*`
+	validMethodName                   = `[A-Za-z_][A-Za-z_0-9]*`
+)
+
+type RoutesTranslator interface {
+	ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*HTTPRouteContext
+	ProcessGRPCRoutes(grpcRoutes []*gwapiv1a2.GRPCRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*GRPCRouteContext
+	ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TLSRouteContext
+	ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TCPRouteContext
+	ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*UDPRouteContext
+}
+
+func (t *Translator) ProcessHTTPRoutes(httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*HTTPRouteContext {
+	var relevantHTTPRoutes []*HTTPRouteContext
+
+	for _, h := range httpRoutes {
+		if h == nil {
+			panic("received nil httproute")
+		}
+		httpRoute := &HTTPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			HTTPRoute:             h.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(httpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantHTTPRoutes = append(relevantHTTPRoutes, httpRoute)
+
+		t.processHTTPRouteParentRefs(httpRoute, resources, xdsIR)
+	}
+
+	return relevantHTTPRoutes
+}
+
+func (t *Translator) ProcessGRPCRoutes(grpcRoutes []*gwapiv1a2.GRPCRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*GRPCRouteContext {
+	var relevantGRPCRoutes []*GRPCRouteContext
+
+	for _, g := range grpcRoutes {
+		if g == nil {
+			panic("received nil grpcroute")
+		}
+		grpcRoute := &GRPCRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			GRPCRoute:             g.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(grpcRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantGRPCRoutes = append(relevantGRPCRoutes, grpcRoute)
+
+		t.processGRPCRouteParentRefs(grpcRoute, resources, xdsIR)
+	}
+
+	return relevantGRPCRoutes
+}
+
+func (t *Translator) processHTTPRouteParentRefs(httpRoute *HTTPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range httpRoute.ParentRefs {
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		routeRoutes, err := t.processHTTPRouteRules(httpRoute, parentRef, resources)
+		if err != nil {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue, // TODO: better reason
+				status.Error2ConditionMsg(err),
+			)
+			continue
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(httpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(httpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(httpRoute, routeRoutes, parentRef, xdsIR)
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the HTTPRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.HTTPRoute != nil &&
+			len(parentRef.HTTPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+	}
+}
+
+func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRef *RouteParentContext, resources *Resources) ([]*ir.HTTPRoute, error) {
+	var routeRoutes []*ir.HTTPRoute
+
+	// compute matches, filters, backends
+	for ruleIdx, rule := range httpRoute.Spec.Rules {
+		httpFiltersContext := t.ProcessHTTPFilters(parentRef, httpRoute, rule.Filters, ruleIdx, resources)
+
+		// A rule is matched if any one of its matches
+		// is satisfied (i.e. a logical "OR"), so generate
+		// a unique Xds IR HTTPRoute per match.
+		ruleRoutes, err := t.processHTTPRouteRule(httpRoute, ruleIdx, httpFiltersContext, rule)
+		if err != nil {
+			return nil, err
+		}
+
+		dstAddrTypeMap := make(map[ir.DestinationAddressType]int)
+
+		for _, backendRef := range rule.BackendRefs {
+			backendRef := backendRef
+			ds, backendWeight := t.processDestination(backendRef, parentRef, httpRoute, resources)
+			if !t.EndpointRoutingDisabled && ds != nil && len(ds.Endpoints) > 0 && ds.AddressType != nil {
+				dstAddrTypeMap[*ds.AddressType]++
+			}
+
+			for _, route := range ruleRoutes {
+				// If the route already has a direct response or redirect configured, then it was from a filter so skip
+				// processing any destinations for this route.
+				if route.DirectResponse == nil && route.Redirect == nil {
+					if ds != nil && len(ds.Endpoints) > 0 {
+						if route.Destination == nil {
+							route.Destination = &ir.RouteDestination{
+								Name: irRouteDestinationName(httpRoute, ruleIdx),
+							}
+						}
+						route.Destination.Settings = append(route.Destination.Settings, ds)
+						route.BackendWeights.Valid += backendWeight
+					} else {
+						route.BackendWeights.Invalid += backendWeight
+					}
+				}
+			}
+		}
+
+		// TODO: support mixed endpointslice address type between backendRefs
+		if !t.EndpointRoutingDisabled && len(dstAddrTypeMap) > 1 {
+			parentRef.SetCondition(httpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1a2.RouteReasonResolvedRefs,
+				"Mixed endpointslice address type between backendRefs is not supported")
+		}
+
+		// If the route has no valid backends then just use a direct response and don't fuss with weighted responses
+		for _, ruleRoute := range ruleRoutes {
+			if ruleRoute.Destination == nil && ruleRoute.Redirect == nil {
+				ruleRoute.DirectResponse = &ir.DirectResponse{
+					StatusCode: 500,
+				}
+			}
+			ruleRoute.IsHTTP2 = false
+		}
+
+		// TODO handle:
+		//	- sum of weights for valid backend refs is 0
+		//	- etc.
+
+		routeRoutes = append(routeRoutes, ruleRoutes...)
+	}
+
+	return routeRoutes, nil
+}
+
+func processTimeout(irRoute *ir.HTTPRoute, rule gwapiv1.HTTPRouteRule) {
+	if rule.Timeouts != nil {
+		var rto *ir.Timeout
+
+		// Timeout is translated from multiple resources and may already be partially set
+		if irRoute.Timeout != nil {
+			rto = irRoute.Timeout.DeepCopy()
+		} else {
+			rto = &ir.Timeout{}
+		}
+
+		if rule.Timeouts.Request != nil {
+			d, err := time.ParseDuration(string(*rule.Timeouts.Request))
+			if err != nil {
+				d, _ = time.ParseDuration(HTTPRequestTimeout)
+			}
+			setRequestTimeout(rto, metav1.Duration{Duration: d})
+		}
+
+		// Also set the IR Route Timeout to the backend request timeout
+		// until we introduce retries, then set it to per try timeout
+		if rule.Timeouts.BackendRequest != nil {
+			d, err := time.ParseDuration(string(*rule.Timeouts.BackendRequest))
+			if err != nil {
+				d, _ = time.ParseDuration(HTTPRequestTimeout)
+			}
+			setRequestTimeout(rto, metav1.Duration{Duration: d})
+		}
+
+		irRoute.Timeout = rto
+	}
+}
+
+func setRequestTimeout(irTimeout *ir.Timeout, d metav1.Duration) {
+	switch {
+	case irTimeout == nil:
+		irTimeout = &ir.Timeout{
+			HTTP: &ir.HTTPTimeout{
+				RequestTimeout: ptr.To(d),
+			},
+		}
+	case irTimeout.HTTP == nil:
+		irTimeout.HTTP = &ir.HTTPTimeout{
+			RequestTimeout: ptr.To(d),
+		}
+	default:
+		irTimeout.HTTP.RequestTimeout = ptr.To(d)
+	}
+}
+
+func (t *Translator) processHTTPRouteRule(httpRoute *HTTPRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule gwapiv1.HTTPRouteRule) ([]*ir.HTTPRoute, error) {
+	var ruleRoutes []*ir.HTTPRoute
+
+	// If no matches are specified, the implementation MUST match every HTTP request.
+	if len(rule.Matches) == 0 {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(httpRoute, ruleIdx, -1),
+		}
+		processTimeout(irRoute, rule)
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	// A rule is matched if any one of its matches
+	// is satisfied (i.e. a logical "OR"), so generate
+	// a unique Xds IR HTTPRoute per match.
+	for matchIdx, match := range rule.Matches {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(httpRoute, ruleIdx, matchIdx),
+		}
+		processTimeout(irRoute, rule)
+
+		if match.Path != nil {
+			switch PathMatchTypeDerefOr(match.Path.Type, gwapiv1.PathMatchPathPrefix) {
+			case gwapiv1.PathMatchPathPrefix:
+				irRoute.PathMatch = &ir.StringMatch{
+					Prefix: match.Path.Value,
+				}
+			case gwapiv1.PathMatchExact:
+				irRoute.PathMatch = &ir.StringMatch{
+					Exact: match.Path.Value,
+				}
+			case gwapiv1.PathMatchRegularExpression:
+				if err := regex.Validate(*match.Path.Value); err != nil {
+					return nil, err
+				}
+				irRoute.PathMatch = &ir.StringMatch{
+					SafeRegex: match.Path.Value,
+				}
+			}
+		}
+		for _, headerMatch := range match.Headers {
+			switch HeaderMatchTypeDerefOr(headerMatch.Type, gwapiv1.HeaderMatchExact) {
+			case gwapiv1.HeaderMatchExact:
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:  string(headerMatch.Name),
+					Exact: ptr.To(headerMatch.Value),
+				})
+			case gwapiv1.HeaderMatchRegularExpression:
+				if err := regex.Validate(headerMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:      string(headerMatch.Name),
+					SafeRegex: ptr.To(headerMatch.Value),
+				})
+			}
+		}
+		for _, queryParamMatch := range match.QueryParams {
+			switch QueryParamMatchTypeDerefOr(queryParamMatch.Type, gwapiv1.QueryParamMatchExact) {
+			case gwapiv1.QueryParamMatchExact:
+				irRoute.QueryParamMatches = append(irRoute.QueryParamMatches, &ir.StringMatch{
+					Name:  string(queryParamMatch.Name),
+					Exact: ptr.To(queryParamMatch.Value),
+				})
+			case gwapiv1.QueryParamMatchRegularExpression:
+				if err := regex.Validate(queryParamMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.QueryParamMatches = append(irRoute.QueryParamMatches, &ir.StringMatch{
+					Name:      string(queryParamMatch.Name),
+					SafeRegex: ptr.To(queryParamMatch.Value),
+				})
+			}
+		}
+
+		if match.Method != nil {
+			irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+				Name:  ":method",
+				Exact: ptr.To(string(*match.Method)),
+			})
+		}
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	return ruleRoutes, nil
+}
+
+func applyHTTPFiltersContextToIRRoute(httpFiltersContext *HTTPFiltersContext, irRoute *ir.HTTPRoute) {
+	// Add the redirect filter or direct response that were created earlier to all the irRoutes
+	if httpFiltersContext.RedirectResponse != nil {
+		irRoute.Redirect = httpFiltersContext.RedirectResponse
+	}
+	if httpFiltersContext.DirectResponse != nil {
+		irRoute.DirectResponse = httpFiltersContext.DirectResponse
+	}
+	if httpFiltersContext.URLRewrite != nil {
+		irRoute.URLRewrite = httpFiltersContext.URLRewrite
+	}
+	if len(httpFiltersContext.AddRequestHeaders) > 0 {
+		irRoute.AddRequestHeaders = httpFiltersContext.AddRequestHeaders
+	}
+	if len(httpFiltersContext.RemoveRequestHeaders) > 0 {
+		irRoute.RemoveRequestHeaders = httpFiltersContext.RemoveRequestHeaders
+	}
+	if len(httpFiltersContext.AddResponseHeaders) > 0 {
+		irRoute.AddResponseHeaders = httpFiltersContext.AddResponseHeaders
+	}
+	if len(httpFiltersContext.RemoveResponseHeaders) > 0 {
+		irRoute.RemoveResponseHeaders = httpFiltersContext.RemoveResponseHeaders
+	}
+	if httpFiltersContext.Mirrors != nil {
+		irRoute.Mirrors = httpFiltersContext.Mirrors
+	}
+
+	if len(httpFiltersContext.ExtensionRefs) > 0 {
+		irRoute.ExtensionRefs = httpFiltersContext.ExtensionRefs
+	}
+
+}
+
+func (t *Translator) processGRPCRouteParentRefs(grpcRoute *GRPCRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range grpcRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		routeRoutes, err := t.processGRPCRouteRules(grpcRoute, parentRef, resources)
+		if err != nil {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue, // TODO: better reason
+				status.Error2ConditionMsg(err),
+			)
+			continue
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		if parentRef.HasCondition(grpcRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+		var hasHostnameIntersection = t.processHTTPRouteParentRefListener(grpcRoute, routeRoutes, parentRef, xdsIR)
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the GRPCRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.GRPCRoute != nil &&
+			len(parentRef.GRPCRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(grpcRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+	}
+}
+
+func (t *Translator) processGRPCRouteRules(grpcRoute *GRPCRouteContext, parentRef *RouteParentContext, resources *Resources) ([]*ir.HTTPRoute, error) {
+	var routeRoutes []*ir.HTTPRoute
+
+	// compute matches, filters, backends
+	for ruleIdx, rule := range grpcRoute.Spec.Rules {
+		httpFiltersContext := t.ProcessGRPCFilters(parentRef, grpcRoute, rule.Filters, resources)
+
+		// A rule is matched if any one of its matches
+		// is satisfied (i.e. a logical "OR"), so generate
+		// a unique Xds IR HTTPRoute per match.
+		ruleRoutes, err := t.processGRPCRouteRule(grpcRoute, ruleIdx, httpFiltersContext, rule)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, backendRef := range rule.BackendRefs {
+			backendRef := backendRef
+			ds, backendWeight := t.processDestination(backendRef, parentRef, grpcRoute, resources)
+			for _, route := range ruleRoutes {
+				// If the route already has a direct response or redirect configured, then it was from a filter so skip
+				// processing any destinations for this route.
+				if route.DirectResponse == nil && route.Redirect == nil {
+					if ds != nil && len(ds.Endpoints) > 0 {
+						if route.Destination == nil {
+							route.Destination = &ir.RouteDestination{
+								Name: irRouteDestinationName(grpcRoute, ruleIdx),
+							}
+						}
+						route.Destination.Settings = append(route.Destination.Settings, ds)
+						route.BackendWeights.Valid += backendWeight
+
+					} else {
+						route.BackendWeights.Invalid += backendWeight
+					}
+				}
+			}
+		}
+
+		// If the route has no valid backends then just use a direct response and don't fuss with weighted responses
+		for _, ruleRoute := range ruleRoutes {
+			if ruleRoute.Destination == nil && ruleRoute.Redirect == nil {
+				ruleRoute.DirectResponse = &ir.DirectResponse{
+					StatusCode: 500,
+				}
+			}
+			ruleRoute.IsHTTP2 = true
+		}
+
+		// TODO handle:
+		//	- sum of weights for valid backend refs is 0
+		//	- etc.
+
+		routeRoutes = append(routeRoutes, ruleRoutes...)
+	}
+
+	return routeRoutes, nil
+}
+
+func (t *Translator) processGRPCRouteRule(grpcRoute *GRPCRouteContext, ruleIdx int, httpFiltersContext *HTTPFiltersContext, rule gwapiv1a2.GRPCRouteRule) ([]*ir.HTTPRoute, error) {
+	var ruleRoutes []*ir.HTTPRoute
+
+	// If no matches are specified, the implementation MUST match every gRPC request.
+	if len(rule.Matches) == 0 {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(grpcRoute, ruleIdx, -1),
+		}
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+		ruleRoutes = append(ruleRoutes, irRoute)
+	}
+
+	// A rule is matched if any one of its matches
+	// is satisfied (i.e. a logical "OR"), so generate
+	// a unique Xds IR HTTPRoute per match.
+	for matchIdx, match := range rule.Matches {
+		irRoute := &ir.HTTPRoute{
+			Name: irRouteName(grpcRoute, ruleIdx, matchIdx),
+		}
+
+		for _, headerMatch := range match.Headers {
+			switch HeaderMatchTypeDerefOr(headerMatch.Type, gwapiv1.HeaderMatchExact) {
+			case gwapiv1.HeaderMatchExact:
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:  string(headerMatch.Name),
+					Exact: ptr.To(headerMatch.Value),
+				})
+			case gwapiv1.HeaderMatchRegularExpression:
+				if err := regex.Validate(headerMatch.Value); err != nil {
+					return nil, err
+				}
+				irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+					Name:      string(headerMatch.Name),
+					SafeRegex: ptr.To(headerMatch.Value),
+				})
+			}
+		}
+
+		if match.Method != nil {
+			// GRPC's path is in the form of "/<service>/<method>"
+			switch GRPCMethodMatchTypeDerefOr(match.Method.Type, gwapiv1a2.GRPCMethodMatchExact) {
+			case gwapiv1a2.GRPCMethodMatchExact:
+				t.processGRPCRouteMethodExact(match.Method, irRoute)
+			case gwapiv1a2.GRPCMethodMatchRegularExpression:
+				if match.Method.Service != nil {
+					if err := regex.Validate(*match.Method.Service); err != nil {
+						return nil, err
+					}
+				}
+				if match.Method.Method != nil {
+					if err := regex.Validate(*match.Method.Method); err != nil {
+						return nil, err
+					}
+				}
+				t.processGRPCRouteMethodRegularExpression(match.Method, irRoute)
+			}
+		}
+
+		ruleRoutes = append(ruleRoutes, irRoute)
+		applyHTTPFiltersContextToIRRoute(httpFiltersContext, irRoute)
+	}
+	return ruleRoutes, nil
+}
+
+func (t *Translator) processGRPCRouteMethodExact(method *gwapiv1a2.GRPCMethodMatch, irRoute *ir.HTTPRoute) {
+	switch {
+	case method.Service != nil && method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			Exact: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, *method.Method)),
+		}
+	case method.Method != nil:
+		// Use a header match since the PathMatch doesn't support Suffix matching
+		irRoute.HeaderMatches = append(irRoute.HeaderMatches, &ir.StringMatch{
+			Name:   ":path",
+			Suffix: ptr.To(fmt.Sprintf("/%s", *method.Method)),
+		})
+	case method.Service != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			Prefix: ptr.To(fmt.Sprintf("/%s", *method.Service)),
+		}
+	}
+}
+
+func (t *Translator) processGRPCRouteMethodRegularExpression(method *gwapiv1a2.GRPCMethodMatch, irRoute *ir.HTTPRoute) {
+	switch {
+	case method.Service != nil && method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, *method.Method)),
+		}
+	case method.Method != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", validServiceName, *method.Method)),
+		}
+	case method.Service != nil:
+		irRoute.PathMatch = &ir.StringMatch{
+			SafeRegex: ptr.To(fmt.Sprintf("/%s/%s", *method.Service, validMethodName)),
+		}
+	}
+}
+
+func (t *Translator) processHTTPRouteParentRefListener(route RouteContext, routeRoutes []*ir.HTTPRoute, parentRef *RouteParentContext, xdsIR XdsIRMap) bool {
+	var hasHostnameIntersection bool
+
+	for _, listener := range parentRef.listeners {
+		hosts := computeHosts(GetHostnames(route), listener.Hostname)
+		if len(hosts) == 0 {
+			continue
+		}
+		hasHostnameIntersection = true
+
+		var perHostRoutes []*ir.HTTPRoute
+		for _, host := range hosts {
+			for _, routeRoute := range routeRoutes {
+				// If the redirect port is not set, the final redirect port must be derived.
+				if routeRoute.Redirect != nil && routeRoute.Redirect.Port == nil {
+					redirectPort := uint32(listener.Port)
+					// If redirect scheme is not-empty, the redirect post must be the
+					// well-known port associated with the redirect scheme.
+					if scheme := routeRoute.Redirect.Scheme; scheme != nil {
+						switch strings.ToLower(*scheme) {
+						case "http":
+							redirectPort = 80
+						case "https":
+							redirectPort = 443
+						}
+					}
+					// If the redirect scheme does not have a well-known port, or
+					// if the redirect scheme is empty, the redirect port must be the Gateway Listener port.
+					routeRoute.Redirect.Port = &redirectPort
+				}
+				// Remove dots from the hostname before appending it to the IR Route name
+				// since dots are special chars used in stats tag extraction in Envoy
+				underscoredHost := strings.ReplaceAll(host, ".", "_")
+				hostRoute := &ir.HTTPRoute{
+					Name:                  fmt.Sprintf("%s/%s", routeRoute.Name, underscoredHost),
+					Hostname:              host,
+					PathMatch:             routeRoute.PathMatch,
+					HeaderMatches:         routeRoute.HeaderMatches,
+					QueryParamMatches:     routeRoute.QueryParamMatches,
+					AddRequestHeaders:     routeRoute.AddRequestHeaders,
+					RemoveRequestHeaders:  routeRoute.RemoveRequestHeaders,
+					AddResponseHeaders:    routeRoute.AddResponseHeaders,
+					RemoveResponseHeaders: routeRoute.RemoveResponseHeaders,
+					Destination:           routeRoute.Destination,
+					Redirect:              routeRoute.Redirect,
+					DirectResponse:        routeRoute.DirectResponse,
+					URLRewrite:            routeRoute.URLRewrite,
+					Mirrors:               routeRoute.Mirrors,
+					ExtensionRefs:         routeRoute.ExtensionRefs,
+					Timeout:               routeRoute.Timeout,
+					Retry:                 routeRoute.Retry,
+					IsHTTP2:               routeRoute.IsHTTP2,
+				}
+				// Don't bother copying over the weights unless the route has invalid backends.
+				if routeRoute.BackendWeights.Invalid > 0 {
+					hostRoute.BackendWeights = routeRoute.BackendWeights
+				}
+				perHostRoutes = append(perHostRoutes, hostRoute)
+			}
+		}
+		irKey := t.getIRKey(listener.gateway)
+		irListener := xdsIR[irKey].GetHTTPListener(irHTTPListenerName(listener))
+		if irListener != nil {
+			if GetRouteType(route) == KindGRPCRoute {
+				irListener.IsHTTP2 = true
+			}
+			irListener.Routes = append(irListener.Routes, perHostRoutes...)
+		}
+	}
+
+	return hasHostnameIntersection
+}
+
+func (t *Translator) ProcessTLSRoutes(tlsRoutes []*gwapiv1a2.TLSRoute, gateways []*GatewayContext, resources *Resources, xdsIR XdsIRMap) []*TLSRouteContext {
+	var relevantTLSRoutes []*TLSRouteContext
+
+	for _, tls := range tlsRoutes {
+		if tls == nil {
+			panic("received nil tlsroute")
+		}
+		tlsRoute := &TLSRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			TLSRoute:              tls.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(tlsRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantTLSRoutes = append(relevantTLSRoutes, tlsRoute)
+
+		t.processTLSRouteParentRefs(tlsRoute, resources, xdsIR)
+	}
+
+	return relevantTLSRoutes
+}
+
+func (t *Translator) processTLSRouteParentRefs(tlsRoute *TLSRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range tlsRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		for _, rule := range tlsRoute.Spec.Rules {
+			for _, backendRef := range rule.BackendRefs {
+				backendRef := backendRef
+				ds, _ := t.processDestination(backendRef, parentRef, tlsRoute, resources)
+				if ds != nil {
+					destSettings = append(destSettings, ds)
+				}
+			}
+
+			// TODO handle:
+			//	- no valid backend refs
+			//	- sum of weights for valid backend refs is 0
+			//	- returning 500's for invalid backend refs
+			//	- etc.
+		}
+
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(tlsRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(tlsRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		var hasHostnameIntersection bool
+		for _, listener := range parentRef.listeners {
+			hosts := computeHosts(GetHostnames(tlsRoute), listener.Hostname)
+			if len(hosts) == 0 {
+				continue
+			}
+
+			hasHostnameIntersection = true
+
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the TCP Listener while parsing the TLSRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.TCPListener{
+				Name:    irTLSListenerName(listener, tlsRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				TLS: &ir.TLS{Passthrough: &ir.TLSInspectorConfig{
+					SNIs: hosts,
+				}},
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(tlsRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.TCP = append(gwXdsIR.TCP, irListener)
+
+		}
+
+		if !hasHostnameIntersection {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingListenerHostname,
+				"There were no hostname intersections between the HTTPRoute and this parent ref's Listener(s).",
+			)
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if parentRef.TLSRoute != nil &&
+			len(parentRef.TLSRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(tlsRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+	}
+}
+
+func (t *Translator) ProcessUDPRoutes(udpRoutes []*gwapiv1a2.UDPRoute, gateways []*GatewayContext, resources *Resources,
+	xdsIR XdsIRMap) []*UDPRouteContext {
+	var relevantUDPRoutes []*UDPRouteContext
+
+	for _, u := range udpRoutes {
+		if u == nil {
+			panic("received nil udproute")
+		}
+		udpRoute := &UDPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			UDPRoute:              u.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(udpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantUDPRoutes = append(relevantUDPRoutes, udpRoute)
+
+		t.processUDPRouteParentRefs(udpRoute, resources, xdsIR)
+	}
+
+	return relevantUDPRoutes
+}
+
+func (t *Translator) processUDPRouteParentRefs(udpRoute *UDPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range udpRoute.ParentRefs {
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		if len(udpRoute.Spec.Rules) != 1 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidRule",
+				"One and only one rule is supported",
+			)
+			continue
+		}
+		if len(udpRoute.Spec.Rules[0].BackendRefs) != 1 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidBackend",
+				"One and only one backend is supported",
+			)
+			continue
+		}
+
+		backendRef := udpRoute.Spec.Rules[0].BackendRefs[0]
+		ds, _ := t.processDestination(backendRef, parentRef, udpRoute, resources)
+		// Skip further processing if route destination is not valid
+		if ds == nil || len(ds.Endpoints) == 0 {
+			continue
+		}
+
+		destSettings = append(destSettings, ds)
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(udpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(udpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		accepted := false
+		for _, listener := range parentRef.listeners {
+			// only one route is allowed for a UDP listener
+			if listener.AttachedRoutes() > 1 {
+				continue
+			}
+			if !listener.IsReady() {
+				continue
+			}
+			accepted = true
+
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the UDP Listener while parsing the UDPRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.UDPListener{
+				Name:    irUDPListenerName(listener, udpRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(udpRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.UDP = append(gwXdsIR.UDP, irListener)
+
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if accepted && parentRef.UDPRoute != nil &&
+			len(parentRef.UDPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+
+		if !accepted {
+			parentRef.SetCondition(udpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				"Multiple routes on the same UDP listener",
+			)
+		}
+	}
+}
+
+func (t *Translator) ProcessTCPRoutes(tcpRoutes []*gwapiv1a2.TCPRoute, gateways []*GatewayContext, resources *Resources,
+	xdsIR XdsIRMap) []*TCPRouteContext {
+	var relevantTCPRoutes []*TCPRouteContext
+
+	for _, tcp := range tcpRoutes {
+		if tcp == nil {
+			panic("received nil tcproute")
+		}
+		tcpRoute := &TCPRouteContext{
+			GatewayControllerName: t.GatewayControllerName,
+			TCPRoute:              tcp.DeepCopy(),
+		}
+
+		// Find out if this route attaches to one of our Gateway's listeners,
+		// and if so, get the list of listeners that allow it to attach for each
+		// parentRef.
+		relevantRoute := t.processAllowedListenersForParentRefs(tcpRoute, gateways, resources)
+		if !relevantRoute {
+			continue
+		}
+
+		relevantTCPRoutes = append(relevantTCPRoutes, tcpRoute)
+
+		t.processTCPRouteParentRefs(tcpRoute, resources, xdsIR)
+	}
+
+	return relevantTCPRoutes
+}
+
+func (t *Translator) processTCPRouteParentRefs(tcpRoute *TCPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, parentRef := range tcpRoute.ParentRefs {
+
+		// Need to compute Route rules within the parentRef loop because
+		// any conditions that come out of it have to go on each RouteParentStatus,
+		// not on the Route as a whole.
+		var destSettings []*ir.DestinationSetting
+
+		// compute backends
+		if len(tcpRoute.Spec.Rules) != 1 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidRule",
+				"One and only one rule is supported",
+			)
+			continue
+		}
+		if len(tcpRoute.Spec.Rules[0].BackendRefs) != 1 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				"InvalidBackend",
+				"One and only one backend is supported",
+			)
+			continue
+		}
+
+		backendRef := tcpRoute.Spec.Rules[0].BackendRefs[0]
+		ds, _ := t.processDestination(backendRef, parentRef, tcpRoute, resources)
+		// Skip further processing if route destination is not valid
+		if ds == nil || len(ds.Endpoints) == 0 {
+			continue
+		}
+		destSettings = append(destSettings, ds)
+		// If no negative condition has been set for ResolvedRefs, set "ResolvedRefs=True"
+		if !parentRef.HasCondition(tcpRoute, gwapiv1.RouteConditionResolvedRefs, metav1.ConditionFalse) {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonResolvedRefs,
+				"Resolved all the Object references for the Route",
+			)
+		}
+
+		// Skip parent refs that did not accept the route
+		if parentRef.HasCondition(tcpRoute, gwapiv1.RouteConditionAccepted, metav1.ConditionFalse) {
+			continue
+		}
+
+		accepted := false
+		for _, listener := range parentRef.listeners {
+			// only one route is allowed for a TCP listener
+			if listener.AttachedRoutes() > 1 {
+				continue
+			}
+			if !listener.IsReady() {
+				continue
+			}
+			accepted = true
+			irKey := t.getIRKey(listener.gateway)
+
+			containerPort := servicePortToContainerPort(int32(listener.Port))
+			// Create the TCP Listener while parsing the TCPRoute since
+			// the listener directly links to a routeDestination.
+			irListener := &ir.TCPListener{
+				Name:    irTCPListenerName(listener, tcpRoute),
+				Address: "0.0.0.0",
+				Port:    uint32(containerPort),
+				Destination: &ir.RouteDestination{
+					Name:     irRouteDestinationName(tcpRoute, -1 /*rule index*/),
+					Settings: destSettings,
+				},
+				TLS: &ir.TLS{Terminate: irTLSConfigs(listener.tlsSecrets)},
+			}
+			gwXdsIR := xdsIR[irKey]
+			gwXdsIR.TCP = append(gwXdsIR.TCP, irListener)
+
+		}
+
+		// If no negative conditions have been set, the route is considered "Accepted=True".
+		if accepted && parentRef.TCPRoute != nil &&
+			len(parentRef.TCPRoute.Status.Parents[parentRef.routeParentStatusIdx].Conditions) == 0 {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionTrue,
+				gwapiv1.RouteReasonAccepted,
+				"Route is accepted",
+			)
+		}
+		if !accepted {
+			parentRef.SetCondition(tcpRoute,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonUnsupportedValue,
+				"Multiple routes on the same TCP listener",
+			)
+		}
+
+	}
+}
+
+// processDestination takes a backendRef and translates it into destination setting or sets error statuses and
+// returns the weight for the backend so that 500 error responses can be returned for invalid backends in
+// the same proportion as the backend would have otherwise received
+func (t *Translator) processDestination(backendRefContext BackendRefContext,
+	parentRef *RouteParentContext,
+	route RouteContext,
+	resources *Resources) (ds *ir.DestinationSetting, backendWeight uint32) {
+	routeType := GetRouteType(route)
+	weight := uint32(1)
+	backendRef := GetBackendRef(backendRefContext)
+	if backendRef.Weight != nil {
+		weight = uint32(*backendRef.Weight)
+	}
+
+	backendNamespace := NamespaceDerefOr(backendRef.Namespace, route.GetNamespace())
+	if !t.validateBackendRef(backendRefContext, parentRef, route, resources, backendNamespace, routeType) {
+		return nil, weight
+	}
+
+	// Skip processing backends with 0 weight
+	if weight == 0 {
+		return nil, weight
+	}
+
+	var (
+		endpoints []*ir.DestinationEndpoint
+		addrType  *ir.DestinationAddressType
+	)
+	protocol := inspectAppProtocolByRouteKind(routeType)
+	var backendTLS *ir.TLSUpstreamConfig
+	switch KindDerefOr(backendRef.Kind, KindService) {
+	case KindService:
+		service := resources.GetService(backendNamespace, string(backendRef.Name))
+		var servicePort corev1.ServicePort
+		for _, port := range service.Spec.Ports {
+			if port.Port == int32(*backendRef.Port) {
+				servicePort = port
+				break
+			}
+		}
+
+		// support HTTPRouteBackendProtocolH2C
+		if servicePort.AppProtocol != nil &&
+			*servicePort.AppProtocol == "kubernetes.io/h2c" {
+			protocol = ir.HTTP2
+		}
+
+		// Route to endpoints by default
+		if !t.EndpointRoutingDisabled {
+			endpointSlices := resources.GetEndpointSlicesForBackend(backendNamespace, string(backendRef.Name), KindDerefOr(backendRef.Kind, KindService))
+			endpoints, addrType = getIREndpointsFromEndpointSlices(endpointSlices, servicePort.Name, servicePort.Protocol)
+		} else {
+			// Fall back to Service ClusterIP routing
+			ep := ir.NewDestEndpoint(
+				service.Spec.ClusterIP,
+				uint32(*backendRef.Port))
+			endpoints = append(endpoints, ep)
+		}
+	}
+
+	// TODO: support mixed endpointslice address type for the same backendRef
+	if !t.EndpointRoutingDisabled && addrType != nil && *addrType == ir.MIXED {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1a2.RouteReasonResolvedRefs,
+			"Mixed endpointslice address type for the same backendRef is not supported")
+	}
+
+	ds = &ir.DestinationSetting{
+		Weight:      &weight,
+		Protocol:    protocol,
+		Endpoints:   endpoints,
+		AddressType: addrType,
+		TLS:         backendTLS,
+	}
+	return ds, weight
+}
+
+func inspectAppProtocolByRouteKind(kind gwapiv1.Kind) ir.AppProtocol {
+	switch kind {
+	case KindUDPRoute:
+		return ir.UDP
+	case KindHTTPRoute:
+		return ir.HTTP
+	case KindTCPRoute:
+		return ir.TCP
+	case KindGRPCRoute:
+		return ir.GRPC
+	case KindTLSRoute:
+		return ir.HTTPS
+	}
+	return ir.TCP
+}
+
+// processAllowedListenersForParentRefs finds out if the route attaches to one of our
+// Gateways' listeners, and if so, gets the list of listeners that allow it to
+// attach for each parentRef.
+func (t *Translator) processAllowedListenersForParentRefs(routeContext RouteContext, gateways []*GatewayContext, resources *Resources) bool {
+	var relevantRoute bool
+
+	for _, parentRef := range GetParentReferences(routeContext) {
+		isRelevantParentRef, selectedListeners := GetReferencedListeners(parentRef, gateways)
+
+		// Parent ref is not to a Gateway that we control: skip it
+		if !isRelevantParentRef {
+			continue
+		}
+		relevantRoute = true
+
+		parentRefCtx := GetRouteParentContext(routeContext, parentRef)
+		// Reset conditions since they will be recomputed during translation
+		parentRefCtx.ResetConditions(routeContext)
+
+		if len(selectedListeners) == 0 {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNoMatchingParent,
+				"No listeners match this parent ref",
+			)
+			continue
+		}
+
+		var allowedListeners []*ListenerContext
+		for _, listener := range selectedListeners {
+			acceptedKind := GetRouteType(routeContext)
+			if listener.AllowsKind(gwapiv1.RouteGroupKind{Group: GroupPtr(gwapiv1.GroupName), Kind: acceptedKind}) &&
+				listener.AllowsNamespace(resources.GetNamespace(routeContext.GetNamespace())) {
+				allowedListeners = append(allowedListeners, listener)
+			}
+		}
+
+		if len(allowedListeners) == 0 {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonNotAllowedByListeners,
+				"No listeners included by this parent ref allowed this attachment.",
+			)
+			continue
+		}
+
+		// Its safe to increment AttachedRoutes since we've found a valid parentRef
+		// and the listener allows this Route kind
+
+		// Theoretically there should only be one parent ref per
+		// Route that attaches to a given Listener, so fine to just increment here, but we
+		// might want to check to ensure we're not double-counting.
+		for _, listener := range allowedListeners {
+			listener.IncrementAttachedRoutes()
+		}
+
+		if !HasReadyListener(selectedListeners) {
+			parentRefCtx.SetCondition(routeContext,
+				gwapiv1.RouteConditionAccepted,
+				metav1.ConditionFalse,
+				"NoReadyListeners",
+				"There are no ready listeners for this parent ref",
+			)
+			continue
+		}
+
+		parentRefCtx.SetListeners(allowedListeners...)
+
+		parentRefCtx.SetCondition(routeContext,
+			gwapiv1.RouteConditionAccepted,
+			metav1.ConditionTrue,
+			gwapiv1.RouteReasonAccepted,
+			"Route is accepted",
+		)
+	}
+	return relevantRoute
+}
+
+func getIREndpointsFromEndpointSlices(endpointSlices []*discoveryv1.EndpointSlice, portName string, portProtocol corev1.Protocol) ([]*ir.DestinationEndpoint, *ir.DestinationAddressType) {
+	var (
+		dstEndpoints []*ir.DestinationEndpoint
+		dstAddrType  *ir.DestinationAddressType
+	)
+
+	addrTypeMap := make(map[ir.DestinationAddressType]int)
+	for _, endpointSlice := range endpointSlices {
+		if endpointSlice.AddressType == discoveryv1.AddressTypeFQDN {
+			addrTypeMap[ir.FQDN]++
+		} else {
+			addrTypeMap[ir.IP]++
+		}
+		endpoints := getIREndpointsFromEndpointSlice(endpointSlice, portName, portProtocol)
+		dstEndpoints = append(dstEndpoints, endpoints...)
+	}
+
+	for addrTypeState, addrTypeCounts := range addrTypeMap {
+		if addrTypeCounts == len(endpointSlices) {
+			dstAddrType = ptr.To(addrTypeState)
+			break
+		}
+	}
+
+	if len(addrTypeMap) > 0 && dstAddrType == nil {
+		dstAddrType = ptr.To(ir.MIXED)
+	}
+
+	return dstEndpoints, dstAddrType
+}
+
+func getIREndpointsFromEndpointSlice(endpointSlice *discoveryv1.EndpointSlice, portName string, portProtocol corev1.Protocol) []*ir.DestinationEndpoint {
+	var endpoints []*ir.DestinationEndpoint
+	for _, endpoint := range endpointSlice.Endpoints {
+		for _, endpointPort := range endpointSlice.Ports {
+			// Check if the endpoint port matches the service port
+			// and if endpoint is Ready
+			if *endpointPort.Name == portName &&
+				*endpointPort.Protocol == portProtocol &&
+				// Unknown state (nil) should be interpreted as Ready, see https://pkg.go.dev/k8s.io/api/discovery/v1#EndpointConditions
+				(endpoint.Conditions.Ready == nil || *endpoint.Conditions.Ready) {
+				for _, address := range endpoint.Addresses {
+					ep := ir.NewDestEndpoint(
+						address,
+						uint32(*endpointPort.Port))
+					endpoints = append(endpoints, ep)
+				}
+			}
+		}
+	}
+
+	return endpoints
+}
+
+func GetTargetBackendReference(backendRef gwapiv1a2.BackendObjectReference, namespace string) gwapiv1a2.PolicyTargetReferenceWithSectionName {
+	ref := gwapiv1a2.PolicyTargetReferenceWithSectionName{
+		PolicyTargetReference: gwapiv1a2.PolicyTargetReference{
+			Group: func() gwapiv1a2.Group {
+				if backendRef.Group == nil {
+					return ""
+				}
+				return *backendRef.Group
+			}(),
+			Kind: func() gwapiv1.Kind {
+				if backendRef.Kind == nil {
+					return "Service"
+				}
+				return *backendRef.Kind
+			}(),
+			Name:      backendRef.Name,
+			Namespace: NamespacePtr(NamespaceDerefOr(backendRef.Namespace, namespace)),
+		},
+		SectionName: func() *gwapiv1.SectionName {
+			if backendRef.Port != nil {
+				return SectionNamePtr(strconv.Itoa(int(*backendRef.Port)))
+			}
+			return nil
+		}(),
+	}
+	return ref
+}
diff --git a/adapter/internal/operator/gateway-api/secrets.go b/adapter/internal/operator/gateway-api/secrets.go
new file mode 100644
index 000000000..46b8a6e7f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/secrets.go
@@ -0,0 +1,153 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/crypto"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	corev1 "k8s.io/api/core/v1"
+	kerrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+var (
+	ErrSecretExists = errors.New("skipped creating secret since it already exists")
+)
+
+// caCertificateKey is the key name for accessing TLS CA certificate bundles
+// in Kubernetes Secrets.
+const (
+	caCertificateKey = "ca.crt"
+	hmacSecretKey    = "hmac-secret"
+)
+
+func newSecret(secretType corev1.SecretType, name string, namespace string, data map[string][]byte) corev1.Secret {
+	return corev1.Secret{
+		Type: secretType,
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "Secret",
+			APIVersion: "v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: namespace,
+			Labels: map[string]string{
+				"control-plane": "envoy-gateway",
+			},
+		},
+		Data: data,
+	}
+}
+
+// CertsToSecret creates secrets in the provided namespace, in compact form, from the provided certs.
+func CertsToSecret(namespace string, certs *crypto.Certificates) []corev1.Secret {
+	return []corev1.Secret{
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy-gateway",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyGatewayCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyGatewayPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeTLS,
+			"envoy-rate-limit",
+			namespace,
+			map[string][]byte{
+				caCertificateKey:        certs.CACertificate,
+				corev1.TLSCertKey:       certs.EnvoyRateLimitCertificate,
+				corev1.TLSPrivateKeyKey: certs.EnvoyRateLimitPrivateKey,
+			}),
+		newSecret(
+			corev1.SecretTypeOpaque,
+			"envoy-oidc-hmac",
+			namespace,
+			map[string][]byte{
+				hmacSecretKey: certs.OIDCHMACSecret,
+			}),
+	}
+}
+
+// CreateOrUpdateSecrets creates the provided secrets if they don't exist or updates
+// them if they do.
+func CreateOrUpdateSecrets(ctx context.Context, client client.Client, secrets []corev1.Secret, update bool) ([]corev1.Secret, error) {
+	var (
+		tidySecrets     []corev1.Secret
+		existingSecrets []string
+	)
+
+	for secret := range secrets {
+		secret := secrets[secret]
+		current := new(corev1.Secret)
+		key := utils.NamespacedName(&secret)
+		if err := client.Get(ctx, key, current); err != nil {
+			// Create if not found.
+			if kerrors.IsNotFound(err) {
+				if err := client.Create(ctx, &secret); err != nil {
+					return nil, fmt.Errorf("failed to create secret %s/%s: %w", secret.Namespace, secret.Name, err)
+				}
+			} else {
+				return nil, fmt.Errorf("failed to get secret %s/%s: %w", secret.Namespace, secret.Name, err)
+			}
+			// Update if current value is different and update arg is set.
+		} else {
+			if !update {
+				existingSecrets = append(existingSecrets, fmt.Sprintf("%s/%s", secret.Namespace, secret.Name))
+				continue
+			}
+			fmt.Println()
+
+			if !reflect.DeepEqual(secret.Data, current.Data) {
+				if err := client.Update(ctx, &secret); err != nil {
+					return nil, fmt.Errorf("failed to update secret %s/%s: %w", secret.Namespace, secret.Name, err)
+				}
+			}
+		}
+		tidySecrets = append(tidySecrets, secret)
+	}
+
+	if len(existingSecrets) > 0 {
+		return tidySecrets, fmt.Errorf("%v: %w;"+
+			"Either update the secrets manually or set overwriteControlPlaneCerts "+
+			"in the EnvoyGateway config", existingSecrets, ErrSecretExists)
+	}
+
+	return tidySecrets, nil
+}
diff --git a/adapter/internal/operator/gateway-api/secrets_test.go b/adapter/internal/operator/gateway-api/secrets_test.go
new file mode 100644
index 000000000..6715eae4b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/secrets_test.go
@@ -0,0 +1,114 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	fakeclient "sigs.k8s.io/controller-runtime/pkg/client/fake"
+)
+
+var (
+	envoyGatewaySecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-gateway",
+			Namespace: "apk",
+		},
+	}
+
+	envoySecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy",
+			Namespace: "apk",
+		},
+	}
+
+	envoyRateLimitSecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-rate-limit",
+			Namespace: "apk",
+		},
+	}
+
+	oidcHMACSecret = corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      "envoy-oidc-hmac",
+			Namespace: "apk",
+		},
+	}
+
+	existingSecretsWithoutHMAC = []client.Object{
+		&envoyGatewaySecret,
+		&envoySecret,
+		&envoyRateLimitSecret,
+	}
+
+	existingSecretsWithHMAC = []client.Object{
+		&envoyGatewaySecret,
+		&envoySecret,
+		&envoyRateLimitSecret,
+		&oidcHMACSecret,
+	}
+
+	SecretsToCreate = []corev1.Secret{
+		envoyGatewaySecret,
+		envoySecret,
+		envoyRateLimitSecret,
+		oidcHMACSecret,
+	}
+)
+
+func TestCreateSecretsWhenUpgrade(t *testing.T) {
+	t.Run("create HMAC secret when it does not exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithoutHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, false)
+		require.ErrorIs(t, err, ErrSecretExists)
+		require.Len(t, created, 1)
+		require.Equal(t, "envoy-oidc-hmac", created[0].Name)
+
+		err = cli.Get(context.Background(), client.ObjectKeyFromObject(&oidcHMACSecret), &corev1.Secret{})
+		require.NoError(t, err)
+	})
+
+	t.Run("skip HMAC secret when it exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, false)
+		require.ErrorIs(t, err, ErrSecretExists)
+		require.Emptyf(t, created, "expected no secrets to be created, got %v", created)
+	})
+
+	t.Run("update secrets when they exist", func(t *testing.T) {
+		cli := fakeclient.NewClientBuilder().WithObjects(existingSecretsWithHMAC...).Build()
+
+		created, err := CreateOrUpdateSecrets(context.Background(), cli, SecretsToCreate, true)
+		require.NoError(t, err)
+		require.Len(t, created, 4)
+	})
+}
diff --git a/adapter/internal/operator/gateway-api/sort.go b/adapter/internal/operator/gateway-api/sort.go
new file mode 100644
index 000000000..eef7d3648
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/sort.go
@@ -0,0 +1,124 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"sort"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+type XdsIRRoutes []*ir.HTTPRoute
+
+func (x XdsIRRoutes) Len() int      { return len(x) }
+func (x XdsIRRoutes) Swap(i, j int) { x[i], x[j] = x[j], x[i] }
+func (x XdsIRRoutes) Less(i, j int) bool {
+
+	// 1. Sort based on path match type
+	// Exact > RegularExpression > PathPrefix
+	if x[i].PathMatch != nil && x[i].PathMatch.Exact != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.SafeRegex != nil {
+				return false
+			}
+			if x[j].PathMatch.Prefix != nil {
+				return false
+			}
+		}
+	}
+	if x[i].PathMatch != nil && x[i].PathMatch.SafeRegex != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.Exact != nil {
+				return true
+			}
+			if x[j].PathMatch.Prefix != nil {
+				return false
+			}
+		}
+	}
+	if x[i].PathMatch != nil && x[i].PathMatch.Prefix != nil {
+		if x[j].PathMatch != nil {
+			if x[j].PathMatch.Exact != nil {
+				return true
+			}
+			if x[j].PathMatch.SafeRegex != nil {
+				return true
+			}
+		}
+	}
+	// Equal case
+
+	// 2. Sort based on characters in a matching path.
+	pCountI := pathMatchCount(x[i].PathMatch)
+	pCountJ := pathMatchCount(x[j].PathMatch)
+	if pCountI < pCountJ {
+		return true
+	}
+	if pCountI > pCountJ {
+		return false
+	}
+	// Equal case
+
+	// 3. Sort based on the number of Header matches.
+	hCountI := len(x[i].HeaderMatches)
+	hCountJ := len(x[j].HeaderMatches)
+	if hCountI < hCountJ {
+		return true
+	}
+	if hCountI > hCountJ {
+		return false
+	}
+	// Equal case
+
+	// 4. Sort based on the number of Query param matches.
+	qCountI := len(x[i].QueryParamMatches)
+	qCountJ := len(x[j].QueryParamMatches)
+	return qCountI < qCountJ
+}
+
+// sortXdsIR sorts the xdsIR based on the match precedence
+// defined in the Gateway API spec.
+// https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1.HTTPRouteRule
+func sortXdsIRMap(xdsIR XdsIRMap) {
+	for _, irItem := range xdsIR {
+		for _, http := range irItem.HTTP {
+			// descending order
+			sort.Sort(sort.Reverse(XdsIRRoutes(http.Routes)))
+		}
+	}
+}
+
+func pathMatchCount(pathMatch *ir.StringMatch) int {
+	if pathMatch != nil {
+		if pathMatch.Exact != nil {
+			return len(*pathMatch.Exact)
+		}
+		if pathMatch.SafeRegex != nil {
+			return len(*pathMatch.SafeRegex)
+		}
+		if pathMatch.Prefix != nil {
+			return len(*pathMatch.Prefix)
+		}
+	}
+	return 0
+}
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
new file mode 100644
index 000000000..391eeb060
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.in.yaml
@@ -0,0 +1,137 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: policies
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: policies
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
new file mode 100644
index 000000000..bda2c196a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-ca-only.out.yaml
@@ -0,0 +1,169 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/policies-ca
+              sni: example.com
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
new file mode 100644
index 000000000..f935b78dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.in.yaml
@@ -0,0 +1,137 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: default
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: default
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: default
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
new file mode 100644
index 000000000..21375f079
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-default-ns.out.yaml
@@ -0,0 +1,168 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: default
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              caCertificate:
+                certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                name: policy-btls/default-ca
+              sni: example.com
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
new file mode 100644
index 000000000..d11c1a5f2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.in.yaml
@@ -0,0 +1,119 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: policies
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: no-ca-cmap
+      namespace: policies
+    data:
+      garbage.crt: |
+        itsAllGarbage
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: no-ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
new file mode 100644
index 000000000..0d234e3ca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-invalid-ca.out.yaml
@@ -0,0 +1,164 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: no-ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: No ca found in configmap no-ca-cmap
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
new file mode 100644
index 000000000..88fb94bc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.in.yaml
@@ -0,0 +1,105 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: default
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: default
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: default
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        sectionName: "8080"
+      tls:
+        wellKnownCACerts: System
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
new file mode 100644
index 000000000..57bc73c40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-system-truststore.out.yaml
@@ -0,0 +1,163 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      sectionName: "8080"
+    tls:
+      hostname: example.com
+      wellKnownCACerts: System
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: default
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            tls:
+              sni: example.com
+              useSystemTrustStore: true
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
new file mode 100644
index 000000000..f773f2008
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.in.yaml
@@ -0,0 +1,134 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      name: gateway-btls
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      name: httproute-btls
+      namespace: envoy-gateway
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-btls
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: http-backend
+              namespace: backends
+              port: 8080
+
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      name: refg-route-svc
+      namespace: backends
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: envoy-gateway
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+      to:
+        - group: ""
+          kind: Service
+
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: http-backend
+      namespace: backends
+    spec:
+      clusterIP: 10.11.12.13
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+          targetPort: 8080
+
+
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "10.244.0.11"
+        conditions:
+          ready: true
+
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: policies
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls
+      namespace: policies
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: backends
+        sectionName: "8080"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: example.com
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
new file mode 100755
index 000000000..2cc528d75
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtlspolicy-without-referencegrant.out.yaml
@@ -0,0 +1,165 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls
+    namespace: policies
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: backends
+      sectionName: "8080"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: example.com
+  status:
+    ancestors:
+    - ancestorRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: target ref to Service backends/http-backend not permitted by any
+          ReferenceGrant
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-btls
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-btls
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-btls
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: http-backend
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-btls
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-btls:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-btls/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-btls
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-btls
+xdsIR:
+  envoy-gateway/gateway-btls:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-btls/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 10.244.0.11
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
new file mode 100644
index 000000000..ea9b2f65a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.in.yaml
@@ -0,0 +1,89 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    loadBalancer:
+      type: Random
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    loadBalancer:
+      type: ConsistentHash
+      consistentHash:
+        type: SourceIP
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
new file mode 100755
index 000000000..4b9a5428d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-override-replace.out.yaml
@@ -0,0 +1,271 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    loadBalancer:
+      consistentHash:
+        type: SourceIP
+      type: ConsistentHash
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      type: Random
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          consistentHash:
+            sourceIP: true
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          random: {}
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        timeout:
+          http:
+            connectionIdleTimeout: 21s
+            maxConnectionDuration: 22s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
new file mode 100644
index 000000000..ed13bb09c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.in.yaml
@@ -0,0 +1,207 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-as-well
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: not-same-namespace-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: not-same-namespace-gateway
+      namespace: another-namespace
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: also-target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-grpcroute-in-gateway-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: not-same-namespace-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: not-same-namespace-httproute
+      namespace: another-namespace
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: another-namespace
+    name: not-same-namespace-httproute
+  spec:
+    parentRefs:
+    - namespace: another-namespace
+      name: not-same-namespace-gateway
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: envoy-gateway
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: tcp
+      protocol: TCP
+      port: 53
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: another-namespace
+    name: not-same-namespace-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
new file mode 100644
index 000000000..f0ea790e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -0,0 +1,621 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: also-target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target HTTPRoute, another BackendTrafficPolicy has already
+          attached to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-grpcroute-in-gateway-2
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: not-same-namespace-httproute
+      namespace: another-namespace
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:envoy-gateway TargetRef.Namespace:another-namespace, BackendTrafficPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [envoy-gateway/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-as-well
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target Gateway, another BackendTrafficPolicy has already
+          attached to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: not-same-namespace-gateway
+      namespace: another-namespace
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:envoy-gateway TargetRef.Namespace:another-namespace, BackendTrafficPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: tcp
+      port: 53
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-gateway
+    namespace: another-namespace
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: not-same-namespace-httproute
+    namespace: another-namespace
+  spec:
+    parentRefs:
+    - name: not-same-namespace-gateway
+      namespace: another-namespace
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service another-namespace/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: not-same-namespace-gateway
+        namespace: another-namespace
+infraIR:
+  another-namespace/not-same-namespace-gateway:
+    proxy:
+      listeners:
+      - address: null
+        name: another-namespace/not-same-namespace-gateway/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: not-same-namespace-gateway
+          apk.wso2.com/owning-gateway-namespace: another-namespace
+      name: another-namespace/not-same-namespace-gateway
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/tcp
+        ports:
+        - containerPort: 10053
+          name: tcp
+          protocol: TCP
+          servicePort: 53
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  another-namespace/not-same-namespace-gateway:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: another-namespace/not-same-namespace-gateway/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
new file mode 100644
index 000000000..8104c47f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.in.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/route2"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+    faultInjection:
+      abort:
+        httpStatus: 14
+        percentage: 0.01
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-grpcroute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: default
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
new file mode 100644
index 000000000..401442b05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -0,0 +1,430 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-grpcroute
+    namespace: default
+  spec:
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    faultInjection:
+      abort:
+        httpStatus: 14
+        percentage: 0.01
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /route2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        faultInjection:
+          abort:
+            grpcStatus: 14
+            percentage: 100
+          delay:
+            fixedDelay: 5.4s
+            percentage: 80
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        faultInjection:
+          abort:
+            httpStatus: 14
+            percentage: 0.01
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /route2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        faultInjection:
+          abort:
+            httpStatus: 500
+            percentage: 100
+          delay:
+            fixedDelay: 5.4s
+            percentage: 80
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
new file mode 100644
index 000000000..589e63b24
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.in.yaml
@@ -0,0 +1,123 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-2
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+grpcRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: GRPCRoute
+    metadata:
+      namespace: default
+      name: grpcroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - apk.wso2.com
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - apk.wso2.com
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/foo"
+          backendRefs:
+            - name: service-1
+              port: 8080
+backendTrafficPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: envoy-gateway
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      circuitBreaker:
+        maxConnections: -1
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: policy-for-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      circuitBreaker:
+        maxRequestsPerConnection: -1
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: BackendTrafficPolicy
+    metadata:
+      namespace: default
+      name: policy-for-route2
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-2
+        namespace: default
+      circuitBreaker:
+        maxParallelRetries: -1
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
new file mode 100644
index 000000000..4197b5961
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -0,0 +1,394 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxRequestsPerConnection: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxRequestsPerConnection value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route2
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxParallelRetries: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxParallelRetries value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    circuitBreaker:
+      maxConnections: -1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'CircuitBreaker: invalid MaxConnections value -1'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
new file mode 100644
index 000000000..c1d23a03a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    circuitBreaker:
+      maxConnections: 2048
+      maxPendingRequests: 1
+      maxParallelRequests: 4294967295
+      maxParallelRetries: 1024
+      maxRequestsPerConnection: 1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    circuitBreaker:
+      maxConnections: 42
+      maxPendingRequests: 42
+      maxParallelRequests: 42
+      maxParallelRetries: 24
+      maxRequestsPerConnection: 42
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
new file mode 100644
index 000000000..152901578
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -0,0 +1,328 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxConnections: 42
+      maxParallelRequests: 42
+      maxParallelRetries: 24
+      maxPendingRequests: 42
+      maxRequestsPerConnection: 42
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    circuitBreaker:
+      maxConnections: 2048
+      maxParallelRequests: 4294967295
+      maxParallelRetries: 1024
+      maxPendingRequests: 1
+      maxRequestsPerConnection: 1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 2048
+          maxParallelRequests: 4294967295
+          maxParallelRetries: 1024
+          maxPendingRequests: 1
+          maxRequestsPerConnection: 1
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 42
+          maxParallelRequests: 42
+          maxParallelRetries: 24
+          maxPendingRequests: 42
+          maxRequestsPerConnection: 42
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
new file mode 100644
index 000000000..3ba0127fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.in.yaml
@@ -0,0 +1,239 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/v2"
+      backendRefs:
+      - name: service-2
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-3
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/v3"
+      backendRefs:
+      - name: service-3
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    healthCheck:
+      active:
+        timeout: "500ms"
+        interval: "3s"
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        type: HTTP
+        http:
+          path: "/healthz"
+          method: "GET"
+          expectedStatuses:
+          - 200
+          - 300
+          expectedResponse:
+            type: Binary
+            binary: RXZlcnl0aGluZyBPSw==
+      passive:
+        baseEjectionTime: 160s
+        interval: 2s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        type: HTTP
+        http:
+          path: "/healthz"
+          method: "GET"
+          expectedStatuses:
+          - 200
+          - 201
+          expectedResponse:
+            type: Text
+            text: pong
+      passive:
+        baseEjectionTime: 150s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        type: TCP
+        tcp:
+          send:
+            type: Text
+            text: ping
+          receive:
+            type: Text
+            text: pong
+      passive:
+        baseEjectionTime: 10s
+        interval: 10s
+        maxEjectionPercent: 10
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-3
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-3
+      namespace: default
+    healthCheck:
+      active:
+        timeout: 1s
+        interval: 3s
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        type: TCP
+        tcp:
+          send:
+            type: Binary
+            binary: cGluZw==
+          receive:
+            type: Binary
+            binary: RXZlcnl0aGluZyBPSw==
+      passive:
+        baseEjectionTime: 160s
+        interval: 8ms
+        maxEjectionPercent: 11
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
new file mode 100644
index 000000000..75d9cce14
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -0,0 +1,648 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 3
+        http:
+          expectedResponse:
+            text: pong
+            type: Text
+          expectedStatuses:
+          - 200
+          - 201
+          method: GET
+          path: /healthz
+        interval: 5s
+        timeout: 1s
+        type: HTTP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m30s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 1s
+        maxEjectionPercent: 100
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-2
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 3
+        interval: 5s
+        tcp:
+          receive:
+            text: pong
+            type: Text
+          send:
+            text: ping
+            type: Text
+        timeout: 1s
+        type: TCP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 10s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 10s
+        maxEjectionPercent: 10
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-3
+    namespace: default
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 1
+        interval: 3s
+        tcp:
+          receive:
+            binary: RXZlcnl0aGluZyBPSw==
+            type: Binary
+          send:
+            binary: cGluZw==
+            type: Binary
+        timeout: 1s
+        type: TCP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m40s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 8ms
+        maxEjectionPercent: 11
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-3
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    healthCheck:
+      active:
+        healthyThreshold: 1
+        http:
+          expectedResponse:
+            binary: RXZlcnl0aGluZyBPSw==
+            type: Binary
+          expectedStatuses:
+          - 200
+          - 300
+          method: GET
+          path: /healthz
+        interval: 3s
+        timeout: 500ms
+        type: HTTP
+        unhealthyThreshold: 3
+      passive:
+        baseEjectionTime: 2m40s
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        interval: 2s
+        maxEjectionPercent: 100
+        splitExternalLocalOriginErrors: false
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 3
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-3
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /v3
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 1
+            http:
+              expectedResponse:
+                binary: RXZlcnl0aGluZyBPSw==
+              expectedStatuses:
+              - 200
+              - 300
+              host: '*'
+              method: GET
+              path: /healthz
+            interval: 3s
+            timeout: 500ms
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m40s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 2s
+            maxEjectionPercent: 100
+            splitExternalLocalOriginErrors: false
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 3
+            interval: 5s
+            tcp:
+              receive:
+                text: pong
+              send:
+                text: ping
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 10s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 10s
+            maxEjectionPercent: 10
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-3/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 1
+            interval: 3s
+            tcp:
+              receive:
+                binary: RXZlcnl0aGluZyBPSw==
+              send:
+                binary: cGluZw==
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m40s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 8ms
+            maxEjectionPercent: 11
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-3/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v3
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        healthCheck:
+          active:
+            healthyThreshold: 3
+            http:
+              expectedResponse:
+                text: pong
+              expectedStatuses:
+              - 200
+              - 201
+              host: apk.wso2.com
+              method: GET
+              path: /healthz
+            interval: 5s
+            timeout: 1s
+            unhealthyThreshold: 3
+          passive:
+            baseEjectionTime: 2m30s
+            consecutive5XxErrors: 5
+            consecutiveGatewayErrors: 0
+            consecutiveLocalOriginFailures: 5
+            interval: 1s
+            maxEjectionPercent: 100
+            splitExternalLocalOriginErrors: false
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
new file mode 100644
index 000000000..5744e6813
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.in.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/test2"
+      backendRefs:
+      - name: service-2
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    loadBalancer:
+      type: Random
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    loadBalancer:
+      type: ConsistentHash
+      consistentHash:
+        type: SourceIP
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+    loadBalancer:
+      type: RoundRobin
+      slowStart:
+        window: 300s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    loadBalancer:
+      type: LeastRequest
+      slowStart:
+        window: 300s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
new file mode 100644
index 000000000..4fbeddb3c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -0,0 +1,443 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    loadBalancer:
+      consistentHash:
+        type: SourceIP
+      type: ConsistentHash
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route2
+    namespace: default
+  spec:
+    loadBalancer:
+      slowStart:
+        window: 5m0s
+      type: LeastRequest
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      type: Random
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway2
+    namespace: envoy-gateway
+  spec:
+    loadBalancer:
+      slowStart:
+        window: 5m0s
+      type: RoundRobin
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other backendTrafficPolicies
+          for these routes: [default/httproute-1 default/httproute-2]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /test2
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        loadBalancer:
+          random: {}
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          leastRequest:
+            slowStart:
+              window: 5m0s
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test2
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        loadBalancer:
+          consistentHash:
+            sourceIP: true
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
new file mode 100644
index 000000000..8b3e60576
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.in.yaml
@@ -0,0 +1,71 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:    # No Rule without selector is specified, so int32 max is used as default.
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
new file mode 100644
index 000000000..82bec953e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
@@ -0,0 +1,213 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          local:
+            default:
+              requests: 4294967295
+              unit: Second
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: false
+                exact: foo
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: false
+                ipv6: false
+                maskLen: 16
+              headerMatches:
+              - distinct: false
+                exact: two
+                name: x-user-id
+              - distinct: false
+                exact: bar
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
new file mode 100644
index 000000000..9d2345eb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.in.yaml
@@ -0,0 +1,74 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:
+            requests: 1000
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute    # Local rateLimit rule limit unit is not a multiple of the default limit unit.
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
new file mode 100644
index 000000000..4abdf1c81
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
@@ -0,0 +1,186 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 1000
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit rule limit unit must be a multiple of
+          the default limit unit'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
new file mode 100644
index 000000000..4ce51ffbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.in.yaml
@@ -0,0 +1,71 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
new file mode 100644
index 000000000..2e5bc0d3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
@@ -0,0 +1,182 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit does not support distinct HeaderMatch'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
new file mode 100644
index 000000000..ac31643f8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.in.yaml
@@ -0,0 +1,77 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:    # There are two Rule without selector, so this is invalid.
+            requests: 10
+            unit: Minute
+        - limit:
+            requests: 20
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
new file mode 100644
index 000000000..8b1a6ef2d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
@@ -0,0 +1,189 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 10
+            unit: Minute
+        - limit:
+            requests: 20
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: local rateLimit can not have more than one rule without
+          clientSelectors'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
new file mode 100644
index 000000000..99a4608cc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.in.yaml
@@ -0,0 +1,74 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Local
+      local:
+        rules:
+        - limit:    # The Rule without selector is used as default
+            requests: 10
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
new file mode 100644
index 000000000..a5f92bcc2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
@@ -0,0 +1,216 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      local:
+        rules:
+        - limit:
+            requests: 10
+            unit: Minute
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              value: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: two
+            - name: x-org-id
+              value: bar
+            sourceCIDR:
+              value: 192.168.0.0/16
+          limit:
+            requests: 10
+            unit: Minute
+      type: Local
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          local:
+            default:
+              requests: 10
+              unit: Minute
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: false
+                exact: foo
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: false
+                ipv6: false
+                maskLen: 16
+              headerMatches:
+              - distinct: false
+                exact: two
+                name: x-user-id
+              - distinct: false
+                exact: bar
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Minute
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
new file mode 100644
index 000000000..582a4e05b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.in.yaml
@@ -0,0 +1,91 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    proxyProtocol:
+      version: V1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    proxyProtocol:
+      version: V2
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
new file mode 100644
index 000000000..f41eecc30
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -0,0 +1,312 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    proxyProtocol:
+      version: V2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    proxyProtocol:
+      version: V1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        proxyProtocol:
+          version: V1
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        proxyProtocol:
+          version: V2
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
new file mode 100644
index 000000000..18dfda14b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              type: RegularExpression
+              value: "*.illegal.regex"
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
new file mode 100644
index 000000000..46444f14d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
@@ -0,0 +1,164 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              type: RegularExpression
+              value: '*.illegal.regex'
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'RateLimit: regex "*.illegal.regex" is invalid: error parsing regexp:
+          missing argument to repetition operator: `*`'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
new file mode 100644
index 000000000..1e075f595
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.in.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    rateLimit:
+      type: Global
+      global:
+        rules:
+        - clientSelectors:
+          - sourceCIDR:
+              type: "Distinct"
+              value: 192.168.0.0/16
+          limit:
+            requests: 20
+            unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
new file mode 100644
index 000000000..1d185ce01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -0,0 +1,352 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - sourceCIDR:
+              type: Distinct
+              value: 192.168.0.0/16
+          limit:
+            requests: 20
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    rateLimit:
+      global:
+        rules:
+        - clientSelectors:
+          - headers:
+            - name: x-user-id
+              value: one
+            - name: x-org-id
+              type: Distinct
+          limit:
+            requests: 10
+            unit: Hour
+      type: Global
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        rateLimit:
+          global:
+            rules:
+            - headerMatches:
+              - distinct: false
+                exact: one
+                name: x-user-id
+              - distinct: true
+                name: x-org-id
+              limit:
+                requests: 10
+                unit: Hour
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        rateLimit:
+          global:
+            rules:
+            - cidrMatch:
+                cidr: 192.168.0.0/16
+                distinct: true
+                ipv6: false
+                maskLen: 16
+              headerMatches: []
+              limit:
+                requests: 20
+                unit: Hour
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
new file mode 100644
index 000000000..b1554fcf3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.in.yaml
@@ -0,0 +1,110 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    retry:
+      retryOn:
+        triggers:
+        - cancelled
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    retry:
+      numRetries: 5
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - connect-failure
+        - retriable-status-codes
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
new file mode 100644
index 000000000..064910c07
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -0,0 +1,350 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    retry:
+      numRetries: 5
+      perRetry:
+        backOff:
+          baseInterval: 100ms
+          maxInterval: 10s
+        timeout: 250ms
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - connect-failure
+        - retriable-status-codes
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    retry:
+      perRetry:
+        backOff:
+          baseInterval: 100ms
+          maxInterval: 10s
+        timeout: 250ms
+      retryOn:
+        triggers:
+        - cancelled
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        retry:
+          perRetry:
+            backOff:
+              baseInterval: 100ms
+              maxInterval: 10s
+            timeout: 250ms
+          retryOn:
+            triggers:
+            - cancelled
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        retry:
+          numRetries: 5
+          perRetry:
+            backOff:
+              baseInterval: 100ms
+              maxInterval: 10s
+            timeout: 250ms
+          retryOn:
+            httpStatusCodes:
+            - 429
+            - 503
+            triggers:
+            - connect-failure
+            - retriable-status-codes
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
new file mode 100644
index 000000000..5bba0fd43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.in.yaml
@@ -0,0 +1,70 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: default
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-httproute-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    circuitBreaker:
+      maxConnections: 2048
+      maxPendingRequests: 1
+      maxParallelRequests: 4294967295
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
new file mode 100644
index 000000000..22ebc5603
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
@@ -0,0 +1,224 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-httproute-1
+    namespace: default
+  spec:
+    circuitBreaker:
+      maxConnections: 2048
+      maxParallelRequests: 4294967295
+      maxPendingRequests: 1
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        circuitBreaker:
+          maxConnections: 2048
+          maxParallelRequests: 4294967295
+          maxPendingRequests: 1
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
new file mode 100644
index 000000000..4587b0518
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.in.yaml
@@ -0,0 +1,95 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    tcpKeepalive:
+      probes: 3
+      idleTime: 20m
+      interval: 60s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    tcpKeepalive:
+      probes: 6
+      idleTime: 10s
+      interval: 30m
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
new file mode 100644
index 000000000..4c90cb268
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -0,0 +1,320 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    tcpKeepalive:
+      idleTime: 10s
+      interval: 30m
+      probes: 6
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    tcpKeepalive:
+      idleTime: 20m
+      interval: 60s
+      probes: 3
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        tcpKeepalive:
+          idleTime: 1200
+          interval: 60
+          probes: 3
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        tcpKeepalive:
+          idleTime: 10
+          interval: 1800
+          probes: 6
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
new file mode 100644
index 000000000..62ff310c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.in.yaml
@@ -0,0 +1,49 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22mib
+      tcp:
+        connectTimeout: 20s
+
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
new file mode 100644
index 000000000..fa8ae48d6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
@@ -0,0 +1,155 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22mib
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: 'Timeout: invalid MaxConnectionDuration value 22mib'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
new file mode 100644
index 000000000..14abe58a7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      tcp:
+        connectTimeout: 15s
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
new file mode 100644
index 000000000..508f965d8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -0,0 +1,328 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        connectionIdleTimeout: 21s
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+      tcp:
+        connectTimeout: 15s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        timeout:
+          http:
+            connectionIdleTimeout: 16s
+            maxConnectionDuration: 17s
+          tcp:
+            connectTimeout: 15s
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            connectionIdleTimeout: 21s
+            maxConnectionDuration: 22s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
new file mode 100644
index 000000000..0987579b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.in.yaml
@@ -0,0 +1,73 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        disable: true
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
new file mode 100644
index 000000000..61c561c06
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/disable-accesslog.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              disable: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
new file mode 100644
index 000000000..43b3279af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.in.yaml
@@ -0,0 +1,35 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway-2
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
new file mode 100644
index 000000000..4d89fe308
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-cross-ns-target.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway-2
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: Namespace:envoy-gateway-2 TargetRef.Namespace:envoy-gateway, EnvoyPatchPolicy
+            can only target a Gateway in the same namespace.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
new file mode 100644
index 000000000..bc81721c4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.in.yaml
@@ -0,0 +1,43 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
new file mode 100644
index 000000000..c66e10852
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-feature-disabled.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy is disabled in the EnvoyGateway configuration
+          reason: Disabled
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
new file mode 100644
index 000000000..7a96a3833
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.in.yaml
@@ -0,0 +1,43 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
new file mode 100644
index 000000000..994a00695
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind-merge-gateways.out.yaml
@@ -0,0 +1,94 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:Gateway,
+            only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:GatewayClass
+            is supported.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
new file mode 100644
index 000000000..d0f8d0530
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.in.yaml
@@ -0,0 +1,35 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: MyGateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
new file mode 100644
index 000000000..84c1f20f3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-invalid-target-kind.out.yaml
@@ -0,0 +1,84 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: TargetRef.Group:gateway.networking.k8s.io TargetRef.Kind:MyGateway,
+            only TargetRef.Group:gateway.networking.k8s.io and TargetRef.Kind:Gateway
+            is supported.
+          reason: Invalid
+          status: "False"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
new file mode 100644
index 000000000..f0cd4b988
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.in.yaml
@@ -0,0 +1,13 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
new file mode 100644
index 000000000..fca40f1fe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-no-status-for-unknown-gateway.out.yaml
@@ -0,0 +1,2 @@
+infraIR: {}
+xdsIR: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
new file mode 100644
index 000000000..303f4a233
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.in.yaml
@@ -0,0 +1,64 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-ignore-global-limit
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GatewayClass
+      name: envoy-gateway-class
+      namespace: envoy-gateway
+    # Higher priority
+    priority: -1
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/ignore_global_conn_limit"
+        value: "true"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
new file mode 100644
index 000000000..ea6ec6609
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid-merge-gateways.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /ignore_global_conn_limit
+          value: "true"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-ignore-global-limit
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /per_connection_buffer_limit_bytes
+          value: "1024"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
new file mode 100644
index 000000000..4924ee7ac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.in.yaml
@@ -0,0 +1,56 @@
+envoyPatchPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-conn-buffer-bytes
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/per_connection_buffer_limit_bytes"
+        value: "1024"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyPatchPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: edit-ignore-global-limit
+  spec:
+    type: "JSONPatch"
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    # Higher priority
+    priority: -1
+    jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      name: "envoy-gateway-gateway-1-http"
+      operation:
+        op: replace
+        path: "/ignore_global_conn_limit"
+        value: "true"
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
new file mode 100644
index 000000000..bcd4a2d07
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoypatchpolicy-valid.out.yaml
@@ -0,0 +1,105 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    envoyPatchPolicies:
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /ignore_global_conn_limit
+          value: "true"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-ignore-global-limit
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    - jsonPatches:
+      - name: envoy-gateway-gateway-1-http
+        operation:
+          op: replace
+          path: /per_connection_buffer_limit_bytes
+          value: "1024"
+        type: type.googleapis.com/envoy.config.listener.v3.Listener
+      name: edit-conn-buffer-bytes
+      namespace: envoy-gateway
+      status:
+        conditions:
+        - lastTransitionTime: null
+          message: EnvoyPatchPolicy has been accepted.
+          reason: Accepted
+          status: "True"
+          type: Accepted
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
new file mode 100644
index 000000000..507bc3162
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.in.yaml
@@ -0,0 +1,79 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: JSON
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
new file mode 100644
index 000000000..8fddd3e69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json-no-format.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  type: JSON
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog: {}
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
new file mode 100644
index 000000000..f004ed31f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.in.yaml
@@ -0,0 +1,82 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: JSON
+            json:
+              protocol: "%PROTOCOL%"
+              duration: "%DURATION%"
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
new file mode 100644
index 000000000..73009d679
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-file-json.out.yaml
@@ -0,0 +1,145 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  json:
+                    duration: '%DURATION%'
+                    protocol: '%PROTOCOL%'
+                  type: JSON
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      json:
+      - json:
+          duration: '%DURATION%'
+          protocol: '%PROTOCOL%'
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
new file mode 100644
index 000000000..6c0255abf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.in.yaml
@@ -0,0 +1,80 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: Text
+            text: |
+              [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+          sinks:
+          - type: File
+          - type: OpenTelemetry
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
new file mode 100644
index 000000000..b88c60c05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog-with-bad-sinks.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - type: File
+                - type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog: {}
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
new file mode 100644
index 000000000..d9e516557
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.in.yaml
@@ -0,0 +1,87 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    telemetry:
+      accessLog:
+        settings:
+        - format:
+            type: Text
+            text: |
+              [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+          sinks:
+          - type: File
+            file:
+              path: /dev/stdout
+          - type: OpenTelemetry
+            openTelemetry:
+              host: otel-collector.monitoring.svc.cluster.local
+              port: 4317
+              resources:
+                k8s.cluster.name: "cluster-1"
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
new file mode 100644
index 000000000..353265e36
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-accesslog.out.yaml
@@ -0,0 +1,156 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+          telemetry:
+            accessLog:
+              settings:
+              - format:
+                  text: |
+                    [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+                  type: Text
+                sinks:
+                - file:
+                    path: /dev/stdout
+                  type: File
+                - openTelemetry:
+                    host: otel-collector.monitoring.svc.cluster.local
+                    port: 4317
+                    resources:
+                      k8s.cluster.name: cluster-1
+                  type: OpenTelemetry
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      openTelemetry:
+      - host: otel-collector.monitoring.svc.cluster.local
+        port: 4317
+        resources:
+          k8s.cluster.name: cluster-1
+        text: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+      text:
+      - format: |
+          [%START_TIME%] "%REQ(:METHOD)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"\n
+        path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
new file mode 100644
index 000000000..24d8302c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.in.yaml
@@ -0,0 +1,70 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    provider:
+      type: Kubernetes
+      kubernetes:
+        envoyService:
+          type: LoadBalancer
+        envoyDeployment:
+          replicas: 2
+          container:
+            env:
+            - name: env_a
+              value: env_a_value
+            - name: env_b
+              value: env_b_name
+            image: "envoyproxy/envoy:distroless-v1.29-latest"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            affinity:
+              nodeAffinity:
+                requiredDuringSchedulingIgnoredDuringExecution:
+                  nodeSelectorTerms:
+                  - matchExpressions:
+                    - key: cloud.google.com/gke-nodepool
+                      operator: In
+                      values:
+                      - router-node
+            tolerations:
+            - effect: NoSchedule
+              key: node-type
+              operator: Exists
+              value: "router"
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+            volumes:
+            - name: certs
+              secret:
+                secretName: envoy-cert
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
new file mode 100644
index 000000000..4a69b9bc6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/envoyproxy-valid.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          provider:
+            kubernetes:
+              envoyDeployment:
+                container:
+                  env:
+                  - name: env_a
+                    value: env_a_value
+                  - name: env_b
+                    value: env_b_name
+                  image: envoyproxy/envoy:distroless-v1.29-latest
+                  resources:
+                    requests:
+                      cpu: 100m
+                      memory: 512Mi
+                  securityContext:
+                    allowPrivilegeEscalation: false
+                    runAsUser: 2000
+                pod:
+                  affinity:
+                    nodeAffinity:
+                      requiredDuringSchedulingIgnoredDuringExecution:
+                        nodeSelectorTerms:
+                        - matchExpressions:
+                          - key: cloud.google.com/gke-nodepool
+                            operator: In
+                            values:
+                            - router-node
+                  annotations:
+                    key1: val1
+                    key2: val2
+                  securityContext:
+                    fsGroup: 2000
+                    fsGroupChangePolicy: OnRootMismatch
+                    runAsGroup: 3000
+                    runAsUser: 1000
+                  tolerations:
+                  - effect: NoSchedule
+                    key: node-type
+                    operator: Exists
+                    value: router
+                  volumes:
+                  - name: certs
+                    secret:
+                      secretName: envoy-cert
+                replicas: 2
+              envoyService:
+                type: LoadBalancer
+            type: Kubernetes
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
new file mode 100644
index 000000000..9e910c6e9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
new file mode 100644
index 000000000..afd662552
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-extension-filter-invalid-group.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Unable to translate APIVersion for Extension Filter: kind: Foo,
+          default/test'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Unable to translate APIVersion for Extension Filter: kind: Foo,
+          default/test'
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
new file mode 100644
index 000000000..410d26bfe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: example
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
new file mode 100644
index 000000000..eead7496d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-non-matching-extension-filter.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: example
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Reference default/example not found for filter type: Foo'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'Reference default/example not found for filter type: Foo'
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
new file mode 100644
index 000000000..3021a18ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Unsupported
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Unsupported
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
new file mode 100644
index 000000000..7de3b2833
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-unsupported-extension-filter.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Unsupported
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Invalid filter ExtensionRef: unknown kind foo.example.io/Unsupported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
new file mode 100644
index 000000000..5bd190c9c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+extensionRefFilters:
+- apiVersion: foo.example.io/v1alpha1
+  kind: Foo
+  metadata:
+    name: test
+    namespace: default
+  spec:
+    data: "stuff"
diff --git a/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
new file mode 100644
index 000000000..b9dc22fc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: foo.example.io
+          kind: Foo
+          name: test
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extensionRefs:
+        - object:
+            apiVersion: foo.example.io/v1alpha1
+            kind: Foo
+            metadata:
+              name: test
+              namespace: default
+            spec:
+              data: stuff
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
new file mode 100644
index 000000000..0dd2519dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.in.yaml
@@ -0,0 +1,63 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: envoy-gateway
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
new file mode 100644
index 000000000..e7427151b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
new file mode 100644
index 000000000..40c54eff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
new file mode 100644
index 000000000..6a890eedf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-allows-same-namespace-with-disallowed-httproute.out.yaml
@@ -0,0 +1,107 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
new file mode 100644
index 000000000..fa6d64551
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.in.yaml
@@ -0,0 +1,76 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      infrastructure:
+        labels:
+          infra-label1: infra-val1
+          infra-label2: infra-val2
+        annotations:
+          infra-anno-key1: infra-anno-val1
+          infra-anno-key2: infra-anno-val2
+      listeners:
+        - name: https
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+    status:
+      listeners:
+        - name: https
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - name: gateway-1
+          namespace: default
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
new file mode 100644
index 000000000..5ea3b0e02
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-infrastructure.out.yaml
@@ -0,0 +1,150 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    infrastructure:
+      annotations:
+        infra-anno-key1: infra-anno-val1
+        infra-anno-key2: infra-anno-val2
+      labels:
+        infra-label1: infra-val1
+        infra-label2: infra-val2
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/https
+        ports:
+        - containerPort: 10443
+          name: https
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        annotations:
+          infra-anno-key1: infra-anno-val1
+          infra-anno-key2: infra-anno-val2
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+          infra-label1: infra-val1
+          infra-label2: infra-val2
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/https
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
new file mode 100644
index 000000000..e4194dd15
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.in.yaml
@@ -0,0 +1,19 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+      addresses:
+        - type: IPAddress
+          value: 1.2.3.4
+        - type: IPAddress
+          value: 5.6.7.8
+        - type: Hostname
+          value: foo.bar
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
new file mode 100644
index 000000000..3c0b792d5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-addresses-with-ipaddress.out.yaml
@@ -0,0 +1,67 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    addresses:
+    - type: IPAddress
+      value: 1.2.3.4
+    - type: IPAddress
+      value: 5.6.7.8
+    - type: Hostname
+      value: foo.bar
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      addresses:
+      - 1.2.3.4
+      - 5.6.7.8
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
new file mode 100644
index 000000000..7c71b1eaa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.in.yaml
@@ -0,0 +1,38 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Selector
+              selector:
+                matchExpressions:
+                  - key: foo
+                    operator: Exists
+                    values:
+                      - bar
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
new file mode 100644
index 000000000..9ba997089
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-namespaces-selector.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Selector
+          selector:
+            matchExpressions:
+            - key: foo
+              operator: Exists
+              values:
+              - bar
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: 'The allowedRoutes.namespaces.selector could not be parsed: values:
+          Invalid value: []string{"bar"}: values set must be empty for exists and
+          does not exist.'
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
new file mode 100644
index 000000000..e31eab269
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: foo.io
+                kind: HTTPRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
new file mode 100644
index 000000000..6869b02ad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-group.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: foo.io
+          kind: HTTPRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Group is not supported, group must be gateway.networking.k8s.io
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds: []
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
new file mode 100644
index 000000000..3c1d72a73
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: FooRoute
+              - group:
+                kind: HTTPRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
new file mode 100644
index 000000000..235dcf33c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind-and-supported.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: FooRoute
+        - kind: HTTPRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: FooRoute is not supported, kind must be one of [HTTPRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds:
+      - kind: HTTPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
new file mode 100644
index 000000000..dd3061ecf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: FooRoute
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
new file mode 100644
index 000000000..14f241429
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-routes-kind.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: FooRoute
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: FooRoute is not supported, kind must be one of [HTTPRoute GRPCRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: http
+      supportedKinds: []
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
new file mode 100644
index 000000000..ee989f7fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          hostname: foo.com
+          protocol: TLS
+          port: 80
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+            kinds:
+              - group: gateway.networking.k8s.io
+                kind: HTTPRoute
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
new file mode 100644
index 000000000..80ee8a1cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-allowed-tls-route-kind.out.yaml
@@ -0,0 +1,83 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        kinds:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 80
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: HTTPRoute is not supported, kind must be one of [TLSRoute]
+        reason: InvalidRouteKinds
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds: []
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
new file mode 100644
index 000000000..be3ac0e7b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-ecdsa-1
+              - name: tls-secret-ecdsa-2
+              - name: tls-secret-1
+
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-2
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ2VENDQVVTZ0F3SUJBZ0lVU2l2SkdURHdva1M3aGVZLzJjc1JzejR2SkIwd0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCMk1CQUdCeXFHU000OUFnRUdCU3VCCkJBQWlBMklBQkZ2cnZSZWJhYVd1UzZNQUVJZDZ3WmZPS3Z1Q1R5VU1PbFpKcUZDRjlUa3pNWWw4Q2lvZnluT3QKQ3JzMHZ2YTlrZC9QMkpNR0JKcWdZZXZid290clJpMTJxTG5IMDQvam9HSWpqVE9LbzNJb2ZyK0ZrOHdMdkFlMwpPMVpLdFI5c3pxTlRNRkV3SFFZRFZSME9CQllFRklLczFRRm5vRHQ5K3Fva1I0T0RXYk16MWYrUE1COEdBMVVkCkl3UVlNQmFBRklLczFRRm5vRHQ5K3Fva1I0T0RXYk16MWYrUE1BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0NnWUkKS29aSXpqMEVBd0lEWndBd1pBSXdIMzF0SHlmVVAwNFhIcGJXR2UxWjFJYUJaQndJdGg1NURVNGhqZlB1OG0rSgpXdjdiVzh6VFNnd0xpcW9yZmN1bkFqQTBnaE5KQkExWDJYdElLRG1sM3M3L1Z4OEZKY1MwNHZwQ2hoK2xBYkxTCnZlYWEyOFIzVExFWTNVK1FUWEkvd0lrPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
new file mode 100644
index 000000000..1c7ce3aa5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-multiple-tls-configuration.out.yaml
@@ -0,0 +1,98 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-2
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-ecdsa-2 public key algorithm must
+          be unique, matched certificate FQDN [foo.bar.com] has a conflicting algorithm
+          [ECDSA].
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
new file mode 100644
index 000000000..e0f69d01a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          hostname: foo.com
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Passthrough
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
new file mode 100644
index 000000000..d4cf64070
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-invalid-mode.out.yaml
@@ -0,0 +1,91 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: TLS Passthrough mode is not supported, TLS mode must be Terminate.
+        reason: UnsupportedTLSMode
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
new file mode 100644
index 000000000..54feff746
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
new file mode 100644
index 000000000..a6291fdcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-certificate-refs.out.yaml
@@ -0,0 +1,86 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have at least 1 TLS certificate ref
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
new file mode 100644
index 000000000..0c3a5060b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          hostname: example.com
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
new file mode 100644
index 000000000..ec5a8b858
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-no-valid-certificate-for-fqdn.out.yaml
@@ -0,0 +1,93 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: example.com
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 must contain valid tls.crt and
+          tls.key, hostname example.com does not match Common Name or DNS Names in
+          the certificate tls.crt.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
new file mode 100644
index 000000000..95bffc38b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
new file mode 100644
index 000000000..358feaa32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-does-not-exist.out.yaml
@@ -0,0 +1,90 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 does not exist.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
new file mode 100644
index 000000000..caab5079f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.in.yaml
@@ -0,0 +1,47 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+                namespace: default
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
new file mode 100644
index 000000000..0cd7c47e5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-in-other-namespace.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+          namespace: default
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Certificate ref to secret default/tls-secret-1 not permitted by any
+          ReferenceGrant.
+        reason: RefNotPermitted
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
new file mode 100644
index 000000000..75e6051a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.in.yaml
@@ -0,0 +1,45 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.key: YmFyCg==
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
new file mode 100644
index 000000000..8bfcf8097
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-invalid-tls-configuration-secret-is-not-valid.out.yaml
@@ -0,0 +1,90 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/tls-secret-1 must contain tls.crt and tls.key.
+        reason: InvalidCertificateRef
+        status: "False"
+        type: ResolvedRefs
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
new file mode 100644
index 000000000..f24ab41fe
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Selector
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
new file mode 100644
index 000000000..86b2c8cb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-missing-allowed-namespaces-selector.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Selector
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: The allowedRoutes.namespaces.selector field must be specified when
+          allowedRoutes.namespaces.from is set to "Selector".
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
new file mode 100644
index 000000000..f027c23e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.in.yaml
@@ -0,0 +1,16 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          hostname: foo.com
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
new file mode 100644
index 000000000..4e6bc7a18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcp-with-hostname.out.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have hostname set when protocol is TCP.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
new file mode 100644
index 000000000..1cc29af9d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8081
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
new file mode 100644
index 000000000..62e423b7f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-mismatch-port-protocol.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10162
+          name: tcp
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8081
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: TCP Port 8081 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
new file mode 100644
index 000000000..f0291a531
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
new file mode 100644
index 000000000..df0712fb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-backends.out.yaml
@@ -0,0 +1,96 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one backend is supported
+        reason: InvalidBackend
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..179769001
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+        - backendRefs:
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..5f95991a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tcproute-with-multiple-rules.out.yaml
@@ -0,0 +1,97 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+    - backendRefs:
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one rule is supported
+        reason: InvalidRule
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..2882a44c1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+                namespace: default
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: default
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: Gateway
+          namespace: envoy-gateway
+      to:
+        - group: ""
+          kind: Secret
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..26dedcf51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+          namespace: default
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
new file mode 100644
index 000000000..09c8d2137
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.in.yaml
@@ -0,0 +1,70 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls-passthrough
+          protocol: TLS
+          port: 90
+          hostname: foo.bar.com
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tls-terminate
+          protocol: HTTPS
+          port: 443
+          hostname: foo.bar.com
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8080
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
new file mode 100644
index 000000000..1cfa15a3c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
@@ -0,0 +1,225 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.bar.com
+      name: tls-passthrough
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.bar.com
+      name: tls-terminate
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-passthrough
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-terminate
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls-passthrough
+        ports:
+        - containerPort: 10090
+          name: tls-passthrough
+          protocol: TLS
+          servicePort: 90
+      - address: null
+        name: envoy-gateway/gateway-1/tls-terminate
+        ports:
+        - containerPort: 10443
+          name: tls-terminate
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls-terminate
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls-passthrough/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.bar.com
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
new file mode 100644
index 000000000..f8e9d3859
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.in.yaml
@@ -0,0 +1,16 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          hostname: foo.com
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
new file mode 100644
index 000000000..cf80aeec7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udp-with-hostname.out.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have hostname set when protocol is UDP.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
new file mode 100644
index 000000000..440e8c9fd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
new file mode 100644
index 000000000..71c654741
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-mismatch-port-protocol.out.yaml
@@ -0,0 +1,92 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10162
+          name: udp
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: UDP Port 8080 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
new file mode 100644
index 000000000..6dfe97fba
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
new file mode 100644
index 000000000..7ee99d034
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-backends.out.yaml
@@ -0,0 +1,96 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one backend is supported
+        reason: InvalidBackend
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..ecb2d33e0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 50
+        - backendRefs:
+            - name: service-2
+              port: 8080
+              weight: 50
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..619a17b0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-udproute-with-multiple-rules.out.yaml
@@ -0,0 +1,97 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 50
+    - backendRefs:
+      - name: service-2
+        port: 8080
+        weight: 50
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: One and only one rule is supported
+        reason: InvalidRule
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
new file mode 100644
index 000000000..bba952493
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
new file mode 100644
index 000000000..d5205682c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-tcproute.out.yaml
@@ -0,0 +1,60 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
new file mode 100644
index 000000000..2f7fa01b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-2
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
new file mode 100644
index 000000000..2c5574c69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unmatched-udproute.out.yaml
@@ -0,0 +1,60 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
new file mode 100644
index 000000000..12598d5c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: unsupported
+          protocol: GRPC
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
new file mode 100644
index 000000000..bc6bca89e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-unsupported-protocol.out.yaml
@@ -0,0 +1,85 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: unsupported
+      port: 80
+      protocol: GRPC
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Protocol GRPC is unsupported, must be HTTP, HTTPS, TCP or UDP.
+        reason: UnsupportedProtocol
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: unsupported
+      supportedKinds: null
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners included by this parent ref allowed this attachment.
+        reason: NotAllowedByListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
new file mode 100644
index 000000000..827436641
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-ecdsa-1
+              - name: tls-secret-ecdsa-2
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-2
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZakNCNlFJSkFNcDhYTGNsWGJ2NU1Bb0dDQ3FHU000OUJBTUNNQnN4R1RBWEJnTlZCQU1NRUhSbGMzUXUKWlhoaGJYQnNaUzVqYjIwd0hoY05Nak13TlRJMU1UUXhNRFF5V2hjTk1qUXdOVEkwTVRReE1EUXlXakFiTVJrdwpGd1lEVlFRRERCQjBaWE4wTG1WNFlXMXdiR1V1WTI5dE1IWXdFQVlIS29aSXpqMENBUVlGSzRFRUFDSURZZ0FFCmVNdEhDM2hJZXEyUXNka3RTaS9aTlIvTUtOYXZTbTNITm43dEdvZ2ZxYXFuOEFTZ0hJYTd5VVUrK1Bzb0RENmsKZisrQ2U3dXNkMG1RTzFTbmRZSVdqMlFMaUl6ME5aSDhCL1FyNGk3SjBJS3dzUWxVbnVuWnF2NUtZOVRMUWEwbgpNQW9HQ0NxR1NNNDlCQU1DQTJnQU1HVUNNUUNHVGpQa2hqZE1KcWUrVjFGRWpteUk2andEV0FDalhucFRuaXhVCnM2dUNKZjVNNUw1TmpGYmkydGplMGlES0UxVUNNQXdxSjZmOUs2bUhUd2JxVGkzTVNFMmQxODl6aUcyWVZCaUQKYmVXcHc0UjF5ZTdHRFJvVm9veG9ob2lERjdsNm13PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1JR2tBZ0VCQkRDUUE5VWo0SkR5c0Q0MlJIMGI2cjU5NTlXTmlXU2ZKZlMxK2RvTjk0TzZCUGdaQUJiUTI4eTIKUTZsM3pZdklLeFNnQndZRks0RUVBQ0toWkFOaUFBUjR5MGNMZUVoNnJaQ3gyUzFLTDlrMUg4d28xcTlLYmNjMgpmdTBhaUIrcHFxZndCS0FjaHJ2SlJUNzQreWdNUHFSLzc0Sjd1NngzU1pBN1ZLZDFnaGFQWkF1SWpQUTFrZndICjlDdmlMc25RZ3JDeENWU2U2ZG1xL2twajFNdEJyU2M9Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
new file mode 100644
index 000000000..c5972d5f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-2
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-ecdsa-1
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+        - name: envoy-gateway/tls-secret-ecdsa-2
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1JR2tBZ0VCQkRDUUE5VWo0SkR5c0Q0MlJIMGI2cjU5NTlXTmlXU2ZKZlMxK2RvTjk0TzZCUGdaQUJiUTI4eTIKUTZsM3pZdklLeFNnQndZRks0RUVBQ0toWkFOaUFBUjR5MGNMZUVoNnJaQ3gyUzFLTDlrMUg4d28xcTlLYmNjMgpmdTBhaUIrcHFxZndCS0FjaHJ2SlJUNzQreWdNUHFSLzc0Sjd1NngzU1pBN1ZLZDFnaGFQWkF1SWpQUTFrZndICjlDdmlMc25RZ3JDeENWU2U2ZG1xL2twajFNdEJyU2M9Ci0tLS0tRU5EIEVDIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZakNCNlFJSkFNcDhYTGNsWGJ2NU1Bb0dDQ3FHU000OUJBTUNNQnN4R1RBWEJnTlZCQU1NRUhSbGMzUXUKWlhoaGJYQnNaUzVqYjIwd0hoY05Nak13TlRJMU1UUXhNRFF5V2hjTk1qUXdOVEkwTVRReE1EUXlXakFiTVJrdwpGd1lEVlFRRERCQjBaWE4wTG1WNFlXMXdiR1V1WTI5dE1IWXdFQVlIS29aSXpqMENBUVlGSzRFRUFDSURZZ0FFCmVNdEhDM2hJZXEyUXNka3RTaS9aTlIvTUtOYXZTbTNITm43dEdvZ2ZxYXFuOEFTZ0hJYTd5VVUrK1Bzb0RENmsKZisrQ2U3dXNkMG1RTzFTbmRZSVdqMlFMaUl6ME5aSDhCL1FyNGk3SjBJS3dzUWxVbnVuWnF2NUtZOVRMUWEwbgpNQW9HQ0NxR1NNNDlCQU1DQTJnQU1HVUNNUUNHVGpQa2hqZE1KcWUrVjFGRWpteUk2andEV0FDalhucFRuaXhVCnM2dUNKZjVNNUw1TmpGYmkydGplMGlES0UxVUNNQXdxSjZmOUs2bUhUd2JxVGkzTVNFMmQxODl6aUcyWVZCaUQKYmVXcHc0UjF5ZTdHRFJvVm9veG9ob2lERjdsNm13PT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
new file mode 100644
index 000000000..58abae412
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+              - name: tls-secret-ecdsa-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-ecdsa-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
+      tls.key: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
new file mode 100644
index 000000000..9b1b70520
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        - group: null
+          kind: null
+          name: tls-secret-ecdsa-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+        - name: envoy-gateway/tls-secret-ecdsa-1
+          privateKey: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUxEbnZNM1RKM3NHYm9EeTF4T3dqSVppVFNWeWZXVWF5YVExcWdrdUdacEtvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFSDVWdHJjenJQS091alV5RTMyaDU2UnVrdHUzSVhTVnJJMkNibXh5UUpqcEY3di9rNVNqTQpSVXZjUnBCdmpnQWROaGhUNGNUMXV4YW1TMFlmQ2JXMVhRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJnVENDQVNlZ0F3SUJBZ0lVRm1sOExCRzBvL1FLNFErWjdrODI0c0MyaUZ3d0NnWUlLb1pJemowRUF3SXcKRmpFVU1CSUdBMVVFQXd3TFptOXZMbUpoY2k1amIyMHdIaGNOTWpRd01qSTVNRGt6TURFd1doY05NelF3TWpJMgpNRGt6TURFd1dqQVdNUlF3RWdZRFZRUUREQXRtYjI4dVltRnlMbU52YlRCWk1CTUdCeXFHU000OUFnRUdDQ3FHClNNNDlBd0VIQTBJQUJMYVl2cUt1VlZveERvNTJlV3p2WUI1anc3RU1GODZybXlvaTVadWF5emRNdnBnNHpCcjgKUktCak5zK1QxakI4T0t1Y1MvN1JVRHgwcHorOTc2ek0zaU9qVXpCUk1CMEdBMVVkRGdRV0JCVE82K2NnMFIwZAp3dHJ6SlFQRzZnNzZoQkJVelRBZkJnTlZIU01FR0RBV2dCVE82K2NnMFIwZHd0cnpKUVBHNmc3NmhCQlV6VEFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUFvR0NDcUdTTTQ5QkFNQ0EwZ0FNRVVDSVFDMlhwUFFnUXpXYWUzYjVwWnQKR2N1TWZESjBjME9QS2NuZWdrWFoyQzRCM2dJZ1Uvc1Jrd0lwTFFOUlYrRWFZdzRQNVQ1Z1BFNlkrVnBtQzk4aApvVmpaL3pRPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0t
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
new file mode 100644
index 000000000..6949425c3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
new file mode 100644
index 000000000..fbf4cd0da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
new file mode 100644
index 000000000..da4aeea8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.in.yaml
@@ -0,0 +1,55 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: Same
+    status:
+      listeners:
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+    status:
+      parents:
+        - parentRef:
+            namespace: default
+            name: gateway-1
+          controllerName: apk.wso2.com/gatewayclass-controller
+          conditions:
+            - type: Accepted
+              status: "True"
+              reason: Accepted
+              message: Route is accepted
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
new file mode 100644
index 000000000..e6c5dec57
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-preexisting-status-condition.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
new file mode 100644
index 000000000..27fc4622a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
new file mode 100644
index 000000000..5f12b5c6c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-tcproutes.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10162
+          name: tcp
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same TCP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
new file mode 100644
index 000000000..0d8be2905
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
new file mode 100644
index 000000000..90932e5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-single-listener-with-multiple-udproutes.out.yaml
@@ -0,0 +1,136 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10162
+          name: udp
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same UDP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
new file mode 100644
index 000000000..f40fbbe83
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.in.yaml
@@ -0,0 +1,69 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: https
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: Same
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+    status:
+      listeners:
+        - name: https
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+        - name: http
+          supportedKinds:
+            - group: gateway.networking.k8s.io
+              kind: HTTPRoute
+          attachedRoutes: 1
+          conditions:
+            - type: Programmed
+              status: "True"
+              reason: Programmed
+              message: Listener has been successfully translated
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - name: gateway-1
+          namespace: default
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: default
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
new file mode 100644
index 000000000..10ae0979e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-stale-status-condition.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/https
+        ports:
+        - containerPort: 10443
+          name: https
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/https
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: default/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
new file mode 100644
index 000000000..049c79741
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TLS
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
new file mode 100644
index 000000000..ca1cdd348
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-tcp-or-tls-port.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 162
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 162
+      protocol: TLS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Only one TCP/TLS listener is allowed in a given port
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is TLS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10162
+          name: tcp1
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
new file mode 100644
index 000000000..50601282f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
new file mode 100644
index 000000000..fbb6bdc8c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-on-same-udp-port.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 162
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Only one UDP listener is allowed in a given port
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10162
+          name: udp1
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
new file mode 100644
index 000000000..90fe76523
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: tls-1
+      protocol: TLS
+      tls:
+        mode: Passthrough
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
new file mode 100644
index 000000000..20716b62a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-http-and-tlsroute-same-hostname-and-port.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls-1
+      port: 80
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
new file mode 100644
index 000000000..d0cadfda0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: http-2
+      protocol: HTTP
+      port: 81
+      hostname: bar.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/test"
+      backendRefs:
+      - name: service-2
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
new file mode 100644
index 000000000..51077a7f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
@@ -0,0 +1,266 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 81
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /test
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 10081
+          name: http-2
+          protocol: HTTP
+          servicePort: 81
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /test
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
new file mode 100644
index 000000000..69b93f3b1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-1
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+    - name: http-2
+      protocol: HTTP
+      port: 80
+      hostname: foo.com
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
new file mode 100644
index 000000000..c620ac15e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-hostname.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a unique hostname
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
new file mode 100644
index 000000000..37c0a342f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTPS
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
new file mode 100644
index 000000000..0052f3f6f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-and-incompatible-protocol.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTPS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a compatible protocol
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: All listeners for a given port must use a compatible protocol
+        reason: ProtocolConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
new file mode 100644
index 000000000..34bd7a43e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.in.yaml
@@ -0,0 +1,53 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*"
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp
+          protocol: TCP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
new file mode 100644
index 000000000..19401c821
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
@@ -0,0 +1,208 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*'
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp
+      port: 80
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/tcp
+        ports:
+        - containerPort: 10080
+          name: tcp
+          protocol: TCP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp/tcproute-1
+      port: 10080
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
new file mode 100644
index 000000000..d4ef5be9e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.in.yaml
@@ -0,0 +1,53 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*"
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp
+          protocol: UDP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
new file mode 100644
index 000000000..9d48e0cdd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
@@ -0,0 +1,207 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*'
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/udp
+        ports:
+        - containerPort: 10080
+          name: udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp/udproute-1
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
new file mode 100644
index 000000000..a4bb69bb7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TCP
+          port: 163
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: tcp1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: tcp2
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
new file mode 100644
index 000000000..577112861
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-with-sectionname.out.yaml
@@ -0,0 +1,188 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 162
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 163
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10162
+          name: tcp1
+          protocol: TCP
+          servicePort: 162
+      - address: null
+        name: envoy-gateway/gateway-1/tcp2
+        ports:
+        - containerPort: 10163
+          name: tcp2
+          protocol: TCP
+          servicePort: 163
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: tcp1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: tcp1
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: tcp2
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: tcp2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10162
+      tls: {}
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp2/tcproute-2
+      port: 10163
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
new file mode 100644
index 000000000..1ba01ba6c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tcp1
+          protocol: TCP
+          port: 161
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tcp2
+          protocol: TCP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8163
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
new file mode 100644
index 000000000..9c3c7ba54
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-tcproutes-without-sectionname.out.yaml
@@ -0,0 +1,184 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp1
+      port: 161
+      protocol: TCP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tcp2
+      port: 162
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tcp1
+        ports:
+        - containerPort: 10161
+          name: tcp1
+          protocol: TCP
+          servicePort: 161
+      - address: null
+        name: envoy-gateway/gateway-1/tcp2
+        ports:
+        - containerPort: 10162
+          name: tcp2
+          protocol: TCP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8163
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same TCP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp1/tcproute-1
+      port: 10161
+      tls: {}
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8163
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tcp2/tcproute-1
+      port: 10162
+      tls: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
new file mode 100644
index 000000000..dc3a42ab7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 163
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: udp1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: udp2
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
new file mode 100644
index 000000000..b0e951037
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-with-sectionname.out.yaml
@@ -0,0 +1,186 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 162
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 163
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10162
+          name: udp1
+          protocol: UDP
+          servicePort: 162
+      - address: null
+        name: envoy-gateway/gateway-1/udp2
+        ports:
+        - containerPort: 10163
+          name: udp2
+          protocol: UDP
+          servicePort: 163
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: udp1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: udp1
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: udp2
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: udp2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10162
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp2/udproute-2
+      port: 10163
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
new file mode 100644
index 000000000..2638f0f19
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: udp1
+          protocol: UDP
+          port: 161
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: udp2
+          protocol: UDP
+          port: 162
+          allowedRoutes:
+            namespaces:
+              from: All
+udpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8162
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: UDPRoute
+    metadata:
+      namespace: default
+      name: udproute-2
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-2
+              port: 8162
diff --git a/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
new file mode 100644
index 000000000..999c2e716
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/gateway-with-two-listeners-with-udproutes-without-sectionname.out.yaml
@@ -0,0 +1,182 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp1
+      port: 161
+      protocol: UDP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: udp2
+      port: 162
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/udp1
+        ports:
+        - containerPort: 10161
+          name: udp1
+          protocol: UDP
+          servicePort: 161
+      - address: null
+        name: envoy-gateway/gateway-1/udp2
+        ports:
+        - containerPort: 10162
+          name: udp2
+          protocol: UDP
+          servicePort: 162
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+udpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: UDPRoute
+  metadata:
+    creationTimestamp: null
+    name: udproute-2
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8162
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Multiple routes on the same UDP listener
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    udp:
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp1/udproute-1
+      port: 10161
+    - address: 0.0.0.0
+      destination:
+        name: udproute/default/udproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8162
+          protocol: UDP
+          weight: 1
+      name: envoy-gateway/gateway-1/udp2/udproute-1
+      port: 10162
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
new file mode 100644
index 000000000..69bfd7a1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
new file mode 100644
index 000000000..df188f66a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-empty-backends.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /com.ExampleExact
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
new file mode 100644
index 000000000..ae2baa8dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
new file mode 100644
index 000000000..33d91c16f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-header-match.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
new file mode 100644
index 000000000..82e319fd2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          method: "Example"
+          service: "com.example"
+          type: Exact
+      - method:
+          method: "Foobar"
+          service: "foo.*"
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
new file mode 100644
index 000000000..79a8f24a6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-and-service-match.out.yaml
@@ -0,0 +1,154 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          method: Example
+          service: com.example
+          type: Exact
+      - method:
+          method: Foobar
+          service: foo.*
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /com.example/Example
+          name: ""
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /foo.*/Foobar
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
new file mode 100644
index 000000000..e2a374d14
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          method: ExampleExact
+          type: Exact
+      - method:
+          method: FooBar[0-9]+
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
new file mode 100644
index 000000000..e63d54ce4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-method-match.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          method: ExampleExact
+          type: Exact
+      - method:
+          method: FooBar[0-9]+
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /(?i)\.?[a-z_][a-z_0-9]*(\.[a-z_][a-z_0-9]*)*/FooBar[0-9]+
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        headerMatches:
+        - distinct: false
+          name: :path
+          suffix: /ExampleExact
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
new file mode 100644
index 000000000..2c48dad58
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - filters:
+      - type: "RequestHeaderModifier"
+        requestHeaderModifier:
+          add:
+          - name: "my-header"
+            value: "foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
new file mode 100644
index 000000000..6bc3ca36f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-request-header-modifier.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: my-header
+            value: foo
+        type: RequestHeaderModifier
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: my-header
+          value: foo
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
new file mode 100644
index 000000000..ad245cb18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+      - method:
+          service: com.[A-Z]+
+          type: RegularExpression
+      backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
new file mode 100644
index 000000000..0c7c7c743
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/grpcroute-with-service-match.out.yaml
@@ -0,0 +1,152 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method:
+          service: com.ExampleExact
+          type: Exact
+      - method:
+          service: com.[A-Z]+
+          type: RegularExpression
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/1/*
+        pathMatch:
+          distinct: false
+          name: ""
+          safeRegex: /com.[A-Z]+/[A-Za-z_][A-Za-z_0-9]*
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /com.ExampleExact
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
new file mode 100644
index 000000000..3d3adbd5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.in.yaml
@@ -0,0 +1,54 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      timeouts:
+        request: 1s
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20kib
+      http:
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
new file mode 100644
index 000000000..7573ae622
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
@@ -0,0 +1,169 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20kib
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: 'Timeout: invalid ConnectTimeout value 20kib'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 1s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
new file mode 100644
index 000000000..d399d2f6e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.in.yaml
@@ -0,0 +1,100 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      timeouts:
+        request: 1s
+      backendRefs:
+      - name: service-1
+        port: 8080
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      tcp:
+        connectTimeout: 15s
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      tcp:
+        connectTimeout: 20s
+      http:
+        maxConnectionDuration: 22s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
new file mode 100644
index 000000000..82870b6b5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -0,0 +1,329 @@
+backendTrafficPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    timeout:
+      http:
+        maxConnectionDuration: 22s
+      tcp:
+        connectTimeout: 20s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: BackendTrafficPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    timeout:
+      http:
+        connectionIdleTimeout: 16s
+        maxConnectionDuration: 17s
+      tcp:
+        connectTimeout: 15s
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+        timeout:
+          http:
+            connectionIdleTimeout: 16s
+            maxConnectionDuration: 17s
+          tcp:
+            connectTimeout: 15s
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            maxConnectionDuration: 22s
+            requestTimeout: 1s
+          tcp:
+            connectTimeout: 20s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
new file mode 100644
index 000000000..d44d02d16
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.in.yaml
@@ -0,0 +1,82 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 81
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 82
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-3
+          protocol: HTTP
+          port: 83
+          hostname: foo1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-4
+          protocol: HTTP
+          port: 84
+          hostname: bar1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-5
+          protocol: HTTP
+          port: 85
+          hostname: foo2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-6
+          protocol: HTTP
+          port: 86
+          hostname: bar2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-7
+          protocol: HTTP
+          port: 87
+          hostname: foo3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-8
+          protocol: HTTP
+          port: 88
+          hostname: bar3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
new file mode 100644
index 000000000..e7aaca900
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
@@ -0,0 +1,590 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 81
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 82
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo1.com
+      name: http-3
+      port: 83
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar1.com
+      name: http-4
+      port: 84
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo2.com
+      name: http-5
+      port: 85
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar2.com
+      name: http-6
+      port: 86
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo3.com
+      name: http-7
+      port: 87
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar3.com
+      name: http-8
+      port: 88
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-6
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-7
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-8
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10081
+          name: http-1
+          protocol: HTTP
+          servicePort: 81
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 10082
+          name: http-2
+          protocol: HTTP
+          servicePort: 82
+      - address: null
+        name: envoy-gateway/gateway-1/http-3
+        ports:
+        - containerPort: 10083
+          name: http-3
+          protocol: HTTP
+          servicePort: 83
+      - address: null
+        name: envoy-gateway/gateway-1/http-4
+        ports:
+        - containerPort: 10084
+          name: http-4
+          protocol: HTTP
+          servicePort: 84
+      - address: null
+        name: envoy-gateway/gateway-1/http-5
+        ports:
+        - containerPort: 10085
+          name: http-5
+          protocol: HTTP
+          servicePort: 85
+      - address: null
+        name: envoy-gateway/gateway-1/http-6
+        ports:
+        - containerPort: 10086
+          name: http-6
+          protocol: HTTP
+          servicePort: 86
+      - address: null
+        name: envoy-gateway/gateway-1/http-7
+        ports:
+        - containerPort: 10087
+          name: http-7
+          protocol: HTTP
+          servicePort: 87
+      - address: null
+        name: envoy-gateway/gateway-1/http-8
+        ports:
+        - containerPort: 10088
+          name: http-8
+          protocol: HTTP
+          servicePort: 88
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10082
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10083
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10084
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10085
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-6
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10086
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-7
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10087
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-8
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10088
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
new file mode 100644
index 000000000..d2078deb7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.in.yaml
@@ -0,0 +1,82 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-3
+          protocol: HTTP
+          port: 80
+          hostname: foo1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-4
+          protocol: HTTP
+          port: 80
+          hostname: bar1.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-5
+          protocol: HTTP
+          port: 80
+          hostname: foo2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-6
+          protocol: HTTP
+          port: 80
+          hostname: bar2.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-7
+          protocol: HTTP
+          port: 80
+          hostname: foo3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-8
+          protocol: HTTP
+          port: 80
+          hostname: bar3.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
new file mode 100644
index 000000000..5f127b4a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
@@ -0,0 +1,541 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo1.com
+      name: http-3
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar1.com
+      name: http-4
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo2.com
+      name: http-5
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar2.com
+      name: http-6
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo3.com
+      name: http-7
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar3.com
+      name: http-8
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-5
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-6
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-7
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-8
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar1.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar1.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar1_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-5
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar2.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-6
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar2_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - foo3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-7
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar3.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-8
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar3.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar3_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
new file mode 100644
index 000000000..2a5c0e34b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: tls
+          protocol: HTTPS
+          port: 443
+          allowedRoutes:
+            namespaces:
+              from: All
+          tls:
+            mode: Terminate
+            certificateRefs:
+              - name: tls-secret-1
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
new file mode 100644
index 000000000..3825b8ac8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
@@ -0,0 +1,203 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10443
+          name: tls
+          protocol: HTTPS
+          servicePort: 443
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/tls
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10443
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      tls:
+        certificates:
+        - name: envoy-gateway/tls-secret-1
+          privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+          serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
new file mode 100644
index 000000000..8b11c8da7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
new file mode 100644
index 000000000..b419de26e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -0,0 +1,187 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
new file mode 100644
index 000000000..2946dfeb1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
new file mode 100644
index 000000000..691ad8691
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-gateway.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
new file mode 100644
index 000000000..ec02f8881
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+          port: 80
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
new file mode 100644
index 000000000..e7b2a7053
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-matching-port.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      port: 80
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        port: 80
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
new file mode 100644
index 000000000..bc9aba4dd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+        - name: http-2
+          protocol: HTTP
+          port: 80
+          hostname: bar.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http-2
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
new file mode 100644
index 000000000..6b6523e55
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -0,0 +1,169 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: bar.com
+      name: http-2
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http-2
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http-2
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - bar.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
new file mode 100644
index 000000000..0c00de607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-2
+              port: 8081
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-2
+    spec:
+      ips:
+        - 8.8.8.8
+      ports:
+        - port: 8081
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-2
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "1.2.3.4"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
new file mode 100644
index 000000000..87823b3a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
@@ -0,0 +1,141 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-2
+        port: 8081
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Mixed endpointslice address type between backendRefs is not supported
+        reason: ResolvedRefs
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 1.2.3.4
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
new file mode 100644
index 000000000..8ad5fa129
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.in.yaml
@@ -0,0 +1,99 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-2
+              port: 8081
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-2
+    spec:
+      ips:
+        - 8.8.8.8
+      ports:
+        - port: 8081
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-2
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "bar.foo"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
new file mode 100644
index 000000000..5fe7303cc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
@@ -0,0 +1,141 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-2
+        port: 8081
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: FQDN
+            endpoints:
+            - host: bar.foo
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
new file mode 100644
index 000000000..7fa56a4ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
new file mode 100644
index 000000000..d243d7e8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: FQDN
+            endpoints:
+            - host: foo.bar
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
new file mode 100644
index 000000000..c58ed15d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.in.yaml
@@ -0,0 +1,83 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "1.2.3.4"
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-2
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: FQDN
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8081
+    endpoints:
+      - addresses:
+          - "foo.bar"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
new file mode 100644
index 000000000..690b29467
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
@@ -0,0 +1,133 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Mixed endpointslice address type for the same backendRef is not supported
+        reason: ResolvedRefs
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: Mixed
+            endpoints:
+            - host: 1.2.3.4
+              port: 8080
+            - host: foo.bar
+              port: 8081
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
new file mode 100644
index 000000000..26a816b93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.in.yaml
@@ -0,0 +1,66 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: default
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: default
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "8.8.8.8"
+        conditions:
+          ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
new file mode 100644
index 000000000..6188955f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
new file mode 100644
index 000000000..6766b18f5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
new file mode 100644
index 000000000..d4796986c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-attaching-to-listener.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
new file mode 100644
index 000000000..f16077de3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          timeouts:
+            backendRequest: 1s
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
new file mode 100644
index 000000000..8d3b1b91e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-backend-request-timeout.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        backendRequest: 1s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 1s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
new file mode 100644
index 000000000..006001996
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-1
+          protocol: HTTP
+          port: 80
+          hostname: foo.com
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          port: 81
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
new file mode 100644
index 000000000..776f3dc5c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-not-attaching-to-listener-non-matching-port.out.yaml
@@ -0,0 +1,110 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: http-1
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-1
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      port: 81
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: No listeners match this parent ref
+        reason: NoMatchingParent
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        port: 81
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http-1
+        ports:
+        - containerPort: 10080
+          name: http-1
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - foo.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-1
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
new file mode 100644
index 000000000..6cf2210aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          timeouts:
+            request: 5s
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
new file mode 100644
index 000000000..6318ac412
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-request-timeout.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+      timeouts:
+        request: 5s
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        timeout:
+          http:
+            requestTimeout: 5s
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
new file mode 100644
index 000000000..ba4acbbc7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
new file mode 100644
index 000000000..6ab06d6c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-empty-backends-and-no-filters.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
new file mode 100644
index 000000000..2e9cddb58
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+            - name: service-2
+              port: 8080
+            - name: service-3
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
new file mode 100644
index 000000000..6f1fc5101
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      - name: service-2
+        port: 8080
+      - name: service-3
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
new file mode 100644
index 000000000..e3419de8d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
+              weight: 1
+            - name: service-2
+              port: 8080
+              weight: 2
+            - name: service-3
+              port: 8080
+              weight: 3
+            - name: service-4
+              port: 8080
+              weight: 0
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
new file mode 100644
index 000000000..cb32420be
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -0,0 +1,149 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+        weight: 1
+      - name: service-2
+        port: 8080
+        weight: 2
+      - name: service-3
+        port: 8080
+        weight: 3
+      - name: service-4
+        port: 8080
+        weight: 0
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 2
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 3
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..c1d5723e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,79 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: backends
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: backends
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..faf1be2da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..e445c5636
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,81 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-1
+              namespace: backends
+              port: 8080
+serviceImports:
+  - apiVersion: multicluster.x-k8s.io/v1alpha1
+    kind: ServiceImport
+    metadata:
+      namespace: backends
+      name: service-import-1
+    spec:
+      ips:
+        - 7.7.7.7
+      ports:
+        - port: 8080
+          name: http
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: service-import-1
+      namespace: backends
+      labels:
+        multicluster.kubernetes.io/service-name: service-import-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "8.8.8.8"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: backends
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: HTTPRoute
+          namespace: default
+      to:
+        - group: multicluster.x-k8s.io
+          kind: ServiceImport
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..5eed2bb32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,131 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
new file mode 100644
index 000000000..14755bccb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
new file mode 100644
index 000000000..bcf7af32c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-empty-matches.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/-1/*
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
new file mode 100644
index 000000000..d98ef6905
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-2"
+            value: "some-value"
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-3"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
new file mode 100644
index 000000000..b9e0b9be4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -0,0 +1,157 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-2
+            value: some-value
+        type: RequestHeaderModifier
+      - requestHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-3
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: add-header-1
+          value: some-value
+        - append: true
+          name: add-header-2
+          value: some-value
+        - append: true
+          name: add-header-3
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
new file mode 100644
index 000000000..ccae4c43a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
new file mode 100644
index 000000000..69c6f158c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
new file mode 100644
index 000000000..9f142279a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-2"
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-3"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
new file mode 100644
index 000000000..8e57d7c08
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-2
+        type: RequestHeaderModifier
+      - requestHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-3
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - rem-header-1
+        - rem-header-2
+        - rem-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
new file mode 100644
index 000000000..347d58dca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "some-header-1"
+          - "some-header-1"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
new file mode 100644
index 000000000..62bc219c0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
@@ -0,0 +1,140 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - some-header-1
+          - some-header-1
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - some-header-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
new file mode 100644
index 000000000..5c8103861
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "example-header-1"
+            value: ""
+          add:
+          - name: "example-header-2"
+            value: ""
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
new file mode 100644
index 000000000..600bf0fa8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-header-values.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: example-header-2
+            value: ""
+          set:
+          - name: example-header-1
+            value: ""
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: example-header-2
+          value: ""
+        - append: false
+          name: example-header-1
+          value: ""
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
new file mode 100644
index 000000000..b6659fa32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: ""
+            value: "some-value"
+          add:
+          - name: ""
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
new file mode 100644
index 000000000..fc890c1f4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-empty-headers.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: ""
+            value: some-value
+          - name: good-header
+            value: some-value
+          set:
+          - name: ""
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: RequestHeaderModifier Filter cannot set a header with an empty name
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
new file mode 100644
index 000000000..cec0b7702
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: "example:1"
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+          add:
+          - name: "example/2"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
new file mode 100644
index 000000000..a224d9440
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-invalid-headers.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: example/2
+            value: some-value
+          set:
+          - name: example:1
+            value: some-value
+          - name: good-header
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'RequestHeaderModifier Filter cannot set headers with a ''/'' or
+          '':'' character in them. Header: ''example:1'''
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
new file mode 100644
index 000000000..c7b7cc8a8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          set:
+          remove:
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
new file mode 100644
index 000000000..8da34b9aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-headers.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier: {}
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
new file mode 100644
index 000000000..982138ca2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          add:
+          - name: "bad:header"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
new file mode 100644
index 000000000..26599e6ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-no-valid-headers.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: bad:header
+            value: some-value
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: RequestHeaderModifier Filter did not provide valid configuration
+          to add/set/remove any headers
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
new file mode 100644
index 000000000..48d62f8d0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          remove:
+          - "example-header-1"
+          - "example-header-2"
+          - "example-header-3"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
new file mode 100644
index 000000000..800dbf826
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-header-filter-remove.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          remove:
+          - example-header-1
+          - example-header-2
+          - example-header-3
+        type: RequestHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - example-header-1
+        - example-header-2
+        - example-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
new file mode 100644
index 000000000..85d2eabc2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          type: Exact
+          value: "/exact"
+      backendRefs:
+      - name: service-1
+        port: 8888
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    name: service-1
+  spec:
+    clusterIP: 7.7.7.7
+    ports:
+    - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
new file mode 100644
index 000000000..8f1ea3e60
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8888
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: TCP Port 8888 not found on service default/service-1
+        reason: PortNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
new file mode 100644
index 000000000..66905669e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.in.yaml
@@ -0,0 +1,45 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              group: "invalid"
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
new file mode 100644
index 000000000..59dc0c3dd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
@@ -0,0 +1,125 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: invalid
+        name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Group is invalid, only the core API group (specified by omitting
+          the group field or setting it to an empty string) and multicluster.x-k8s.io
+          are supported
+        reason: InvalidKind
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
new file mode 100644
index 000000000..8914c502c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              kind: "URL"
+              port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
new file mode 100644
index 000000000..0009e0dc3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - kind: URL
+        name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Kind is invalid, only Service and MCS ServiceImport are supported
+        reason: InvalidKind
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
new file mode 100644
index 000000000..90664bbd4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
new file mode 100644
index 000000000..1a5fdd9e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: PortNotSpecified
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
new file mode 100644
index 000000000..35593cde2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - group: multicluster.x-k8s.io
+              kind: ServiceImport
+              name: service-import-that-doesnt-exist
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
new file mode 100644
index 000000000..0fdd26254
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - group: multicluster.x-k8s.io
+        kind: ServiceImport
+        name: service-import-that-doesnt-exist
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: ServiceImport default/service-import-that-doesnt-exist not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
new file mode 100644
index 000000000..d56d23d0c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-that-doesnt-exist
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
new file mode 100644
index 000000000..73fbe7166
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
@@ -0,0 +1,121 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-that-doesnt-exist
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-that-doesnt-exist not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
new file mode 100644
index 000000000..236a10736
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          type: Exact
+          value: "/exact"
+      backendRefs:
+      - name: service-1
+        port: 8080
+        filters:
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+            - name: "set-header-1"
+              value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
new file mode 100644
index 000000000..30cdf9673
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backend-ref-unsupported-filter.out.yaml
@@ -0,0 +1,127 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - filters:
+        - responseHeaderModifier:
+            set:
+            - name: set-header-1
+              value: some-value
+          type: ResponseHeaderModifier
+        name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: The filters field within BackendRef is not supported
+        reason: UnsupportedRefValue
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
new file mode 100644
index 000000000..833ca4ad0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              namespace: backends
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: backends
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
new file mode 100644
index 000000000..b74619520
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: backends
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Backend ref to Service backends/service-1 not permitted by any ReferenceGrant.
+        reason: RefNotPermitted
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
new file mode 100644
index 000000000..1b114bdc5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-2
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 81
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+
+      rules:
+        - matches:
+            - path:
+                type: RegularExpression
+                value: "*.foo.bar.com"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
new file mode 100644
index 000000000..a71a4cee6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-invalid-regex.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 81
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: RegularExpression
+          value: '*.foo.bar.com'
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Regex "*.foo.bar.com" is invalid: error parsing regexp: missing
+          argument to repetition operator: `*`'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10081
+          name: http
+          protocol: HTTP
+          servicePort: 81
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10081
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
new file mode 100644
index 000000000..9b21f53ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.in.yaml
@@ -0,0 +1,50 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
new file mode 100644
index 000000000..ad7c1b832
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-duplicates.out.yaml
@@ -0,0 +1,162 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        - name: httproute/default/httproute-1/rule/0-mirror-1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
new file mode 100644
index 000000000..0e7fe4865
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.in.yaml
@@ -0,0 +1,62 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestHeaderModifier
+        requestHeaderModifier:
+          set:
+          - name: X-Header-Set
+            value: set-overwrites-values
+          add:
+          - name: X-Header-Add
+            value: header-val-1
+          - name: X-Header-Add-Append
+            value: header-val-2
+          remove:
+          - X-Header-Remove
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: mirror-service
+            port: 8080
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
new file mode 100644
index 000000000..9c1575888
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-multiple.out.yaml
@@ -0,0 +1,186 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestHeaderModifier:
+          add:
+          - name: X-Header-Add
+            value: header-val-1
+          - name: X-Header-Add-Append
+            value: header-val-2
+          remove:
+          - X-Header-Remove
+          set:
+          - name: X-Header-Set
+            value: set-overwrites-values
+        type: RequestHeaderModifier
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: mirror-service
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addRequestHeaders:
+        - append: true
+          name: X-Header-Add
+          value: header-val-1
+        - append: true
+          name: X-Header-Add-Append
+          value: header-val-2
+        - append: false
+          name: X-Header-Set
+          value: set-overwrites-values
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-1
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        - name: httproute/default/httproute-1/rule/0-mirror-2
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.6.5.4
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeRequestHeaders:
+        - X-Header-Remove
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
new file mode 100644
index 000000000..3c5204ca2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
new file mode 100644
index 000000000..8eaec664b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: PortNotSpecified
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
new file mode 100644
index 000000000..bd9b63a40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-unknown
+            port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
new file mode 100644
index 000000000..0255c22dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-unknown
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-unknown not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
new file mode 100644
index 000000000..526e5c01c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: RequestMirror
+        requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
new file mode 100644
index 000000000..139d70fca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-mirror-filter.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - requestMirror:
+          backendRef:
+            kind: Service
+            name: service-1
+            port: 8080
+        type: RequestMirror
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        mirrors:
+        - name: httproute/default/httproute-1/rule/0-mirror-0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..51dd2e3d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - whales.kubernetes.io
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..0f9e160ff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-non-matching-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - whales.kubernetes.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There were no hostname intersections between the HTTPRoute and this
+          parent ref's Listener(s).
+        reason: NoMatchingListenerHostname
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
new file mode 100644
index 000000000..679d88528
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /redirected
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
new file mode 100644
index 000000000..52c8fddab
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
@@ -0,0 +1,136 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          path:
+            replaceFullPath: /redirected
+            type: ReplaceFullPath
+          scheme: https
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: null
+          path:
+            fullReplace: /redirected
+            prefixMatchReplace: null
+          port: 443
+          scheme: https
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
new file mode 100644
index 000000000..ab244b058
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          hostname: "redirected.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
new file mode 100644
index 000000000..95c55f2d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-hostname.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          hostname: redirected.com
+          scheme: https
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: redirected.com
+          path: null
+          port: 443
+          scheme: https
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
new file mode 100644
index 000000000..09583b2b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ExtensionRef
+        extensionRef:
+          group: unsupported.group.io
+          kind: UnsupportedKind
+          name: unsupported
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
new file mode 100644
index 000000000..ae17d799a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-filter-type.out.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - extensionRef:
+          group: unsupported.group.io
+          kind: UnsupportedKind
+          name: unsupported
+        type: ExtensionRef
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Invalid filter ExtensionRef: unknown kind unsupported.group.io/UnsupportedKind'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
new file mode 100644
index 000000000..00fe8b6f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.in.yaml
@@ -0,0 +1,38 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: unknown
+          statusCode: 301
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
new file mode 100644
index 000000000..9836a529f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-scheme.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          scheme: unknown
+          statusCode: 301
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Scheme: unknown is unsupported, only ''https'' and ''http'' are
+          supported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
new file mode 100644
index 000000000..134a1b3f9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.in.yaml
@@ -0,0 +1,39 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 666
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
new file mode 100644
index 000000000..66948bda2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-invalid-status.out.yaml
@@ -0,0 +1,114 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          scheme: https
+          statusCode: 666
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Status code 666 is invalid, only 302 and 301 are supported
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
new file mode 100644
index 000000000..593e057f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: http
+          statusCode: 302
+          port: 8080
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /redirected
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
new file mode 100644
index 000000000..abbfe08b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
@@ -0,0 +1,137 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - filters:
+      - requestRedirect:
+          path:
+            replacePrefixMatch: /redirected
+            type: ReplacePrefixMatch
+          port: 8080
+          scheme: http
+          statusCode: 302
+        type: RequestRedirect
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        redirect:
+          hostname: null
+          path:
+            fullReplace: null
+            prefixMatchReplace: /redirected
+          port: 8080
+          scheme: http
+          statusCode: 302
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
new file mode 100644
index 000000000..73d50049d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.in.yaml
@@ -0,0 +1,57 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
new file mode 100644
index 000000000..99721e5b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-adds.out.yaml
@@ -0,0 +1,169 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
new file mode 100644
index 000000000..d0d7618f7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.in.yaml
@@ -0,0 +1,52 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-2"
+            value: "some-value"
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "add-header-1"
+            value: "some-value"
+          - name: "add-header-3"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
new file mode 100644
index 000000000..60e8c9fd1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -0,0 +1,157 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-2
+            value: some-value
+        type: ResponseHeaderModifier
+      - responseHeaderModifier:
+          add:
+          - name: add-header-1
+            value: some-value
+          - name: add-header-3
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: add-header-1
+          value: some-value
+        - append: true
+          name: add-header-2
+          value: some-value
+        - append: true
+          name: add-header-3
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
new file mode 100644
index 000000000..882b82282
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.in.yaml
@@ -0,0 +1,61 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "set-header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          - name: "set-header-4"
+            value: "some-value"
+          add:
+          - name: "Set-Header-1"
+            value: "some-value"
+          - name: "set-header-2"
+            value: "some-value"
+          - name: "set-header-3"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
+          - name: "set-header-5"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
new file mode 100644
index 000000000..91a37eb93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: Set-Header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          - name: set-header-5
+            value: some-value
+          set:
+          - name: set-header-1
+            value: some-value
+          - name: set-header-2
+            value: some-value
+          - name: set-header-3
+            value: some-value
+          - name: set-header-4
+            value: some-value
+          - name: set-header-4
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: Set-Header-1
+          value: some-value
+        - append: true
+          name: set-header-2
+          value: some-value
+        - append: true
+          name: set-header-3
+          value: some-value
+        - append: true
+          name: set-header-5
+          value: some-value
+        - append: false
+          name: set-header-4
+          value: some-value
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
new file mode 100644
index 000000000..c1f62250c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-2"
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "rem-header-1"
+          - "rem-header-3"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
new file mode 100644
index 000000000..ce339d0d7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-2
+        type: ResponseHeaderModifier
+      - responseHeaderModifier:
+          remove:
+          - rem-header-1
+          - rem-header-3
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - rem-header-1
+        - rem-header-2
+        - rem-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
new file mode 100644
index 000000000..e77287f9e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "some-header-1"
+          - "some-header-1"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
new file mode 100644
index 000000000..07eb5708d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
@@ -0,0 +1,140 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - some-header-1
+          - some-header-1
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - some-header-1
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
new file mode 100644
index 000000000..8a1383752
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "example-header-1"
+            value: ""
+          add:
+          - name: "example-header-2"
+            value: ""
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
new file mode 100644
index 000000000..5e6273a77
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
@@ -0,0 +1,148 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: example-header-2
+            value: ""
+          set:
+          - name: example-header-1
+            value: ""
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - addResponseHeaders:
+        - append: true
+          name: example-header-2
+          value: ""
+        - append: false
+          name: example-header-1
+          value: ""
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
new file mode 100644
index 000000000..edddd1b5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: ""
+            value: "some-value"
+          add:
+          - name: ""
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
new file mode 100644
index 000000000..7f394b273
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-empty-headers.out.yaml
@@ -0,0 +1,123 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: ""
+            value: some-value
+          - name: good-header
+            value: some-value
+          set:
+          - name: ""
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ResponseHeaderModifier Filter cannot set a header with an empty name
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
new file mode 100644
index 000000000..93a13bbba
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          set:
+          - name: "example:1"
+            value: "some-value"
+          - name: "good-header"
+            value: "some-value"
+          add:
+          - name: "example/2"
+            value: "some-value"
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
new file mode 100644
index 000000000..9c731253e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-invalid-headers.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: example/2
+            value: some-value
+          set:
+          - name: example:1
+            value: some-value
+          - name: good-header
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'ResponseHeaderModifier Filter cannot set headers with a ''/'' or
+          '':'' character in them. Header: ''example:1'''
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
new file mode 100644
index 000000000..c2331bdad
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          set:
+          remove:
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
new file mode 100644
index 000000000..06d127d5f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-headers.out.yaml
@@ -0,0 +1,135 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier: {}
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
new file mode 100644
index 000000000..4c29af176
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          add:
+          - name: "bad:header"
+            value: "some-value"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
new file mode 100644
index 000000000..72358a130
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-no-valid-headers.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          add:
+          - name: bad:header
+            value: some-value
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ResponseHeaderModifier Filter did not provide valid configuration
+          to add/set/remove any headers
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
new file mode 100644
index 000000000..1a793c4c0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: ResponseHeaderModifier
+        responseHeaderModifier:
+          remove:
+          - "example-header-1"
+          - "example-header-2"
+          - "example-header-3"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
new file mode 100644
index 000000000..5665378d9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-response-header-filter-remove.out.yaml
@@ -0,0 +1,143 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - responseHeaderModifier:
+          remove:
+          - example-header-1
+          - example-header-2
+          - example-header-3
+        type: ResponseHeaderModifier
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        removeResponseHeaders:
+        - example-header-1
+        - example-header-2
+        - example-header-3
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
new file mode 100644
index 000000000..af7ae3628
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
new file mode 100644
index 000000000..04b1c1ec3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -0,0 +1,128 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
new file mode 100644
index 000000000..ee0320816
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - method: POST
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
new file mode 100644
index 000000000..9f1a599e7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
@@ -0,0 +1,126 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - method: POST
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: POST
+          name: :method
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
new file mode 100644
index 000000000..2ec00c37a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.in.yaml
@@ -0,0 +1,63 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+              headers:
+                - name: Header-1
+                  type: Exact
+                  value: "exact"
+              queryParams:
+                - name: QueryParam-1
+                  type: Exact
+                  value: "exact"
+          backendRefs:
+            - name: service-1
+              port: 8080
+        - matches:
+            - path:
+                type: PathPrefix
+                value: "/prefix"
+          backendRefs:
+            - name: service-2
+              port: 8080
+        - matches:
+            - path:
+                type: RegularExpression
+                value: "*regex*"
+              headers:
+                - name: Header-1
+                  type: RegularExpression
+                  value: "*regex*"
+              queryParams:
+                - name: QueryParam-1
+                  type: RegularExpression
+                  value: "*regex*"
+          backendRefs:
+            - name: service-3
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
new file mode 100644
index 000000000..96d72ccde
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-multiple-rules.out.yaml
@@ -0,0 +1,134 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          type: Exact
+          value: exact
+        path:
+          type: Exact
+          value: /exact
+        queryParams:
+        - name: QueryParam-1
+          type: Exact
+          value: exact
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          type: PathPrefix
+          value: /prefix
+    - backendRefs:
+      - name: service-3
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          type: RegularExpression
+          value: '*regex*'
+        path:
+          type: RegularExpression
+          value: '*regex*'
+        queryParams:
+        - name: QueryParam-1
+          type: RegularExpression
+          value: '*regex*'
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Regex "*regex*" is invalid: error parsing regexp: missing argument
+          to repetition operator: `*`'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
new file mode 100644
index 000000000..7709a6945
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.in.yaml
@@ -0,0 +1,37 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                value: "/pathprefix"
+              headers:
+                - name: Header-1
+                  value: Val-1
+                - name: Header-2
+                  value: Val-2
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
new file mode 100644
index 000000000..eb419ab3f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -0,0 +1,139 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: Header-1
+          value: Val-1
+        - name: Header-2
+          value: Val-2
+        path:
+          value: /pathprefix
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: Val-1
+          name: Header-1
+        - distinct: false
+          exact: Val-2
+          name: Header-2
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /pathprefix
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
new file mode 100644
index 000000000..dbd94a92b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - matches:
+            - path:
+                type: Exact
+                value: "/exact"
+          backendRefs:
+            - name: service-that-doesnt-exist
+              port: 8080
+            - name: service-that-doesnt-exist-2
+              port: 8080
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      name: service-1
+    spec:
+      clusterIP: 7.7.7.7
+      ports:
+        - port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
new file mode 100644
index 000000000..50eeb2a32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
@@ -0,0 +1,132 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-that-doesnt-exist
+        port: 8080
+      - name: service-that-doesnt-exist-2
+        port: 8080
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          type: Exact
+          value: /exact
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service default/service-that-doesnt-exist-2 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 2
+          valid: 1
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..2ac69230a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,35 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - apk.wso2.com
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..bad0357f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,130 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
new file mode 100644
index 000000000..acdb93654
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.in.yaml
@@ -0,0 +1,36 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          hostname: "*.envoyproxy.io"
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - apk.wso2.com
+        - whales.envoyproxy.io
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
new file mode 100644
index 000000000..12d756935
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -0,0 +1,150 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    - whales.envoyproxy.io
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: whales.envoyproxy.io
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/whales_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
new file mode 100644
index 000000000..571a20a80
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
new file mode 100644
index 000000000..c2572699c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            type: ReplaceFullPath
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          path:
+            fullReplace: /rewrite
+            prefixMatchReplace: null
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
new file mode 100644
index 000000000..d1e4d2a0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
new file mode 100644
index 000000000..b699829a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
@@ -0,0 +1,144 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            fullReplace: null
+            prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
new file mode 100644
index 000000000..bd20f47a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.in.yaml
@@ -0,0 +1,40 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
new file mode 100644
index 000000000..6eb871daf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: rewrite.com
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
new file mode 100644
index 000000000..26f989775
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
+
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
new file mode 100644
index 000000000..01d889c79
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
@@ -0,0 +1,138 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          hostname: urlrewrite.envoyproxy.io
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
new file mode 100644
index 000000000..4226c48e0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "-rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
new file mode 100644
index 000000000..1ae124802
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-hostname.out.yaml
@@ -0,0 +1,122 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: -rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'hostname "-rewrite.com" is invalid: [a lowercase RFC 1123 subdomain
+          must consist of lower case alphanumeric characters, ''-'' or ''.'', and
+          must start and end with an alphanumeric character (e.g. ''example.com'',
+          regex used for validation is ''[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*'')]'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
new file mode 100644
index 000000000..86d5f6bb1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
new file mode 100644
index 000000000..a56ea1e8f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-multiple-filters.out.yaml
@@ -0,0 +1,124 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            type: ReplaceFullPath
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Cannot configure multiple urlRewrite filters for a single HTTPRouteRule
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
new file mode 100644
index 000000000..4da7aa982
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "rewrite.com"
+          path:
+            type: ReplacePrefixMatches
+            replacePrefixMatch: /rewrites
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
new file mode 100644
index 000000000..6f119ee91
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path-type.out.yaml
@@ -0,0 +1,120 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: rewrite.com
+          path:
+            replacePrefixMatch: /rewrites
+            type: ReplacePrefixMatches
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: 'Rewrite path type: ReplacePrefixMatches is invalid, only "ReplaceFullPath"
+          and "ReplacePrefixMatch" are supported'
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
new file mode 100644
index 000000000..63c23fa10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.in.yaml
@@ -0,0 +1,43 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
+            replaceFullPath: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
new file mode 100644
index 000000000..d5c133ea9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-invalid-path.out.yaml
@@ -0,0 +1,119 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replaceFullPath: /rewrite
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ReplaceFullPath cannot be set when rewrite path type is "ReplacePrefixMatch"
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
new file mode 100644
index 000000000..1b3c47b9a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.in.yaml
@@ -0,0 +1,41 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
new file mode 100644
index 000000000..99390c3fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-missing-path.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: ReplacePrefixMatch must be set when rewrite path type is "ReplacePrefixMatch"
+        reason: UnsupportedValue
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
new file mode 100644
index 000000000..057561938
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
new file mode 100644
index 000000000..26845a2d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
@@ -0,0 +1,142 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            replacePrefixMatch: /rewrite
+            type: ReplacePrefixMatch
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+        urlRewrite:
+          path:
+            fullReplace: null
+            prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
new file mode 100644
index 000000000..d61cae049
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.in.yaml
@@ -0,0 +1,34 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      hostnames:
+        - "*.envoyproxy.io"
+      rules:
+        - matches:
+            - path:
+                value: "/"
+          backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
new file mode 100644
index 000000000..ddfe368cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
@@ -0,0 +1,129 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - '*.envoyproxy.io'
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.envoyproxy.io'
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/*_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
new file mode 100644
index 000000000..7315f3f4f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.in.yaml
@@ -0,0 +1,189 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "*.com"
+    - "*.net"
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.com
+    rules:
+    - matches:
+      - path:
+          value: "/v1/example"
+        queryParams:
+        - name: "debug"
+          value: "yes"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-3
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.com
+    rules:
+    - matches:
+      - path:
+          value: "/v1/example"
+      backendRefs:
+      - name: service-2
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-4
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.net
+    rules:
+    - matches:
+      - path:
+          value: "/v1/status"
+        headers:
+        - name: "version"
+          value: "one"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-5
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - example.net
+    rules:
+    - matches:
+      - path:
+          value: "/v1/status"
+      backendRefs:
+      - name: service-2
+        port: 8080
+services:
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: service-1
+  spec:
+    clusterIP: 1.1.1.1
+    ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+- apiVersion: v1
+  kind: Service
+  metadata:
+    namespace: envoy-gateway
+    name: service-2
+  spec:
+    clusterIP: 2.2.2.2
+    ports:
+    - name: http
+      port: 8080
+      protocol: TCP
+      targetPort: 8080
+endpointSlices:
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-service-1
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: service-1
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8080
+  endpoints:
+  - addresses:
+    - "7.7.7.7"
+    conditions:
+      ready: true
+- apiVersion: discovery.k8s.io/v1
+  kind: EndpointSlice
+  metadata:
+    name: endpointslice-service-2
+    namespace: envoy-gateway
+    labels:
+      kubernetes.io/service-name: service-2
+  addressType: IPv4
+  ports:
+  - name: http
+    protocol: TCP
+    port: 8080
+  endpoints:
+  - addresses:
+    - "8.8.8.8"
+    conditions:
+      ready: true
diff --git a/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
new file mode 100644
index 000000000..242b63714
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/httproutes-with-multiple-matches.out.yaml
@@ -0,0 +1,436 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 6
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - '*.com'
+    - '*.net'
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /v1/example
+        queryParams:
+        - name: debug
+          value: "yes"
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-3
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v1/example
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-4
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.net
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: version
+          value: one
+        path:
+          value: /v1/status
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-5
+    namespace: envoy-gateway
+  spec:
+    hostnames:
+    - example.net
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /v1/status
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-2/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/example
+        queryParamMatches:
+        - distinct: false
+          exact: "yes"
+          name: debug
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-3/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-3/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/example
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-4/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        headerMatches:
+        - distinct: false
+          exact: one
+          name: version
+        hostname: example.net
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-4/rule/0/match/0/example_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/status
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-5/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.net
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-5/rule/0/match/0/example_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /v1/status
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.com'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*.net'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_net
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
new file mode 100644
index 000000000..daf66d677
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.in.yaml
@@ -0,0 +1,34 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+        - name: udp
+          port: 80
+          protocol: UDP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
new file mode 100644
index 000000000..2481d8918
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-invalid-multiple-gateways.out.yaml
@@ -0,0 +1,147 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+    - name: udp
+      port: 80
+      protocol: UDP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Port, protocol and hostname tuple must be unique for every listener
+        reason: HostnameConflict
+        status: "True"
+        type: Conflicted
+      - lastTransitionTime: null
+        message: Listener is invalid, see other Conditions for details.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: udp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: UDPRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/udp
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-2/udp
+          protocol: UDP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
new file mode 100644
index 000000000..662a2381a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.in.yaml
@@ -0,0 +1,45 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-2
+          hostname: company.com
+          port: 8888
+          protocol: HTTP
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-3
+          port: 8888
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-4
+          hostname: example.com
+          port: 8888
+          protocol: HTTP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
new file mode 100755
index 000000000..4d162ad5d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-listeners-same-ports.out.yaml
@@ -0,0 +1,210 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - hostname: company.com
+      name: http-2
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-3
+      port: 8888
+      protocol: HTTP
+    - hostname: example.com
+      name: http-4
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-4
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-1/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-1/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - company.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-4
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
new file mode 100644
index 000000000..07203553a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.in.yaml
@@ -0,0 +1,81 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.envoyproxy.io"
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-2
+      port: 8888
+      protocol: HTTP
+    - name: http-3
+      hostname: example.com
+      port: 8888
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http-3
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-2
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
new file mode 100644
index 000000000..3ee2965a4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
@@ -0,0 +1,292 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: '*.envoyproxy.io'
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http-2
+      port: 8888
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: example.com
+      name: http-3
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - example.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http-3
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http-3
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-2/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*.envoyproxy.io'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: example.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/example_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
new file mode 100644
index 000000000..821dd97b6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.in.yaml
@@ -0,0 +1,41 @@
+envoyproxy:
+  apiVersion: apk.wso2.com/v1alpha1
+  kind: EnvoyProxy
+  metadata:
+    namespace: apk
+    name: test
+  spec:
+    mergeGateways: true
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-1
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          port: 80
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+  - apiVersion: gateway.networking.k8s.io/v1beta1
+    kind: Gateway
+    metadata:
+      name: gateway-2
+      namespace: envoy-gateway
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http-2
+          port: 8888
+          protocol: HTTP
+          allowedRoutes:
+            namespaces:
+              from: Same
+        - name: http-3
+          hostname: example.com
+          port: 8888
+          protocol: HTTP
diff --git a/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
new file mode 100644
index 000000000..974e1f0f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/merge-valid-multiple-gateways.out.yaml
@@ -0,0 +1,174 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http-2
+      port: 8888
+      protocol: HTTP
+    - hostname: example.com
+      name: http-3
+      port: 8888
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-2
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http-3
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway-class:
+    proxy:
+      config:
+        apiVersion: apk.wso2.com/v1alpha1
+        kind: EnvoyProxy
+        metadata:
+          creationTimestamp: null
+          name: test
+          namespace: apk
+        spec:
+          logging: {}
+          mergeGateways: true
+        status: {}
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: envoy-gateway/gateway-1/http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/http-2
+        ports:
+        - containerPort: 8888
+          name: envoy-gateway/gateway-2/http-2
+          protocol: HTTP
+          servicePort: 8888
+      metadata:
+        labels:
+          apk.wso2.com/owning-gatewayclass: envoy-gateway-class
+      name: envoy-gateway-class
+xdsIR:
+  envoy-gateway-class:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-2
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
+    - address: 0.0.0.0
+      hostnames:
+      - example.com
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http-3
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 8888
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
new file mode 100644
index 000000000..0b4c43f85
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.in.yaml
@@ -0,0 +1,42 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
new file mode 100755
index 000000000..d0fd54b1b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-invalid-cross-ns-ref.out.yaml
@@ -0,0 +1,115 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Namespace:default TargetRef.Namespace:envoy-gateway, SecurityPolicy
+          can only target a resource in the same namespace.
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
new file mode 100644
index 000000000..fff03a86c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.in.yaml
@@ -0,0 +1,23 @@
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-unknown-httproute
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
new file mode 100644
index 000000000..c05267109
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-no-status-for-unknown-gateway-or-route.out.yaml
@@ -0,0 +1,31 @@
+infraIR: {}
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-httproute
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: unknown-httproute
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-unknown-gateway
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: unknown-gateway
+      namespace: envoy-gateway
+  status:
+    ancestors: null
+xdsIR: {}
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
new file mode 100644
index 000000000..c5afd9fe8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.in.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    cors:
+      allowOrigins:
+      - "https://*.test.com:8080"
+      - "https://www.test.org:8080"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
new file mode 100755
index 000000000..3008e7c8a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-override-replace.out.yaml
@@ -0,0 +1,338 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - https://*.test.com:8080
+      - https://www.test.org:8080
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: https://.*\.test\.com:8080
+          - distinct: false
+            exact: https://www.test.org:8080
+            name: ""
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-1
+          - x-header-2
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: http://.*\.example\.com
+          - distinct: false
+            exact: http://foo.bar.com
+            name: ""
+          - distinct: false
+            name: ""
+            safeRegex: https://.*
+          exposeHeaders:
+          - x-header-3
+          - x-header-4
+          maxAge: 16m40s
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
new file mode 100644
index 000000000..6600b040c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.in.yaml
@@ -0,0 +1,133 @@
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-gateway-1-as-well
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: also-target-httproute-in-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: target-grpcroute-in-gateway-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    namespace: envoy-gateway
+    name: httproute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: envoy-gateway
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+    rules:
+    - matches:
+      - headers:
+        - type: Exact
+          name: magic
+          value: foo
+      backendRefs:
+      - name: service-1
+        port: 8080
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: tcp
+      protocol: TCP
+      port: 53
+      allowedRoutes:
+        namespaces:
+          from: Same
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
new file mode 100755
index 000000000..2ddeae68c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-status-conditions.out.yaml
@@ -0,0 +1,436 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: https
+      port: 443
+      protocol: HTTPS
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      name: tcp
+      port: 53
+      protocol: TCP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is HTTPS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: https
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tcp
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - headers:
+        - name: magic
+          type: Exact
+          value: foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1beta1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: envoy-gateway
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Service envoy-gateway/service-1 not found
+        reason: BackendNotFound
+        status: "False"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      - address: null
+        name: envoy-gateway/gateway-2/tcp
+        ports:
+        - containerPort: 10053
+          name: tcp
+          protocol: TCP
+          servicePort: 53
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: also-target-httproute-in-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target HTTPRoute, another SecurityPolicy has already attached
+          to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-grpcroute-in-gateway-2
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: GRPCRoute
+      name: grpcroute-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [envoy-gateway/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: target-gateway-1-as-well
+    namespace: envoy-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Unable to target Gateway, another SecurityPolicy has already attached
+          to it
+        reason: Conflicted
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        hostname: '*'
+        isHTTP2: false
+        name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 1
+          valid: 0
+        directResponse:
+          statusCode: 500
+        headerMatches:
+        - distinct: false
+          exact: foo
+          name: magic
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
new file mode 100644
index 000000000..675503369
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.in.yaml
@@ -0,0 +1,58 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: users-secret
+  data:
+    .htpasswd: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    basicAuth:
+      users:
+        name: "users-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
new file mode 100644
index 000000000..493d550bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-basic-auth.out.yaml
@@ -0,0 +1,166 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    basicAuth:
+      users:
+        group: null
+        kind: null
+        name: users-secret
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        basicAuth:
+          users: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
new file mode 100644
index 000000000..a39e1ec9c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.in.yaml
@@ -0,0 +1,173 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-3
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-3
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-2
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    cors:
+      allowOrigins:
+      - "http://*.example.com"
+      - "http://foo.bar.com"
+      - "https://*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      maxAge: 1000s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    cors:
+      allowOrigins:
+      - "https://*.test.com:8080"
+      - "https://www.test.org:8080"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    cors:
+      allowOrigins:
+      - "*"
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-5"
+      - "x-header-6"
+      exposeHeaders:
+      - "x-header-7"
+      - "x-header-8"
+      maxAge: 2000s
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
new file mode 100644
index 000000000..141420829
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-cors.out.yaml
@@ -0,0 +1,554 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-3
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-3
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-2
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-3
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+  envoy-gateway/gateway-3:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-3/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-3
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-3
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-1
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - https://*.test.com:8080
+      - https://www.test.org:8080
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route-2
+    namespace: default
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-5
+      - x-header-6
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - '*'
+      exposeHeaders:
+      - x-header-7
+      - x-header-8
+      maxAge: 33m20s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-3
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-1
+    namespace: envoy-gateway
+  spec:
+    cors:
+      allowHeaders:
+      - x-header-1
+      - x-header-2
+      allowMethods:
+      - GET
+      - POST
+      allowOrigins:
+      - http://*.example.com
+      - http://foo.bar.com
+      - https://*
+      exposeHeaders:
+      - x-header-3
+      - x-header-4
+      maxAge: 16m40s
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-1
+          - x-header-2
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: http://.*\.example\.com
+          - distinct: false
+            exact: http://foo.bar.com
+            name: ""
+          - distinct: false
+            name: ""
+            safeRegex: https://.*
+          exposeHeaders:
+          - x-header-3
+          - x-header-4
+          maxAge: 16m40s
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: https://.*\.test\.com:8080
+          - distinct: false
+            exact: https://www.test.org:8080
+            name: ""
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
+  envoy-gateway/gateway-3:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-3/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        cors:
+          allowHeaders:
+          - x-header-5
+          - x-header-6
+          allowMethods:
+          - GET
+          - POST
+          allowOrigins:
+          - distinct: false
+            name: ""
+            safeRegex: .*
+          exposeHeaders:
+          - x-header-7
+          - x-header-8
+          maxAge: 33m20s
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
new file mode 100644
index 000000000..246d99635
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.in.yaml
@@ -0,0 +1,65 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: http-backend
+    spec:
+      ports:
+        - port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
new file mode 100644
index 000000000..986994f0e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: TCP Port 80 not found on service default/http-backend
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
new file mode 100644
index 000000000..1ad4755a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.in.yaml
@@ -0,0 +1,64 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: http-backend
+    spec:
+      ports:
+        - port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
new file mode 100755
index 000000000..9a12785e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-port.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: A valid port number corresponding to a port on the Service must be
+          specified
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
new file mode 100644
index 000000000..8701ab075
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.in.yaml
@@ -0,0 +1,65 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: envoy-gateway
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
new file mode 100644
index 000000000..fab5b9930
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -0,0 +1,168 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Backend ref to Service envoy-gateway/http-backend not permitted by
+          any ReferenceGrant
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
new file mode 100644
index 000000000..8834c8606
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.in.yaml
@@ -0,0 +1,56 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            name: http-backend
+            namespace: default
+            port: 80
+          headersToBackend:
+            - header1
+            - header2
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
new file mode 100644
index 000000000..34585ba90
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -0,0 +1,167 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: default
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Service default/http-backend not found
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
new file mode 100644
index 000000000..0102d9c6b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.in.yaml
@@ -0,0 +1,231 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+          name: http
+          protocol: TCP
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: grpc-backend
+    spec:
+      ports:
+        - port: 9000
+          name: grpc
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 80
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-grpc-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: grpc-backend
+    addressType: IPv4
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 9000
+    endpoints:
+      - addresses:
+          - 8.8.8.8
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: apk.wso2.com
+          kind: SecurityPolicy
+          namespace: default
+        - group: gateway.networking.k8s.io
+          kind: BackendTLSPolicy
+          namespace: default
+      to:
+        - group: ''
+          kind: Service
+configMaps:
+  - apiVersion: v1
+    kind: ConfigMap
+    metadata:
+      name: ca-cmap
+      namespace: default
+    data:
+      ca.crt: |
+        -----BEGIN CERTIFICATE-----
+        MIIDJzCCAg+gAwIBAgIUAl6UKIuKmzte81cllz5PfdN2IlIwDQYJKoZIhvcNAQEL
+        BQAwIzEQMA4GA1UEAwwHbXljaWVudDEPMA0GA1UECgwGa3ViZWRiMB4XDTIzMTAw
+        MjA1NDE1N1oXDTI0MTAwMTA1NDE1N1owIzEQMA4GA1UEAwwHbXljaWVudDEPMA0G
+        A1UECgwGa3ViZWRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwSTc
+        1yj8HW62nynkFbXo4VXKv2jC0PM7dPVky87FweZcTKLoWQVPQE2p2kLDK6OEszmM
+        yyr+xxWtyiveremrWqnKkNTYhLfYPhgQkczib7eUalmFjUbhWdLvHakbEgCodn3b
+        kz57mInX2VpiDOKg4kyHfiuXWpiBqrCx0KNLpxo3DEQcFcsQTeTHzh4752GV04RU
+        Ti/GEWyzIsl4Rg7tGtAwmcIPgUNUfY2Q390FGqdH4ahn+mw/6aFbW31W63d9YJVq
+        ioyOVcaMIpM5B/c7Qc8SuhCI1YGhUyg4cRHLEw5VtikioyE3X04kna3jQAj54YbR
+        bpEhc35apKLB21HOUQIDAQABo1MwUTAdBgNVHQ4EFgQUyvl0VI5vJVSuYFXu7B48
+        6PbMEAowHwYDVR0jBBgwFoAUyvl0VI5vJVSuYFXu7B486PbMEAowDwYDVR0TAQH/
+        BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAMLxrgFVMuNRq2wAwcBt7SnNR5Cfz
+        2MvXq5EUmuawIUi9kaYjwdViDREGSjk7JW17vl576HjDkdfRwi4E28SydRInZf6J
+        i8HZcZ7caH6DxR335fgHVzLi5NiTce/OjNBQzQ2MJXVDd8DBmG5fyatJiOJQ4bWE
+        A7FlP0RdP3CO3GWE0M5iXOB2m1qWkE2eyO4UHvwTqNQLdrdAXgDQlbam9e4BG3Gg
+        d/6thAkWDbt/QNT+EJHDCvhDRKh1RuGHyg+Y+/nebTWWrFWsktRrbOoHCZiCpXI1
+        3eXE6nt0YkgtDxG22KqnhpAg9gUSs2hlhoxyvkzyF0mu6NhPlwAgnq7+/Q==
+        -----END CERTIFICATE-----
+backendTLSPolicies:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls-http
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: http-backend
+        namespace: envoy-gateway
+        sectionName: "80"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: http-backend
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: BackendTLSPolicy
+    metadata:
+      name: policy-btls-grpc
+      namespace: default
+    spec:
+      targetRef:
+        group: ''
+        kind: Service
+        name: grpc-backend
+        sectionName: "9000"
+      tls:
+        caCertRefs:
+          - name: ca-cmap
+            group: ''
+            kind: ConfigMap
+        hostname: grpc-backend
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            Name: http-backend
+            Namespace: envoy-gateway
+            Port: 80
+          Path: /auth
+          headersToBackend:
+            - header1
+            - header2
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      extAuth:
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRef:
+            name: grpc-backend
+            port: 9000
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
new file mode 100755
index 000000000..ad044aac3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth-with-backendtlspolicy.out.yaml
@@ -0,0 +1,373 @@
+backendTLSPolicies:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-http
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: http-backend
+      namespace: envoy-gateway
+      sectionName: "80"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: http-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: apk.wso2.com
+        kind: SecurityPolicy
+        name: policy-for-gateway
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: BackendTLSPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-btls-grpc
+    namespace: default
+  spec:
+    targetRef:
+      group: ""
+      kind: Service
+      name: grpc-backend
+      sectionName: "9000"
+    tls:
+      caCertRefs:
+      - group: ""
+        kind: ConfigMap
+        name: ca-cmap
+      hostname: grpc-backend
+  status:
+    ancestors:
+    - ancestorRef:
+        group: apk.wso2.com
+        kind: SecurityPolicy
+        name: policy-for-http-route
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: BackendTLSPolicy is Accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extAuth:
+      grpc:
+        backendRef:
+          name: grpc-backend
+          port: 9000
+      headersToExtAuth:
+      - header1
+      - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          grpc:
+            authority: grpc-backend.default:9000
+            destination:
+              name: securitypolicy/default/policy-for-http-route/grpc-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 8.8.8.8
+                  port: 9000
+                protocol: GRPC
+                tls:
+                  caCertificate:
+                    certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                    name: policy-btls-grpc/default-ca
+                  sni: grpc-backend
+                weight: 1
+          headersToExtAuth:
+          - header1
+          - header2
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-gateway/http-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 80
+                protocol: HTTP
+                tls:
+                  caCertificate:
+                    certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                    name: policy-btls-http/default-ca
+                  sni: http-backend
+                weight: 1
+            headersToBackend:
+            - header1
+            - header2
+            path: /auth
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
new file mode 100644
index 000000000..2521c1298
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.in.yaml
@@ -0,0 +1,165 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: default
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: http
+          protocol: HTTP
+          port: 80
+          allowedRoutes:
+            namespaces:
+              from: All
+httpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-1
+    spec:
+      hostnames:
+        - www.foo.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /foo
+          backendRefs:
+            - name: service-1
+              port: 8080
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: HTTPRoute
+    metadata:
+      namespace: default
+      name: httproute-2
+    spec:
+      hostnames:
+        - www.bar.com
+      parentRefs:
+        - namespace: default
+          name: gateway-1
+          sectionName: http
+      rules:
+        - matches:
+            - path:
+                value: /bar
+          backendRefs:
+            - name: service-1
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: envoy-gateway
+      name: http-backend
+    spec:
+      ports:
+        - port: 80
+          name: http
+          protocol: TCP
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: default
+      name: grpc-backend
+    spec:
+      ports:
+        - port: 9000
+          name: grpc
+          protocol: TCP
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-http-backend
+      namespace: envoy-gateway
+      labels:
+        kubernetes.io/service-name: http-backend
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 80
+    endpoints:
+      - addresses:
+          - 7.7.7.7
+        conditions:
+          ready: true
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-grpc-backend
+      namespace: default
+      labels:
+        kubernetes.io/service-name: grpc-backend
+    addressType: IPv4
+    ports:
+      - name: grpc
+        protocol: TCP
+        port: 9000
+    endpoints:
+      - addresses:
+          - 8.8.8.8
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: envoy-gateway
+      name: referencegrant-1
+    spec:
+      from:
+        - group: apk.wso2.com
+          kind: SecurityPolicy
+          namespace: default
+      to:
+        - group: ''
+          kind: Service
+securityPolicies:
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-gateway
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      extAuth:
+        http:
+          backendRef:
+            Name: http-backend
+            Namespace: envoy-gateway
+            Port: 80
+          Path: /auth
+          headersToBackend:
+            - header1
+            - header2
+  - apiVersion: apk.wso2.com/v1alpha1
+    kind: SecurityPolicy
+    metadata:
+      namespace: default
+      name: policy-for-http-route
+    spec:
+      targetRef:
+        group: gateway.networking.k8s.io
+        kind: HTTPRoute
+        name: httproute-1
+        namespace: default
+      extAuth:
+        headersToExtAuth:
+          - header1
+          - header2
+        grpc:
+          backendRef:
+            name: grpc-backend
+            port: 9000
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
new file mode 100644
index 000000000..06400a32a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-extauth.out.yaml
@@ -0,0 +1,297 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: default
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: default
+        sectionName: http
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    extAuth:
+      grpc:
+        backendRef:
+          name: grpc-backend
+          port: 9000
+      headersToExtAuth:
+      - header1
+      - header2
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: default
+  spec:
+    extAuth:
+      http:
+        backendRef:
+          name: http-backend
+          namespace: envoy-gateway
+          port: 80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          grpc:
+            authority: grpc-backend.default:9000
+            destination:
+              name: securitypolicy/default/policy-for-http-route/grpc-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 8.8.8.8
+                  port: 9000
+                protocol: GRPC
+                weight: 1
+          headersToExtAuth:
+          - header1
+          - header2
+        hostname: www.foo.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        extAuth:
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-gateway/http-backend
+              settings:
+              - addressType: IP
+                endpoints:
+                - host: 7.7.7.7
+                  port: 80
+                protocol: HTTP
+                weight: 1
+            headersToBackend:
+            - header1
+            - header2
+            path: /auth
+        hostname: www.bar.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
new file mode 100644
index 000000000..8e3d04dea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.in.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway  # This policy should attach httproute-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route  # This policy should attach httproute-2
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+    jwt:
+      providers:
+      - name: example2
+        issuer: https://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim2
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client2-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
new file mode 100644
index 000000000..d3c939f3b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
@@ -0,0 +1,308 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: one-route-example-key
+        issuer: https://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+      provider:
+        issuer: https://accounts.google.com
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-2
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Secret default/client2-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        issuer: https://accounts.google.com
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Secret envoy-gateway/client1-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-2]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: one-route-example-key
+            issuer: https://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
new file mode 100644
index 000000000..7c3a41a1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.in.yaml
@@ -0,0 +1,126 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+      - name: example2
+        issuer: https://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: https://two.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: two-route-example-key
+          claim: claim2
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    jwt:
+      providers:
+      - name: example3
+        issuer: https://three.example.com
+        audiences:
+        - three.foo.com
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: three-route-example-key
+          claim: claim3
+        extractFrom:
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          cookies:
+          - session_access_token
+          params:
+          - token
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
new file mode 100644
index 000000000..22f29d9c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -0,0 +1,382 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - three.foo.com
+        claimToHeaders:
+        - claim: claim3
+          header: three-route-example-key
+        extractFrom:
+          cookies:
+          - session_access_token
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          params:
+          - token
+        issuer: https://three.example.com
+        name: example3
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: two-route-example-key
+        issuer: https://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: https://two.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: two-route-example-key
+            issuer: https://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: https://two.example.com/jwt/public-key/jwks.json
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - three.foo.com
+            claimToHeaders:
+            - claim: claim3
+              header: three-route-example-key
+            extractFrom:
+              cookies:
+              - session_access_token
+              headers:
+              - name: Authorization
+                valuePrefix: 'Bearer '
+              params:
+              - token
+            issuer: https://three.example.com
+            name: example3
+            remoteJWKS:
+              uri: https://three.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
new file mode 100644
index 000000000..0f57a7f98
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.in.yaml
@@ -0,0 +1,118 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    namespace: default
+    name: grpcroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-2
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    jwt:
+      providers:
+      - name: example1
+        issuer: https://one.example.com
+        audiences:
+        - one.foo.com
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key
+          claim: claim1
+      - name: example2
+        issuer: http://two.example.com
+        audiences:
+        - two.foo.com
+        remoteJWKS:
+          uri: http://two.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: two-route-example-key
+          claim: claim2
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-route
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    jwt:
+      providers:
+      - name: example3
+        issuer: https://three.example.com
+        audiences:
+        - three.foo.com
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: three-route-example-key
+          claim: claim3
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
new file mode 100644
index 000000000..52ac328af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-jwt.out.yaml
@@ -0,0 +1,366 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+grpcRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: GRPCRoute
+  metadata:
+    creationTimestamp: null
+    name: grpcroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - apk.wso2.com
+    parentRefs:
+    - name: gateway-2
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+  envoy-gateway/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-2
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-route
+    namespace: default
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - three.foo.com
+        claimToHeaders:
+        - claim: claim3
+          header: three-route-example-key
+        issuer: https://three.example.com
+        name: example3
+        remoteJWKS:
+          uri: https://three.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway
+    namespace: envoy-gateway
+  spec:
+    jwt:
+      providers:
+      - audiences:
+        - one.foo.com
+        claimToHeaders:
+        - claim: claim1
+          header: one-route-example-key
+        issuer: https://one.example.com
+        name: example1
+        remoteJWKS:
+          uri: https://one.example.com/jwt/public-key/jwks.json
+      - audiences:
+        - two.foo.com
+        claimToHeaders:
+        - claim: claim2
+          header: two-route-example-key
+        issuer: http://two.example.com
+        name: example2
+        remoteJWKS:
+          uri: http://two.example.com/jwt/public-key/jwks.json
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: true
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: grpcroute/default/grpcroute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: GRPC
+            weight: 1
+        hostname: '*'
+        isHTTP2: true
+        jwt:
+          providers:
+          - audiences:
+            - one.foo.com
+            claimToHeaders:
+            - claim: claim1
+              header: one-route-example-key
+            issuer: https://one.example.com
+            name: example1
+            remoteJWKS:
+              uri: https://one.example.com/jwt/public-key/jwks.json
+          - audiences:
+            - two.foo.com
+            claimToHeaders:
+            - claim: claim2
+              header: two-route-example-key
+            issuer: http://two.example.com
+            name: example2
+            remoteJWKS:
+              uri: http://two.example.com/jwt/public-key/jwks.json
+        name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
+  envoy-gateway/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: apk.wso2.com
+        isHTTP2: false
+        jwt:
+          providers:
+          - audiences:
+            - three.foo.com
+            claimToHeaders:
+            - claim: claim3
+              header: three-route-example-key
+            issuer: https://three.example.com
+            name: example3
+            remoteJWKS:
+              uri: https://three.example.com/jwt/public-key/jwks.json
+        name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
new file mode 100644
index 000000000..5c3795d80
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.in.yaml
@@ -0,0 +1,41 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client1-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-non-exist-secretRef
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+    oidc:
+      provider:
+        issuer: "https://httpbin.org/"
+      clientID: "client1.apps.foo.bar.com"
+      clientSecret:
+        name: "client1-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
new file mode 100644
index 000000000..34cc81c21
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-issuer.out.yaml
@@ -0,0 +1,108 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-non-exist-secretRef
+    namespace: default
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.foo.bar.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        issuer: https://httpbin.org/
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: 'Error fetching endpoints from issuer: invalid character ''<'' looking
+          for beginning of value'
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
new file mode 100644
index 000000000..0f291acfd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.in.yaml
@@ -0,0 +1,118 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: envoy-gateway
+    name: client2-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client3-secret
+  data:
+    invalid_client_secret_key: Y2xpZW50MTpzZWNyZXQK
+
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-2
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: default
+    name: gateway-3
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-non-exist-secretRef
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-no-referenceGrant
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        namespace: envoy-gateway
+        name: "client2-secret"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-no-client-secret-key
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-3
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+        authorizationEndpoint: "https://accounts.google.com/o/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth2.googleapis.com/token"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        namespace: default
+        name: "client3-secret"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
new file mode 100644
index 000000000..75516da5b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc-invalid-secretref.out.yaml
@@ -0,0 +1,320 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-2
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-3
+    namespace: default
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 0
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+infraIR:
+  default/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-1
+  default/gateway-2:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-2/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-2
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-2
+  default/gateway-3:
+    proxy:
+      listeners:
+      - address: null
+        name: default/gateway-3/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-3
+          apk.wso2.com/owning-gateway-namespace: default
+      name: default/gateway-3
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-non-exist-secretRef
+    namespace: default
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Secret default/client1-secret does not exist
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-no-referenceGrant
+    namespace: default
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+        namespace: envoy-gateway
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-2
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-2
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Secret ref namespace must be unspecified/empty or default
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-no-client-secret-key
+    namespace: default
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client3-secret
+        namespace: default
+      provider:
+        authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+        issuer: https://accounts.google.com
+        tokenEndpoint: https://oauth2.googleapis.com/token
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-3
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-3
+        namespace: default
+      conditions:
+      - lastTransitionTime: null
+        message: Client secret not found in secret default/client3-secret
+        reason: Invalid
+        status: "False"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  default/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  default/gateway-2:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-2/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+  default/gateway-3:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: default/gateway-3/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
new file mode 100644
index 000000000..8be22f023
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.in.yaml
@@ -0,0 +1,127 @@
+secrets:
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: envoy-gateway
+    name: client1-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client2-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: default
+    name: client3-secret
+  data:
+    client-secret: Y2xpZW50MTpzZWNyZXQK
+- apiVersion: v1
+  kind: Secret
+  metadata:
+    namespace: apk
+    name: envoy-oidc-hmac
+  data:
+    hmac-secret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      allowedRoutes:
+        namespaces:
+          from: All
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-1
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/foo"
+      backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    namespace: default
+    name: httproute-2
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+      sectionName: http
+    rules:
+    - matches:
+      - path:
+          value: "/bar"
+      backendRefs:
+      - name: service-1
+        port: 8080
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: envoy-gateway
+    name: policy-for-gateway-discover-endpoints  # This policy should attach httproute-2
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+    oidc:
+      provider:
+        issuer: "https://accounts.google.com"
+      clientID: "client1.apps.googleusercontent.com"
+      clientSecret:
+        name: "client1-secret"
+      redirectURL: "https://www.example.com/bar/oauth2/callback"
+      logoutPath: "/bar/logout"
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    namespace: default
+    name: policy-for-http-route   # This policy should attach httproute-1
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+    oidc:
+      provider:
+        issuer: "https://oauth.foo.com"
+        authorizationEndpoint: "https://oauth.foo.com/oauth2/v2/auth"
+        tokenEndpoint: "https://oauth.foo.com/token"
+      clientID: "client2.oauth.foo.com"
+      clientSecret:
+        name: "client2-secret"
+      scopes: ["openid", "email", "profile"]
+      redirectURL: "https://www.example.com/foo/oauth2/callback"
+      logoutPath: "/foo/logout"
diff --git a/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
new file mode 100644
index 000000000..a6014fbff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/securitypolicy-with-oidc.out.yaml
@@ -0,0 +1,304 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: http
+      port: 80
+      protocol: HTTP
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: http
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: HTTPRoute
+      - group: gateway.networking.k8s.io
+        kind: GRPCRoute
+httpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-1
+    namespace: default
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /foo
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: HTTPRoute
+  metadata:
+    creationTimestamp: null
+    name: httproute-2
+    namespace: default
+  spec:
+    hostnames:
+    - www.example.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+      sectionName: http
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+      matches:
+      - path:
+          value: /bar
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/http
+        ports:
+        - containerPort: 10080
+          name: http
+          protocol: HTTP
+          servicePort: 80
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+securityPolicies:
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-http-route
+    namespace: default
+    uid: 08335a80-83ba-4592-888f-6ac0bba44ce4
+  spec:
+    oidc:
+      clientID: client2.oauth.foo.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client2-secret
+      logoutPath: /foo/logout
+      provider:
+        authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+        issuer: https://oauth.foo.com
+        tokenEndpoint: https://oauth.foo.com/token
+      redirectURL: https://www.example.com/foo/oauth2/callback
+      scopes:
+      - openid
+      - email
+      - profile
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: httproute-1
+      namespace: default
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+        sectionName: http
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      controllerName: apk.wso2.com/gatewayclass-controller
+- apiVersion: apk.wso2.com/v1alpha1
+  kind: SecurityPolicy
+  metadata:
+    creationTimestamp: null
+    name: policy-for-gateway-discover-endpoints
+    namespace: envoy-gateway
+    uid: b8284d0f-de82-4c65-b204-96a0d3f258a1
+  spec:
+    oidc:
+      clientID: client1.apps.googleusercontent.com
+      clientSecret:
+        group: null
+        kind: null
+        name: client1-secret
+      logoutPath: /bar/logout
+      provider:
+        issuer: https://accounts.google.com
+      redirectURL: https://www.example.com/bar/oauth2/callback
+    targetRef:
+      group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-1
+      namespace: envoy-gateway
+  status:
+    ancestors:
+    - ancestorRef:
+        group: gateway.networking.k8s.io
+        kind: Gateway
+        name: gateway-1
+        namespace: envoy-gateway
+      conditions:
+      - lastTransitionTime: null
+        message: Policy has been accepted.
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: 'This policy is being overridden by other securityPolicies for these
+          routes: [default/httproute-1]'
+        reason: Overridden
+        status: "True"
+        type: Overridden
+      controllerName: apk.wso2.com/gatewayclass-controller
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    http:
+    - address: 0.0.0.0
+      hostnames:
+      - '*'
+      isHTTP2: false
+      name: envoy-gateway/gateway-1/http
+      path:
+        escapedSlashesAction: UnescapeAndRedirect
+        mergeSlashes: true
+      port: 10080
+      routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.example.com
+        isHTTP2: false
+        name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+        oidc:
+          clientID: client2.oauth.foo.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          cookieSuffix: 5f93c2e4
+          hmacSecret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+          logoutPath: /foo/logout
+          provider:
+            authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+            tokenEndpoint: https://oauth.foo.com/token
+          redirectPath: /foo/oauth2/callback
+          redirectURL: https://www.example.com/foo/oauth2/callback
+          scopes:
+          - openid
+          - email
+          - profile
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 8080
+            protocol: HTTP
+            weight: 1
+        hostname: www.example.com
+        isHTTP2: false
+        name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+        oidc:
+          clientID: client1.apps.googleusercontent.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          cookieSuffix: b0a1b740
+          hmacSecret: qrOYACHXoe7UEDI/raOjNSx+Z9ufXSc/22C3T6X/zPY=
+          logoutPath: /bar/logout
+          provider:
+            authorizationEndpoint: https://accounts.google.com/o/oauth2/v2/auth
+            tokenEndpoint: https://oauth2.googleapis.com/token
+          redirectPath: /bar/oauth2/callback
+          redirectURL: https://www.example.com/bar/oauth2/callback
+          scopes:
+          - openid
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
diff --git a/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
new file mode 100644
index 000000000..b4beac9da
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.in.yaml
@@ -0,0 +1,46 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          port: 90
+          tls:
+            certificateRefs:
+              - group: ""
+                kind: Secret
+                name: tls-secret-1
+            mode: Terminate
+          allowedRoutes:
+            namespaces:
+              from: All
+tcpRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TCPRoute
+    metadata:
+      namespace: default
+      name: tcproute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
+      tls.key: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
new file mode 100644
index 000000000..b2246be98
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tcproute-attaching-to-gateway-with-listener-tls-terminate.out.yaml
@@ -0,0 +1,117 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        certificateRefs:
+        - group: ""
+          kind: Secret
+          name: tls-secret-1
+        mode: Terminate
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tcpRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TCPRoute
+  metadata:
+    creationTimestamp: null
+    name: tcproute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tcproute/default/tcproute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: TCP
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tcproute-1
+      port: 10090
+      tls:
+        terminate:
+          certificates:
+          - name: envoy-gateway/tls-secret-1
+            privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+            serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUREVENDQWZXZ0F3SUJBZ0lVRUZNaFA5ZUo5WEFCV3NRNVptNmJSazJjTE5Rd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0ZqRVVNQklHQTFVRUF3d0xabTl2TG1KaGNpNWpiMjB3SGhjTk1qUXdNakk1TURrek1ERXdXaGNOTXpRdwpNakkyTURrek1ERXdXakFXTVJRd0VnWURWUVFEREF0bWIyOHVZbUZ5TG1OdmJUQ0NBU0l3RFFZSktvWklodmNOCkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFKbEk2WXhFOVprQ1BzNnBDUXhickNtZWl4OVA1RGZ4OVJ1NUxENFQKSm1kVzdJS2R0UVYvd2ZMbXRzdTc2QithVGRDaldlMEJUZmVPT1JCYlIzY1BBRzZFbFFMaWNsUVVydW4zcStncwpKcEsrSTdjSStqNXc4STY4WEg1V1E3clZVdGJ3SHBxYncrY1ZuQnFJVU9MaUlhdGpJZjdLWDUxTTF1RjljZkVICkU0RG5jSDZyYnI1OS9SRlpCc2toeHM1T3p3Sklmb2hreXZGd2V1VHd4Sy9WcGpJKzdPYzQ4QUJDWHBOTzlEL3EKRWgrck9hdWpBTWNYZ0hRSVRrQ2lpVVRjVW82TFNIOXZMWlB0YXFmem9acTZuaE1xcFc2NUUxcEF3RjNqeVRUeAphNUk4SmNmU0Zqa2llWjIwTFVRTW43TThVNHhIamFvL2d2SDBDQWZkQjdSTFUyc0NBd0VBQWFOVE1GRXdIUVlEClZSME9CQllFRk9SQ0U4dS8xRERXN2loWnA3Y3g5dFNtUG02T01COEdBMVVkSXdRWU1CYUFGT1JDRTh1LzFERFcKN2loWnA3Y3g5dFNtUG02T01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQgpBRnQ1M3pqc3FUYUg1YThFMmNodm1XQWdDcnhSSzhiVkxNeGl3TkdqYm1FUFJ6K3c2TngrazBBOEtFY0lEc0tjClNYY2k1OHU0b1didFZKQmx6YS9adWpIUjZQMUJuT3BsK2FveTc4NGJiZDRQMzl3VExvWGZNZmJCQ20xdmV2aDkKQUpLbncyWnRxcjRta2JMY3hFcWxxM3NCTEZBUzlzUUxuS05DZTJjR0xkVHAyYm9HK3FjZ3lRZ0NJTTZmOEVNdgpXUGlmQ01NR3V6Sy9HUkY0YlBPL1lGNDhld0R1M1VlaWgwWFhkVUFPRTlDdFVhOE5JaGMxVVBhT3pQcnRZVnFyClpPR2t2L0t1K0I3OGg4U0VzTzlYclFjdXdiT25KeDZLdFIrYWV5a3ZBcFhDUTNmWkMvYllLQUFSK1A4QUpvUVoKYndJVW1YaTRnajVtK2JLUGhlK2lyK0U9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0=
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/.gitignore b/adapter/internal/operator/gateway-api/testdata/tls/.gitignore
new file mode 100644
index 000000000..a813e7b2f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/.gitignore
@@ -0,0 +1,2 @@
+# allow test keys to be checked-in to test folder only
+!*.key
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
new file mode 100644
index 000000000..2ca528b49
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256-cert.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBgTCCASegAwIBAgIUFml8LBG0o/QK4Q+Z7k824sC2iFwwCgYIKoZIzj0EAwIw
+FjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTBZMBMGByqGSM49AgEGCCqG
+SM49AwEHA0IABLaYvqKuVVoxDo52eWzvYB5jw7EMF86rmyoi5ZuayzdMvpg4zBr8
+RKBjNs+T1jB8OKucS/7RUDx0pz+976zM3iOjUzBRMB0GA1UdDgQWBBTO6+cg0R0d
+wtrzJQPG6g76hBBUzTAfBgNVHSMEGDAWgBTO6+cg0R0dwtrzJQPG6g76hBBUzTAP
+BgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIQC2XpPQgQzWae3b5pZt
+GcuMfDJ0c0OPKcnegkXZ2C4B3gIgU/sRkwIpLQNRV+EaYw4P5T5gPE6Y+VpmC98h
+oVjZ/zQ=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
new file mode 100644
index 000000000..b5678c1fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p256.key
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAyfKQvPBudXRh0LLmtVRJPYl6e+GgzvgctFexKh9a1GoAoGCCqGSM49
+AwEHoUQDQgAEtpi+oq5VWjEOjnZ5bO9gHmPDsQwXzqubKiLlm5rLN0y+mDjMGvxE
+oGM2z5PWMHw4q5xL/tFQPHSnP73vrMzeIw==
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
new file mode 100644
index 000000000..3d55a9124
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384-cert.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBvTCCAUSgAwIBAgIUSivJGTDwokS7heY/2csRsz4vJB0wCgYIKoZIzj0EAwIw
+FjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTB2MBAGByqGSM49AgEGBSuB
+BAAiA2IABFvrvRebaaWuS6MAEId6wZfOKvuCTyUMOlZJqFCF9TkzMYl8CiofynOt
+Crs0vva9kd/P2JMGBJqgYevbwotrRi12qLnH04/joGIjjTOKo3Iofr+Fk8wLvAe3
+O1ZKtR9szqNTMFEwHQYDVR0OBBYEFIKs1QFnoDt9+qokR4ODWbMz1f+PMB8GA1Ud
+IwQYMBaAFIKs1QFnoDt9+qokR4ODWbMz1f+PMA8GA1UdEwEB/wQFMAMBAf8wCgYI
+KoZIzj0EAwIDZwAwZAIwH31tHyfUP04XHpbWGe1Z1IaBZBwIth55DU4hjfPu8m+J
+Wv7bW8zTSgwLiqorfcunAjA0ghNJBA1X2XtIKDml3s7/Vx8FJcS04vpChh+lAbLS
+veaa28R3TLEY3U+QTXI/wIk=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
new file mode 100644
index 000000000..4626890e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/ecdsa-p384.key
@@ -0,0 +1,6 @@
+-----BEGIN EC PRIVATE KEY-----
+MIGkAgEBBDCeNj3chbP4g2cPOizPipLiJ6tCQAXf4rjSHHksQ1b6KV7xyDP6iVAK
+BVoyR/aipR+gBwYFK4EEACKhZANiAARb670Xm2mlrkujABCHesGXzir7gk8lDDpW
+SahQhfU5MzGJfAoqH8pzrQq7NL72vZHfz9iTBgSaoGHr28KLa0Ytdqi5x9OP46Bi
+I40ziqNyKH6/hZPMC7wHtztWSrUfbM4=
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh b/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
new file mode 100755
index 000000000..8d428ed4a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/gen-certs.sh
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+# The following commands were used to generate test key/cert pairs
+# using openssl (LibreSSL 3.3.6)
+
+CERT_VALIDITY_DAYS=3650
+
+# RSA
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8.key -out rsa-cert.pem -subj "/CN=foo.bar.com"
+openssl rsa -in rsa-pkcs8.key -out rsa-pkcs1.key
+
+# RSA with SAN extension
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8-san.key -out rsa-cert-san.pem -subj "/CN=Test Inc" -addext "subjectAltName = DNS:foo.bar.com"
+openssl rsa -in rsa-pkcs8-san.key -out rsa-pkcs1-san.key
+
+# RSA with wildcard SAN domain
+
+openssl req -x509 -nodes -days $CERT_VALIDITY_DAYS -newkey rsa:2048 -keyout rsa-pkcs8-wildcard.key -out rsa-cert-wildcard.pem -subj "/CN=Test Inc" -addext "subjectAltName = DNS:*, DNS:*.example.com"
+openssl rsa -in rsa-pkcs8-wildcard.key -out rsa-pkcs1-wildcard.key
+
+# ECDSA-p256
+
+openssl ecparam -name prime256v1 -genkey -noout -out ecdsa-p256.key
+openssl req -new -x509 -days $CERT_VALIDITY_DAYS -key ecdsa-p256.key -out ecdsa-p256-cert.pem -subj "/CN=foo.bar.com"
+
+# ECDSA-p384
+
+openssl ecparam -name secp384r1 -genkey -noout -out ecdsa-p384.key
+openssl req -new -x509 -days $CERT_VALIDITY_DAYS -key ecdsa-p384.key -out ecdsa-p384-cert.pem -subj "/CN=foo.bar.com"
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key b/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
new file mode 100644
index 000000000..5d5aa4d36
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/invalid-key-type.key
@@ -0,0 +1,3 @@
+-----BEGIN FOO-----
+SGVsbG8gd29ybGQK
+-----END FOO-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
new file mode 100644
index 000000000..0c19932b1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-cert.pem
@@ -0,0 +1,3 @@
+-----BEGIN CERTIFICATE-----
+SGVsbG8gd29ybGQK
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
new file mode 100644
index 000000000..e6cc48732
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-ecdsa.key
@@ -0,0 +1,3 @@
+-----BEGIN EC PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END EC PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem b/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
new file mode 100644
index 000000000..9a02198b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-encoding.pem
@@ -0,0 +1 @@
+SGVsbG8gd29ybGQK
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
new file mode 100644
index 000000000..02ef0ad96
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs1.key
@@ -0,0 +1,3 @@
+-----BEGIN RSA PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END RSA PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
new file mode 100644
index 000000000..18d998a6e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/malformed-pkcs8.key
@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+SGVsbG8gd29ybGQK
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
new file mode 100644
index 000000000..3dfef07bc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-san.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDHzCCAgegAwIBAgIUWL1B/R492wfVLSDYPTpACUMQTiMwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIVGVzdCBJbmMwHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjATMREwDwYDVQQDDAhUZXN0IEluYzCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMpoxyIyxqyqk/s1BCrUhbH0k+PyOGdb1sI5EazA/p9BpmSI
+zX99ViqFuha+gf1Q0Ght/Wh5Fy4UKzcgo4Jv3qd3r82q+M0VojAj7RBajiwsPSDV
+u6hNiy4CE9Ic2abqmh1HMlbQnaYafXkZoRhvCH3enZ1h2tfRprmwa+vYO3HlLk9k
+x2Z3xcXIaePNoBOe71U9t/gsKakjnIk7rV0S//BW6YYEYlHRxTbSeoyqsSC0ImL/
+gT+0dm/rmtU0e1LVUMGzQI/BFMqD/hUgSrweH0t7BjFOsIK2S62loQ87HQOx5ntV
+aPO4C8TAdxheUcCscoUQ233tsMo9qPy6paQTfgMCAwEAAaNrMGkwHQYDVR0OBBYE
+FLxFSbDoGbAEZAHoayV/xzIHMTu5MB8GA1UdIwQYMBaAFLxFSbDoGbAEZAHoayV/
+xzIHMTu5MA8GA1UdEwEB/wQFMAMBAf8wFgYDVR0RBA8wDYILZm9vLmJhci5jb20w
+DQYJKoZIhvcNAQELBQADggEBAJ6zTuAm5LPUv1A6Y6ASzRqepEfzHJb2AdBKQKG4
+oPqQlqbs2HyILGjGv//h8YU17LKV6W0fQ7bvUlHTiIdlh3mBL838r1cLGO2LaUf1
+JNhtKY+kT9I+KxV1ZPkrASLb2/6673bOyOdTU4D6OSPsywtvZ7qWM564hm2qw62G
+2SgiC4+F61/BkcvG3XRhhAcLpCxyyrzdAuXsnhOHHLziJZ9byLTceWoGnIPk8qA5
+yKpnsH2LPYPUeY1HxNTNTUc0+BQpjikqPmdSyYGi4EUwBEhMVYZBhJLjmaEL3Dee
+7zt7DFeERauy/uHL+LteokP0E7eKgAk+amoJxY+PYv2jMZk=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
new file mode 100644
index 000000000..a4f1c00ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert-wildcard.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDJDCCAgygAwIBAgIUSrSbKLf0bLEGogWx/gCw2GCtvxEwDQYJKoZIhvcNAQEL
+BQAwEzERMA8GA1UEAwwIVGVzdCBJbmMwHhcNMjQwMjI5MDkzMDEwWhcNMzQwMjI2
+MDkzMDEwWjATMREwDwYDVQQDDAhUZXN0IEluYzCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAK1JzjPIiWg3qoHSrAddkeJjaMP9iyMTi/BPo9cJPoRE8Zi7
+WapUrXL/9A9r+jHMyGIZNZNdcZ5cY2Xv0LP8ZxVy2lk0+3wtYzHnpGYGVtyq2tet
+DhFsiPl82YRjC0mzWa4QMz4SXzFHNgIDpRdhfrovmseuWGQE8pV4Ud9UK/SKilMO
+qtB5JirLP2Vs5T1oWicWLQvfbGwv7sFDdr9bG0XtSQp17HSgo50SDE5+BjSmptFw
+1VcKLlqahMXBDDiorgwhIhGGKpESeM0P7bFhVmkM3ash2xSTBuFUBDlE4JOahzws
+DXrupUhDdS1hdc2fPrjhFAlJfWEYZ6BlZjysiVUCAwEAAaNwMG4wHQYDVR0OBBYE
+FBQufK1LibuVm9Ts/VjBx8L3uiNeMB8GA1UdIwQYMBaAFBQufK1LibuVm9Ts/VjB
+x8L3uiNeMA8GA1UdEwEB/wQFMAMBAf8wGwYDVR0RBBQwEoIBKoINKi5leGFtcGxl
+LmNvbTANBgkqhkiG9w0BAQsFAAOCAQEAfPS41agevWMV3ZXt0COFG3uYfPFXnVw6
+P41p9O6GkdYsuqFvPeTyyH2/dAIKKwSzM/pthg8Kn8LZlmJyFNnA1stJxn5XdbV1
+pPqj8UvYCBzyjMIqmRyoiyLiQlbohMa0UdEBKcH/PdLE9K8TGJrZgoGXqq1WmitD
+3vcPjSePKEiUJVS9lChySs0KY5B+hUQD0Jj6npFD4Zk0xqdxh0rWueCqq7vjqEYz
+pj4Pwrufn1PBTmfxMuV/UJV5ebikeuZP35kWzLR7ZWAL7wuDdWp/6o4yk3QLanDQ
+CwgCFcX+ss+0VyuM3YerTOUU8QVJJx4UZANZx6+43pdJZOcntPZ4CA==
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
new file mode 100644
index 000000000..84a712c48
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-cert.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDDTCCAfWgAwIBAgIUEFMhP9eJ9XABWsQ5Zm6bRk2cLNQwDQYJKoZIhvcNAQEL
+BQAwFjEUMBIGA1UEAwwLZm9vLmJhci5jb20wHhcNMjQwMjI5MDkzMDEwWhcNMzQw
+MjI2MDkzMDEwWjAWMRQwEgYDVQQDDAtmb28uYmFyLmNvbTCCASIwDQYJKoZIhvcN
+AQEBBQADggEPADCCAQoCggEBAJlI6YxE9ZkCPs6pCQxbrCmeix9P5Dfx9Ru5LD4T
+JmdW7IKdtQV/wfLmtsu76B+aTdCjWe0BTfeOORBbR3cPAG6ElQLiclQUrun3q+gs
+JpK+I7cI+j5w8I68XH5WQ7rVUtbwHpqbw+cVnBqIUOLiIatjIf7KX51M1uF9cfEH
+E4DncH6rbr59/RFZBskhxs5OzwJIfohkyvFweuTwxK/VpjI+7Oc48ABCXpNO9D/q
+Eh+rOaujAMcXgHQITkCiiUTcUo6LSH9vLZPtaqfzoZq6nhMqpW65E1pAwF3jyTTx
+a5I8JcfSFjkieZ20LUQMn7M8U4xHjao/gvH0CAfdB7RLU2sCAwEAAaNTMFEwHQYD
+VR0OBBYEFORCE8u/1DDW7ihZp7cx9tSmPm6OMB8GA1UdIwQYMBaAFORCE8u/1DDW
+7ihZp7cx9tSmPm6OMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+AFt53zjsqTaH5a8E2chvmWAgCrxRK8bVLMxiwNGjbmEPRz+w6Nx+k0A8KEcIDsKc
+SXci58u4oWbtVJBlza/ZujHR6P1BnOpl+aoy784bbd4P39wTLoXfMfbBCm1vevh9
+AJKnw2Ztqr4mkbLcxEqlq3sBLFAS9sQLnKNCe2cGLdTp2boG+qcgyQgCIM6f8EMv
+WPifCMMGuzK/GRF4bPO/YF48ewDu3Ueih0XXdUAOE9CtUa8NIhc1UPaOzPrtYVqr
+ZOGkv/Ku+B78h8SEsO9XrQcuwbOnJx6KtR+aeykvApXCQ3fZC/bYKAAR+P8AJoQZ
+bwIUmXi4gj5m+bKPhe+ir+E=
+-----END CERTIFICATE-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
new file mode 100644
index 000000000..4a103794b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-san.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDKaMciMsasqpP7
+NQQq1IWx9JPj8jhnW9bCORGswP6fQaZkiM1/fVYqhboWvoH9UNBobf1oeRcuFCs3
+IKOCb96nd6/NqvjNFaIwI+0QWo4sLD0g1buoTYsuAhPSHNmm6podRzJW0J2mGn15
+GaEYbwh93p2dYdrX0aa5sGvr2Dtx5S5PZMdmd8XFyGnjzaATnu9VPbf4LCmpI5yJ
+O61dEv/wVumGBGJR0cU20nqMqrEgtCJi/4E/tHZv65rVNHtS1VDBs0CPwRTKg/4V
+IEq8Hh9LewYxTrCCtkutpaEPOx0DseZ7VWjzuAvEwHcYXlHArHKFENt97bDKPaj8
+uqWkE34DAgMBAAECggEAOh5v32/5ACdSqnUEp0+yu/BgbrlkXLlQJyC/5HzeH9h3
+8LIfX5YbocYYMuOs65HC5dl/Q/pRH5gG+KNUj+WTZz7EqieHnUuy8GPAdEusOx7Q
+xpbYdXEen61VB6XlETqX2gRRfgAU5FcC5Dzpttxa8dl0JHauof2/A96WfnfuSbtk
+GlCLQdMg+pstPWq3rXeUQ09LFQdOCsZsUz76QzlxXo2YlCDcIQVprT0YlkZ5iIFM
+2HkFtaJGBW6bTNjiTyqSQTkz35AIk8mIZbuqjLZC65WKpwgbscVMxl5eRRuSQ06o
+BFnZYJDLeeDmD7yV2vFS14WNDnohPyw9dcAzRO614QKBgQDoSJ7InpRExuud2Cij
+36xMfwcXpmfh63EBDhmgw6L4EhJ25zKm1ZzKL+ULAzLos/Y3w69Rf1X6miHZ93Gk
+EjHFGKorY8TRegJny/uhUNqEc0KzB2BhSucXFGs6XTWM2qGXGRK2ecepJjTX7uy3
+Z2Pq/wD396BDb7gt+L71PSWD2QKBgQDfE064ojNLQ2yszXmL283TzI+Cadcs28GV
+f+5cV97QSEimSsgK9hrg7PzdcEk7jkAye1GgRldqEoH+9lrIH8ltTIkiw/F8lvkw
+3UM9XvR9MKPEGKuxxFo0I/ksxtaHcSALpkFQMgakC5386XgOiIcOaM7hib3hrWBx
+HKpZuq0TOwKBgAg3OVaDNV9RYdgNYzKYoLF79LZDbn0xJKgS5ZkoEkWP7hNCjioU
+eB02oHVJQa21X8oNI9BQHqxkczoQZHaXJieAfdRXDQkTta4SKu5Du9bfdMZ8Rk5q
+pc3NLRW9Yj1/JiQAAQdvOz6iWVAh5UF/aKtRJamfmo2IEA2gNLDb3s3RAoGAUcXq
+HZSX6QcWV2IbJEG2+eUK1mumDTOhiwQShJdRfliBCTRwkFQXFkzJhQMcVVCYB+lc
+yrv+X0vZi3UTYjkExaRAwRXC+ED/qAH0HBMq3Jlv7vp8NfYcevCU7u0UxyGY9axE
+VPmBpbD8gTG0aN9zYrzY2aR8jrXXnJ89cxcTSvECgYEAvtFZMBh+noQxMttnh0/L
+LwrAjedj8pWOAPzCdDFxvgzVp1mdi7GxbH4noEhcPhTlZ53Wfi3oOB4uhcGdXWpk
+HbjIWVUWczRKh15dICHNcbykU55T6p1jpPyYXsJfmonCWVYt9yppsLJ5wCu648J3
+QT4FZnPrtsI8mIcPI24A4xU=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
new file mode 100644
index 000000000..4b212d5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1-wildcard.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCtSc4zyIloN6qB
+0qwHXZHiY2jD/YsjE4vwT6PXCT6ERPGYu1mqVK1y//QPa/oxzMhiGTWTXXGeXGNl
+79Cz/GcVctpZNPt8LWMx56RmBlbcqtrXrQ4RbIj5fNmEYwtJs1muEDM+El8xRzYC
+A6UXYX66L5rHrlhkBPKVeFHfVCv0iopTDqrQeSYqyz9lbOU9aFonFi0L32xsL+7B
+Q3a/WxtF7UkKdex0oKOdEgxOfgY0pqbRcNVXCi5amoTFwQw4qK4MISIRhiqREnjN
+D+2xYVZpDN2rIdsUkwbhVAQ5ROCTmoc8LA167qVIQ3UtYXXNnz644RQJSX1hGGeg
+ZWY8rIlVAgMBAAECggEAJjN4jSreu8ZVxNPcD62dfPJcRKSOuTdUaLAt1rhXe1I1
+jm1yyV1sdUcelw2/NJ5H6HRVPrzhUL9ePDkfYaY5VV2h6/uFmyzoSrado84u9OuH
+Xfds/ANYuONAknJBKUir8vboTP1A1fy0V8JU8TARf1sCPJXfL4F1tuS0685C+F/6
+djrRq8ijw7wBgfptXeecVB1uqrKflKU4i86gCX6fC9KIa4YOHUUrR/d1epe1KujW
+5JZtbgIrsWT8Yk/m47R6Azk1UotZVxKbZyCYsQB9iTfLSXU9mIC7uPuYw9qwBiRo
+YR00BVI3BtUrcvoQtL3P7jWA/f0EHmOKCRLGOaNFkQKBgQDyB+MSSqbWhuwXVc2g
+RViOUqQtthqku+9kZce1O8NZTDjAoCP7K5TIs8RoZLnIS12r4V3X9B4NkkxDwBvj
+ngM1MBppNlKrRvGTLIqtsu9dsSzzNueZZLAtovIg4aEP2cBLmoc4XcDQiDdU/EjB
+TypTbDm40z9pBl3EBRXdFCxlaQKBgQC3SjejSRC3vAuA8QNeX2RyOB7qU5M/5EMJ
+FeNB3KNzper/b17bgumhG8XE+fw9OhyWg8kipHbicddO3UsNYF6wOpTf5XUmPhJJ
+rxX3ibB3imjuMnrBBc9oEQYrHYe7e8hqb8e8tsrl23t1zNTYfEAV/mgGGvSKLkb+
+x4zkfDTrDQKBgQDhw1Ggoln2Cmz3Z2Yjdgwg1h2nNhKsT1ICyJ39A/44sczOgZKO
+nBxxCp7O8gYKO6LozZQH+QJ/jlPtbqmVLLO5TWGVesKqWcbFjereE+cL8lUHmdN3
+VmCwcSqCWXUvn+Kroz026t0Mp8NVVu9Wwk2s+2rsaMDharrUOhom2sZ+4QKBgQCp
+QYDlaShl8uFQnb91m3NfQlHSI4E7o+b/cdXdUQkjV1kNrmOTI23pF4NmpU53n70c
+hO/s7KDX9TZVHmcbIB3wcPhfVT38JZ+vqV4Iq35otUi2hajzrBDeUbI3iFp6GBF3
+sGdq7gWpgyecHZ2DmCF57edTk/qzy45F4jJKICSh1QKBgDoHRNBc84OghC3mnpkq
+h/dERHHhseCqFa79Z/47hGM02YOhm8PdkIFBubwGZYO8slx+OLFmg9hdf1vahJBg
+G36uNic5VarCL4x3RsMiZCwmokP9AR52D/vvnxR47jbP/x+4B2qc6fwJVAQNhFg0
+KtOqp0kWe61o2COcNV/PVxj3
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
new file mode 100644
index 000000000..d07adaf01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs1.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQCZSOmMRPWZAj7O
+qQkMW6wpnosfT+Q38fUbuSw+EyZnVuyCnbUFf8Hy5rbLu+gfmk3Qo1ntAU33jjkQ
+W0d3DwBuhJUC4nJUFK7p96voLCaSviO3CPo+cPCOvFx+VkO61VLW8B6am8PnFZwa
+iFDi4iGrYyH+yl+dTNbhfXHxBxOA53B+q26+ff0RWQbJIcbOTs8CSH6IZMrxcHrk
+8MSv1aYyPuznOPAAQl6TTvQ/6hIfqzmrowDHF4B0CE5AoolE3FKOi0h/by2T7Wqn
+86Gaup4TKqVuuRNaQMBd48k08WuSPCXH0hY5InmdtC1EDJ+zPFOMR42qP4Lx9AgH
+3Qe0S1NrAgMBAAECgf96g/PYxvaZy4Bn1NrJBd8LZOgcbZc2gnx6Ikv/UXZ0Nhlx
+EYiKjeFjV6HW5oEXrZ+/mPf4dusVaL74U9VojuPJceAeRrjL3eOhbHtcx+0gcGLg
+XxF9TRap65TuUd1ai04hGwYf75sbP7RKbPivwZgUAe0CpVufchnXqrsYr8pJY51O
+WVkSqz4RY9Wm0k5G1JFyIyEC9umDlujcHNtRVmafkNfAtCliPrFKc/n9nJfO6RFP
+7g7V/IvqnuIr7PE3Gn6PaT+Bgg448td5JzPpTA5ZBcBo2orz/kxYPFpr/gPUBqQd
+o6nWqw76ZxwPldwLhJ+XYNX7ouctUSCL9u77fyECgYEAyv7Dlxf+KQlfDwmo/r1T
+0L1ZnH472hiIedSheyVBHbEVTSmr42BRljW4DbRcQM4VcxxDkGrR76RGe9og6mzc
+Rv8+VlCX2+qy9p5m6ZXrbAw30zC/5mPkRWubhUhi+9eCMZa/hAI/RFv269DrBD2/
+6kg0F8X0O/6wI+WpatK3W0cCgYEAwU9A6bJpfaXKKXPGmOG/nUxTyzyqYjKNZJd/
+9GhEnuGjK5CAEVPJa8kZvfQzlWmwZafq0DhqI8vLaFCDf8Y8E99Man3GWhUb3V/J
+qNQQS356NCfZw7lxoKKBIvT6cwihTnsE/R4HCsal2wwN4Zl9HWNBgamS7TLkz1Lh
+fwRDkL0CgYBZ49j+5nwA9gpnIVL5gyNDcyXke63LVUPSF0tuub+NA2a4ZbSdGoDm
+cGFRiEW12Mx8zc5JfFP8t5USsTQUOyKMOekD1ep5UwPu25Qc6et3TC3IUnUX87IY
+357dtYFHnlYj2WpzbX9QqRy9riT0GtgKSfDvehQ+IPkk3EVabXcObwKBgGGxC70O
+zQESp/gK6nKYo5161V4Aapr1sT8E0UVS7Fre7Pc3L4GSNliiaL/2iZsYrmyxT5mq
+6PjuJP2yssIADJx+XL/0kCk2Qb6+icsoYJPGdzukaAjhzuq/NUPVSjyYP+zJftvs
+MOLhQTBSBzHbv776SkCc0gPNlJSx7gOixAKBAoGAJBGUn3e5AfComA1E1DxRyLZj
+T0PkACePjD+xkFJhwDhCgswhm4UJg1fAo1hBQRFttpVC/uBLck18MEAI1vdfSyPv
+kSg5kVqPju3sg39TMgOVewjP3E3AMQGug1P71Yk2zYJPlh95dLU5HJVno6ovB+Pm
+Lqy+Mzx3wkF0d8ePXQ4=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
new file mode 100644
index 000000000..4a103794b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-san.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDKaMciMsasqpP7
+NQQq1IWx9JPj8jhnW9bCORGswP6fQaZkiM1/fVYqhboWvoH9UNBobf1oeRcuFCs3
+IKOCb96nd6/NqvjNFaIwI+0QWo4sLD0g1buoTYsuAhPSHNmm6podRzJW0J2mGn15
+GaEYbwh93p2dYdrX0aa5sGvr2Dtx5S5PZMdmd8XFyGnjzaATnu9VPbf4LCmpI5yJ
+O61dEv/wVumGBGJR0cU20nqMqrEgtCJi/4E/tHZv65rVNHtS1VDBs0CPwRTKg/4V
+IEq8Hh9LewYxTrCCtkutpaEPOx0DseZ7VWjzuAvEwHcYXlHArHKFENt97bDKPaj8
+uqWkE34DAgMBAAECggEAOh5v32/5ACdSqnUEp0+yu/BgbrlkXLlQJyC/5HzeH9h3
+8LIfX5YbocYYMuOs65HC5dl/Q/pRH5gG+KNUj+WTZz7EqieHnUuy8GPAdEusOx7Q
+xpbYdXEen61VB6XlETqX2gRRfgAU5FcC5Dzpttxa8dl0JHauof2/A96WfnfuSbtk
+GlCLQdMg+pstPWq3rXeUQ09LFQdOCsZsUz76QzlxXo2YlCDcIQVprT0YlkZ5iIFM
+2HkFtaJGBW6bTNjiTyqSQTkz35AIk8mIZbuqjLZC65WKpwgbscVMxl5eRRuSQ06o
+BFnZYJDLeeDmD7yV2vFS14WNDnohPyw9dcAzRO614QKBgQDoSJ7InpRExuud2Cij
+36xMfwcXpmfh63EBDhmgw6L4EhJ25zKm1ZzKL+ULAzLos/Y3w69Rf1X6miHZ93Gk
+EjHFGKorY8TRegJny/uhUNqEc0KzB2BhSucXFGs6XTWM2qGXGRK2ecepJjTX7uy3
+Z2Pq/wD396BDb7gt+L71PSWD2QKBgQDfE064ojNLQ2yszXmL283TzI+Cadcs28GV
+f+5cV97QSEimSsgK9hrg7PzdcEk7jkAye1GgRldqEoH+9lrIH8ltTIkiw/F8lvkw
+3UM9XvR9MKPEGKuxxFo0I/ksxtaHcSALpkFQMgakC5386XgOiIcOaM7hib3hrWBx
+HKpZuq0TOwKBgAg3OVaDNV9RYdgNYzKYoLF79LZDbn0xJKgS5ZkoEkWP7hNCjioU
+eB02oHVJQa21X8oNI9BQHqxkczoQZHaXJieAfdRXDQkTta4SKu5Du9bfdMZ8Rk5q
+pc3NLRW9Yj1/JiQAAQdvOz6iWVAh5UF/aKtRJamfmo2IEA2gNLDb3s3RAoGAUcXq
+HZSX6QcWV2IbJEG2+eUK1mumDTOhiwQShJdRfliBCTRwkFQXFkzJhQMcVVCYB+lc
+yrv+X0vZi3UTYjkExaRAwRXC+ED/qAH0HBMq3Jlv7vp8NfYcevCU7u0UxyGY9axE
+VPmBpbD8gTG0aN9zYrzY2aR8jrXXnJ89cxcTSvECgYEAvtFZMBh+noQxMttnh0/L
+LwrAjedj8pWOAPzCdDFxvgzVp1mdi7GxbH4noEhcPhTlZ53Wfi3oOB4uhcGdXWpk
+HbjIWVUWczRKh15dICHNcbykU55T6p1jpPyYXsJfmonCWVYt9yppsLJ5wCu648J3
+QT4FZnPrtsI8mIcPI24A4xU=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
new file mode 100644
index 000000000..4b212d5fa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8-wildcard.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCtSc4zyIloN6qB
+0qwHXZHiY2jD/YsjE4vwT6PXCT6ERPGYu1mqVK1y//QPa/oxzMhiGTWTXXGeXGNl
+79Cz/GcVctpZNPt8LWMx56RmBlbcqtrXrQ4RbIj5fNmEYwtJs1muEDM+El8xRzYC
+A6UXYX66L5rHrlhkBPKVeFHfVCv0iopTDqrQeSYqyz9lbOU9aFonFi0L32xsL+7B
+Q3a/WxtF7UkKdex0oKOdEgxOfgY0pqbRcNVXCi5amoTFwQw4qK4MISIRhiqREnjN
+D+2xYVZpDN2rIdsUkwbhVAQ5ROCTmoc8LA167qVIQ3UtYXXNnz644RQJSX1hGGeg
+ZWY8rIlVAgMBAAECggEAJjN4jSreu8ZVxNPcD62dfPJcRKSOuTdUaLAt1rhXe1I1
+jm1yyV1sdUcelw2/NJ5H6HRVPrzhUL9ePDkfYaY5VV2h6/uFmyzoSrado84u9OuH
+Xfds/ANYuONAknJBKUir8vboTP1A1fy0V8JU8TARf1sCPJXfL4F1tuS0685C+F/6
+djrRq8ijw7wBgfptXeecVB1uqrKflKU4i86gCX6fC9KIa4YOHUUrR/d1epe1KujW
+5JZtbgIrsWT8Yk/m47R6Azk1UotZVxKbZyCYsQB9iTfLSXU9mIC7uPuYw9qwBiRo
+YR00BVI3BtUrcvoQtL3P7jWA/f0EHmOKCRLGOaNFkQKBgQDyB+MSSqbWhuwXVc2g
+RViOUqQtthqku+9kZce1O8NZTDjAoCP7K5TIs8RoZLnIS12r4V3X9B4NkkxDwBvj
+ngM1MBppNlKrRvGTLIqtsu9dsSzzNueZZLAtovIg4aEP2cBLmoc4XcDQiDdU/EjB
+TypTbDm40z9pBl3EBRXdFCxlaQKBgQC3SjejSRC3vAuA8QNeX2RyOB7qU5M/5EMJ
+FeNB3KNzper/b17bgumhG8XE+fw9OhyWg8kipHbicddO3UsNYF6wOpTf5XUmPhJJ
+rxX3ibB3imjuMnrBBc9oEQYrHYe7e8hqb8e8tsrl23t1zNTYfEAV/mgGGvSKLkb+
+x4zkfDTrDQKBgQDhw1Ggoln2Cmz3Z2Yjdgwg1h2nNhKsT1ICyJ39A/44sczOgZKO
+nBxxCp7O8gYKO6LozZQH+QJ/jlPtbqmVLLO5TWGVesKqWcbFjereE+cL8lUHmdN3
+VmCwcSqCWXUvn+Kroz026t0Mp8NVVu9Wwk2s+2rsaMDharrUOhom2sZ+4QKBgQCp
+QYDlaShl8uFQnb91m3NfQlHSI4E7o+b/cdXdUQkjV1kNrmOTI23pF4NmpU53n70c
+hO/s7KDX9TZVHmcbIB3wcPhfVT38JZ+vqV4Iq35otUi2hajzrBDeUbI3iFp6GBF3
+sGdq7gWpgyecHZ2DmCF57edTk/qzy45F4jJKICSh1QKBgDoHRNBc84OghC3mnpkq
+h/dERHHhseCqFa79Z/47hGM02YOhm8PdkIFBubwGZYO8slx+OLFmg9hdf1vahJBg
+G36uNic5VarCL4x3RsMiZCwmokP9AR52D/vvnxR47jbP/x+4B2qc6fwJVAQNhFg0
+KtOqp0kWe61o2COcNV/PVxj3
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
new file mode 100644
index 000000000..d07adaf01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tls/rsa-pkcs8.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADANBgkqhkiG9w0BAQEFAASCBKQwggSgAgEAAoIBAQCZSOmMRPWZAj7O
+qQkMW6wpnosfT+Q38fUbuSw+EyZnVuyCnbUFf8Hy5rbLu+gfmk3Qo1ntAU33jjkQ
+W0d3DwBuhJUC4nJUFK7p96voLCaSviO3CPo+cPCOvFx+VkO61VLW8B6am8PnFZwa
+iFDi4iGrYyH+yl+dTNbhfXHxBxOA53B+q26+ff0RWQbJIcbOTs8CSH6IZMrxcHrk
+8MSv1aYyPuznOPAAQl6TTvQ/6hIfqzmrowDHF4B0CE5AoolE3FKOi0h/by2T7Wqn
+86Gaup4TKqVuuRNaQMBd48k08WuSPCXH0hY5InmdtC1EDJ+zPFOMR42qP4Lx9AgH
+3Qe0S1NrAgMBAAECgf96g/PYxvaZy4Bn1NrJBd8LZOgcbZc2gnx6Ikv/UXZ0Nhlx
+EYiKjeFjV6HW5oEXrZ+/mPf4dusVaL74U9VojuPJceAeRrjL3eOhbHtcx+0gcGLg
+XxF9TRap65TuUd1ai04hGwYf75sbP7RKbPivwZgUAe0CpVufchnXqrsYr8pJY51O
+WVkSqz4RY9Wm0k5G1JFyIyEC9umDlujcHNtRVmafkNfAtCliPrFKc/n9nJfO6RFP
+7g7V/IvqnuIr7PE3Gn6PaT+Bgg448td5JzPpTA5ZBcBo2orz/kxYPFpr/gPUBqQd
+o6nWqw76ZxwPldwLhJ+XYNX7ouctUSCL9u77fyECgYEAyv7Dlxf+KQlfDwmo/r1T
+0L1ZnH472hiIedSheyVBHbEVTSmr42BRljW4DbRcQM4VcxxDkGrR76RGe9og6mzc
+Rv8+VlCX2+qy9p5m6ZXrbAw30zC/5mPkRWubhUhi+9eCMZa/hAI/RFv269DrBD2/
+6kg0F8X0O/6wI+WpatK3W0cCgYEAwU9A6bJpfaXKKXPGmOG/nUxTyzyqYjKNZJd/
+9GhEnuGjK5CAEVPJa8kZvfQzlWmwZafq0DhqI8vLaFCDf8Y8E99Man3GWhUb3V/J
+qNQQS356NCfZw7lxoKKBIvT6cwihTnsE/R4HCsal2wwN4Zl9HWNBgamS7TLkz1Lh
+fwRDkL0CgYBZ49j+5nwA9gpnIVL5gyNDcyXke63LVUPSF0tuub+NA2a4ZbSdGoDm
+cGFRiEW12Mx8zc5JfFP8t5USsTQUOyKMOekD1ep5UwPu25Qc6et3TC3IUnUX87IY
+357dtYFHnlYj2WpzbX9QqRy9riT0GtgKSfDvehQ+IPkk3EVabXcObwKBgGGxC70O
+zQESp/gK6nKYo5161V4Aapr1sT8E0UVS7Fre7Pc3L4GSNliiaL/2iZsYrmyxT5mq
+6PjuJP2yssIADJx+XL/0kCk2Qb6+icsoYJPGdzukaAjhzuq/NUPVSjyYP+zJftvs
+MOLhQTBSBzHbv776SkCc0gPNlJSx7gOixAKBAoGAJBGUn3e5AfComA1E1DxRyLZj
+T0PkACePjD+xkFJhwDhCgswhm4UJg1fAo1hBQRFttpVC/uBLck18MEAI1vdfSyPv
+kSg5kVqPju3sg39TMgOVewjP3E3AMQGug1P71Yk2zYJPlh95dLU5HJVno6ovB+Pm
+Lqy+Mzx3wkF0d8ePXQ4=
+-----END PRIVATE KEY-----
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
new file mode 100644
index 000000000..a10119662
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.in.yaml
@@ -0,0 +1,32 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          port: 90
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
new file mode 100644
index 000000000..95aec2678
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-attaching-to-gateway.out.yaml
@@ -0,0 +1,112 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
new file mode 100644
index 000000000..e7d44bece
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.in.yaml
@@ -0,0 +1,48 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "foo.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-2
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "bar.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
new file mode 100644
index 000000000..6cd2d930b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-multiple.out.yaml
@@ -0,0 +1,162 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 2
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    hostnames:
+    - foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-2
+    namespace: default
+  spec:
+    hostnames:
+    - bar.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - foo.com
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-2/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-2
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - bar.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
new file mode 100644
index 000000000..f37773dbd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.in.yaml
@@ -0,0 +1,29 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          port: 90
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
new file mode 100644
index 000000000..a75fdbe5e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-not-attaching-to-gateway-with-no-mode.out.yaml
@@ -0,0 +1,81 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 90
+      protocol: TLS
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must have TLS set when protocol is TLS.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TCPRoute
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
new file mode 100644
index 000000000..00e85a873
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.in.yaml
@@ -0,0 +1,78 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          port: 90
+          tls:
+            mode: Passthrough
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              namespace: test-service-namespace
+              port: 8080
+services:
+  - apiVersion: v1
+    kind: Service
+    metadata:
+      namespace: test-service-namespace
+      name: service-1
+    spec:
+      clusterIP: 1.1.1.1
+      ports:
+        - name: http
+          port: 8080
+          protocol: TCP
+          targetPort: 8080
+endpointSlices:
+  - apiVersion: discovery.k8s.io/v1
+    kind: EndpointSlice
+    metadata:
+      name: endpointslice-service-1
+      namespace: test-service-namespace
+      labels:
+        kubernetes.io/service-name: service-1
+    addressType: IPv4
+    ports:
+      - name: http
+        protocol: TCP
+        port: 8080
+    endpoints:
+      - addresses:
+          - "7.7.7.7"
+        conditions:
+          ready: true
+referenceGrants:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: ReferenceGrant
+    metadata:
+      namespace: test-service-namespace
+      name: referencegrant-1
+    spec:
+      from:
+        - group: gateway.networking.k8s.io
+          kind: TLSRoute
+          namespace: default
+      to:
+        - group: ""
+          kind: Service
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
new file mode 100644
index 000000000..e62a5aab0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -0,0 +1,113 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10090
+          name: tls
+          protocol: TLS
+          servicePort: 90
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        namespace: test-service-namespace
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10090
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
new file mode 100644
index 000000000..76f60b075
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.in.yaml
@@ -0,0 +1,31 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
new file mode 100644
index 000000000..919955fee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-hostname.out.yaml
@@ -0,0 +1,111 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - '*'
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
new file mode 100644
index 000000000..621f046a9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.in.yaml
@@ -0,0 +1,33 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    namespace: envoy-gateway
+    name: gateway-1
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - name: tls
+      protocol: TLS
+      port: 91
+      tls:
+        mode: Passthrough
+      allowedRoutes:
+        namespaces:
+          from: All
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    namespace: default
+    name: tlsroute-1
+  spec:
+    parentRefs:
+    - namespace: envoy-gateway
+      name: gateway-1
+    hostnames:
+    - "foo.com"
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
new file mode 100644
index 000000000..f3ef27913
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-empty-listener-hostname.out.yaml
@@ -0,0 +1,113 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      name: tls
+      port: 91
+      protocol: TLS
+      tls:
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Sending translated listener configuration to the data plane
+        reason: Programmed
+        status: "True"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener has been successfully translated
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      listeners:
+      - address: null
+        name: envoy-gateway/gateway-1/tls
+        ports:
+        - containerPort: 10091
+          name: tls
+          protocol: TLS
+          servicePort: 91
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    hostnames:
+    - foo.com
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: Route is accepted
+        reason: Accepted
+        status: "True"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
+    tcp:
+    - address: 0.0.0.0
+      destination:
+        name: tlsroute/default/tlsroute-1/rule/-1
+        settings:
+        - addressType: IP
+          endpoints:
+          - host: 7.7.7.7
+            port: 8080
+          protocol: HTTPS
+          weight: 1
+      name: envoy-gateway/gateway-1/tls/tlsroute-1
+      port: 10091
+      tls:
+        passthrough:
+          snis:
+          - foo.com
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
new file mode 100644
index 000000000..26a91e256
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.in.yaml
@@ -0,0 +1,44 @@
+gateways:
+  - apiVersion: gateway.networking.k8s.io/v1
+    kind: Gateway
+    metadata:
+      namespace: envoy-gateway
+      name: gateway-1
+    spec:
+      gatewayClassName: envoy-gateway-class
+      listeners:
+        - name: tls
+          protocol: TLS
+          hostname: foo.com
+          tls:
+            mode: Passthrough
+            certificateRefs:
+              - name: tls-secret-1
+          port: 90
+          allowedRoutes:
+            namespaces:
+              from: All
+tlsRoutes:
+  - apiVersion: gateway.networking.k8s.io/v1alpha2
+    kind: TLSRoute
+    metadata:
+      namespace: default
+      name: tlsroute-1
+    spec:
+      parentRefs:
+        - namespace: envoy-gateway
+          name: gateway-1
+      rules:
+        - backendRefs:
+            - name: service-1
+              port: 8080
+secrets:
+  - apiVersion: v1
+    kind: Secret
+    metadata:
+      namespace: envoy-gateway
+      name: tls-secret-1
+    type: kubernetes.io/tls
+    data:
+      tls.crt: Zm9vCg==
+      tls.key: YmFyCg==
diff --git a/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
new file mode 100644
index 000000000..92b48bfca
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/testdata/tlsroute-with-listener-both-passthrough-and-cert-data.out.yaml
@@ -0,0 +1,86 @@
+gateways:
+- apiVersion: gateway.networking.k8s.io/v1
+  kind: Gateway
+  metadata:
+    creationTimestamp: null
+    name: gateway-1
+    namespace: envoy-gateway
+  spec:
+    gatewayClassName: envoy-gateway-class
+    listeners:
+    - allowedRoutes:
+        namespaces:
+          from: All
+      hostname: foo.com
+      name: tls
+      port: 90
+      protocol: TLS
+      tls:
+        certificateRefs:
+        - group: null
+          kind: null
+          name: tls-secret-1
+        mode: Passthrough
+  status:
+    listeners:
+    - attachedRoutes: 1
+      conditions:
+      - lastTransitionTime: null
+        message: Listener must not have TLS certificate refs set for TLS mode Passthrough.
+        reason: Invalid
+        status: "False"
+        type: Programmed
+      - lastTransitionTime: null
+        message: Listener references have been resolved
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      name: tls
+      supportedKinds:
+      - group: gateway.networking.k8s.io
+        kind: TLSRoute
+infraIR:
+  envoy-gateway/gateway-1:
+    proxy:
+      metadata:
+        labels:
+          apk.wso2.com/owning-gateway-name: gateway-1
+          apk.wso2.com/owning-gateway-namespace: envoy-gateway
+      name: envoy-gateway/gateway-1
+tlsRoutes:
+- apiVersion: gateway.networking.k8s.io/v1alpha2
+  kind: TLSRoute
+  metadata:
+    creationTimestamp: null
+    name: tlsroute-1
+    namespace: default
+  spec:
+    parentRefs:
+    - name: gateway-1
+      namespace: envoy-gateway
+    rules:
+    - backendRefs:
+      - name: service-1
+        port: 8080
+  status:
+    parents:
+    - conditions:
+      - lastTransitionTime: null
+        message: There are no ready listeners for this parent ref
+        reason: NoReadyListeners
+        status: "False"
+        type: Accepted
+      - lastTransitionTime: null
+        message: Resolved all the Object references for the Route
+        reason: ResolvedRefs
+        status: "True"
+        type: ResolvedRefs
+      controllerName: apk.wso2.com/gatewayclass-controller
+      parentRef:
+        name: gateway-1
+        namespace: envoy-gateway
+xdsIR:
+  envoy-gateway/gateway-1:
+    accessLog:
+      text:
+      - path: /dev/stdout
diff --git a/adapter/internal/operator/gateway-api/tls.go b/adapter/internal/operator/gateway-api/tls.go
new file mode 100644
index 000000000..5cf277c97
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/tls.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"time"
+
+	corev1 "k8s.io/api/core/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// validateTLSSecretData ensures the cert and key provided in a secret
+// is not malformed and can be properly parsed
+func validateTLSSecretsData(secrets []*corev1.Secret, host *v1.Hostname) error {
+	var publicKeyAlgorithm string
+	var parseErr error
+
+	pkaSecretSet := make(map[string][]string)
+	for _, secret := range secrets {
+		certData := secret.Data[corev1.TLSCertKey]
+
+		if err := validateCertificate(certData); err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to validate certificate in %s: %w", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey, err)
+		}
+
+		certBlock, _ := pem.Decode(certData)
+		if certBlock == nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to decode pem data in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey)
+		}
+
+		cert, err := x509.ParseCertificate(certBlock.Bytes)
+		if err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse certificate in %s: %w", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSCertKey, err)
+		}
+		publicKeyAlgorithm = cert.PublicKeyAlgorithm.String()
+
+		keyData := secret.Data[corev1.TLSPrivateKeyKey]
+
+		keyBlock, _ := pem.Decode(keyData)
+		if keyBlock == nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, unable to decode pem data in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+		}
+
+		matchedFQDN, err := verifyHostname(cert, host)
+		if err != nil {
+			return fmt.Errorf("%s/%s must contain valid %s and %s, hostname %s does not match Common Name or DNS Names in the certificate %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, string(*host), corev1.TLSCertKey)
+		}
+		pkaSecretKey := fmt.Sprintf("%s/%s", publicKeyAlgorithm, matchedFQDN)
+
+		// Check whether the public key algorithm and matched certificate FQDN in the referenced secrets are unique.
+		if matchedFQDN, ok := pkaSecretSet[pkaSecretKey]; ok {
+			return fmt.Errorf("%s/%s public key algorithm must be unique, matched certificate FQDN %s has a conflicting algorithm [%s]",
+				secret.Namespace, secret.Name, matchedFQDN, publicKeyAlgorithm)
+
+		}
+		pkaSecretSet[pkaSecretKey] = matchedFQDN
+
+		switch keyBlock.Type {
+		case "PRIVATE KEY":
+			_, err := x509.ParsePKCS8PrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse PKCS8 formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		case "RSA PRIVATE KEY":
+			_, err := x509.ParsePKCS1PrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse PKCS1 formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		case "EC PRIVATE KEY":
+			_, err := x509.ParseECPrivateKey(keyBlock.Bytes)
+			if err != nil {
+				parseErr = fmt.Errorf("%s/%s must contain valid %s and %s, unable to parse EC formatted private key in %s", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, corev1.TLSPrivateKeyKey)
+			}
+		default:
+			return fmt.Errorf("%s/%s must contain valid %s and %s, %s key format found in %s, supported formats are PKCS1, PKCS8 or EC", secret.Namespace, secret.Name, corev1.TLSCertKey, corev1.TLSPrivateKeyKey, keyBlock.Type, corev1.TLSPrivateKeyKey)
+		}
+	}
+
+	return parseErr
+}
+
+// verifyHostname checks if the listener Hostname matches any domain in the certificate, returns a list of matched hosts.
+func verifyHostname(cert *x509.Certificate, host *v1.Hostname) ([]string, error) {
+	var matchedHosts []string
+
+	if len(cert.DNSNames) > 0 {
+		matchedHosts = computeHosts(cert.DNSNames, host)
+	} else {
+		matchedHosts = computeHosts([]string{cert.Subject.CommonName}, host)
+	}
+
+	if len(matchedHosts) > 0 {
+		return matchedHosts, nil
+	}
+
+	return nil, x509.HostnameError{Certificate: cert, Host: string(*host)}
+}
+
+func validateCertificate(data []byte) error {
+	block, _ := pem.Decode(data)
+	if block == nil {
+		return fmt.Errorf("pem decode failed")
+	}
+	certs, err := x509.ParseCertificates(block.Bytes)
+	if err != nil {
+		return err
+	}
+	now := time.Now()
+	roundedTime := now.Truncate(time.Minute)
+
+	// TODO(amali) remove this round logic if any issue happens.
+	// it's added due to issue in gateway conformance test certificate
+	// Only add a minute if the current time is not exactly on the minute
+	if !now.Equal(roundedTime) {
+		roundedTime = roundedTime.Add(time.Minute)
+	}
+	for _, cert := range certs {
+		if roundedTime.After(cert.NotAfter) {
+			return fmt.Errorf("certificate is expired %v, now: %v", cert.NotAfter, roundedTime)
+		}
+		if roundedTime.Before(cert.NotBefore) {
+			return fmt.Errorf("certificate is not yet valid %v, now %v", cert.NotBefore, roundedTime)
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/tls_test.go b/adapter/internal/operator/gateway-api/tls_test.go
new file mode 100644
index 000000000..8faaef876
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/tls_test.go
@@ -0,0 +1,236 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	secretName      = "secret"
+	secretNamespace = "test"
+)
+
+// createTestSecret creates a K8s tls secret using testdata
+// see for more info <https://kubernetes.io/docs/concepts/configuration/secret/#tls-secrets>
+func createTestSecrets(t *testing.T, certFile, keyFile string) []*corev1.Secret {
+	t.Helper()
+
+	certData, err := os.ReadFile(filepath.Join("testdata", "tls", certFile))
+	require.NoError(t, err)
+
+	keyData, err := os.ReadFile(filepath.Join("testdata", "tls", keyFile))
+	require.NoError(t, err)
+
+	return []*corev1.Secret{{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      secretName,
+			Namespace: secretNamespace,
+		},
+		Type: corev1.SecretTypeTLS,
+		Data: map[string][]byte{
+			corev1.TLSCertKey:       certData,
+			corev1.TLSPrivateKeyKey: keyData,
+		},
+	}}
+}
+
+// TestValidateTLSSecretData ensures that we can properly validate the contents of a K8s tls secret.
+// The test assumes the secret is valid and was able to be applied to a cluster.
+func TestValidateTLSSecretsData(t *testing.T) {
+	type testCase struct {
+		Name        string
+		CertFile    string
+		KeyFile     string
+		Domain      v1.Hostname
+		ExpectedErr error
+	}
+
+	testCases := []testCase{
+		{
+			Name:        "valid-rsa-pkcs1",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "rsa-pkcs1.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-pkcs8",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-san-domain",
+			CertFile:    "rsa-cert-san.pem",
+			KeyFile:     "rsa-pkcs8-san.key",
+			Domain:      "foo.bar.com",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-rsa-wildcard-domain",
+			CertFile:    "rsa-cert-wildcard.pem",
+			KeyFile:     "rsa-pkcs1-wildcard.key",
+			Domain:      "foo.bar.com",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p256",
+			CertFile:    "ecdsa-p256-cert.pem",
+			KeyFile:     "ecdsa-p256.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p384",
+			CertFile:    "ecdsa-p384-cert.pem",
+			KeyFile:     "ecdsa-p384.key",
+			Domain:      "*",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "malformed-cert-pem-encoding",
+			CertFile:    "malformed-encoding.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to validate certificate in tls.crt: pem decode failed"),
+		},
+		{
+			Name:        "malformed-key-pem-encoding",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-encoding.pem",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to decode pem data in tls.key"),
+		},
+		{
+			Name:        "malformed-cert",
+			CertFile:    "malformed-cert.pem",
+			KeyFile:     "rsa-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to validate certificate in tls.crt: x509: malformed certificate"),
+		},
+		{
+			Name:        "malformed-pkcs8-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-pkcs8.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse PKCS8 formatted private key in tls.key"),
+		},
+		{
+			Name:        "malformed-pkcs1-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-pkcs1.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse PKCS1 formatted private key in tls.key"),
+		},
+		{
+			Name:        "malformed-ecdsa-key",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "malformed-ecdsa.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, unable to parse EC formatted private key in tls.key"),
+		},
+		{
+			Name:        "invalid-key-type",
+			CertFile:    "rsa-cert.pem",
+			KeyFile:     "invalid-key-type.key",
+			Domain:      "*",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, FOO key format found in tls.key, supported formats are PKCS1, PKCS8 or EC"),
+		},
+		{
+			Name:        "invalid-domain-cert",
+			CertFile:    "rsa-cert-san.pem",
+			KeyFile:     "rsa-pkcs8-san.key",
+			Domain:      "*.example.com",
+			ExpectedErr: errors.New("test/secret must contain valid tls.crt and tls.key, hostname *.example.com does not match Common Name or DNS Names in the certificate tls.crt"),
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			secrets := createTestSecrets(t, tc.CertFile, tc.KeyFile)
+			require.NotNil(t, secrets)
+			err := validateTLSSecretsData(secrets, &tc.Domain)
+			if tc.ExpectedErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tc.ExpectedErr.Error())
+			}
+		})
+	}
+}
+
+func TestValidateCertificate(t *testing.T) {
+	type testCase struct {
+		Name        string
+		CertFile    string
+		ExpectedErr error
+	}
+
+	testCases := []testCase{
+		{
+			Name:        "valid-rsa-cert",
+			CertFile:    "rsa-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p256-cert",
+			CertFile:    "ecdsa-p256-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "valid-ecdsa-p384-cert",
+			CertFile:    "ecdsa-p384-cert.pem",
+			ExpectedErr: nil,
+		},
+		{
+			Name:        "malformed-cert",
+			CertFile:    "malformed-cert.pem",
+			ExpectedErr: errors.New("x509: malformed certificate"),
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.Name, func(t *testing.T) {
+			certData, err := os.ReadFile(filepath.Join("testdata", "tls", tc.CertFile))
+			require.NoError(t, err)
+			err = validateCertificate(certData)
+			if tc.ExpectedErr == nil {
+				require.NoError(t, err)
+			} else {
+				require.EqualError(t, err, tc.ExpectedErr.Error())
+			}
+		})
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator.go b/adapter/internal/operator/gateway-api/translator.go
new file mode 100644
index 000000000..90b54a421
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator.go
@@ -0,0 +1,292 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"golang.org/x/exp/maps"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	KindConfigMap        = "ConfigMap"
+	KindBackendTLSPolicy = "BackendTLSPolicy"
+	KindGateway          = "Gateway"
+	KindGatewayClass     = "GatewayClass"
+	KindGRPCRoute        = "GRPCRoute"
+	KindHTTPRoute        = "HTTPRoute"
+	KindNamespace        = "Namespace"
+	KindTLSRoute         = "TLSRoute"
+	KindTCPRoute         = "TCPRoute"
+	KindUDPRoute         = "UDPRoute"
+	KindService          = "Service"
+	KindServiceImport    = "ServiceImport"
+	KindSecret           = "Secret"
+	KindBackend          = "Backend"
+
+	GroupMultiClusterService = "multicluster.x-k8s.io"
+	// OwningGatewayNamespaceLabel is the owner reference label used for managed infra.
+	// The value should be the namespace of the accepted Envoy Gateway.
+	OwningGatewayNamespaceLabel = "apk.wso2.com/owning-gateway-namespace"
+
+	OwningGatewayClassLabel = "apk.wso2.com/owning-gatewayclass"
+	// OwningGatewayNameLabel is the owner reference label used for managed infra.
+	// The value should be the name of the accepted Envoy Gateway.
+	OwningGatewayNameLabel = "apk.wso2.com/owning-gateway-name"
+
+	// minEphemeralPort is the first port in the ephemeral port range.
+	minEphemeralPort = 1024
+	// wellKnownPortShift is the constant added to the well known port (1-1023)
+	// to convert it into an ephemeral port.
+	wellKnownPortShift = 10000
+)
+
+var _ TranslatorManager = (*Translator)(nil)
+
+type TranslatorManager interface {
+	Translate(resources *Resources) *TranslateResult
+	GetRelevantGateways(gateways []*gwapiv1.Gateway) []*GatewayContext
+
+	RoutesTranslator
+	ListenersTranslator
+	AddressesTranslator
+	FiltersTranslator
+}
+
+// Translator translates Gateway API resources to IRs and computes status
+// for Gateway API resources.
+type Translator struct {
+	// GatewayControllerName is the name of the Gateway API controller
+	GatewayControllerName string
+
+	// GatewayClassName is the name of the GatewayClass
+	// to process Gateways for.
+	GatewayClassName gwapiv1.ObjectName
+
+	// GlobalRateLimitEnabled is true when global
+	// ratelimiting has been configured by the admin.
+	GlobalRateLimitEnabled bool
+
+	// EndpointRoutingDisabled can be set to true to use
+	// the Service Cluster IP for routing to the backend
+	// instead.
+	EndpointRoutingDisabled bool
+
+	// MergeGateways is true when all Gateway Listeners
+	// should be merged under the parent GatewayClass.
+	MergeGateways bool
+
+	// EnvoyPatchPolicyEnabled when the EnvoyPatchPolicy
+	// feature is enabled.
+	EnvoyPatchPolicyEnabled bool
+
+	// ExtensionGroupKinds stores the group/kind for all resources
+	// introduced by an Extension so that the translator can
+	// store referenced resources in the IR for later use.
+	ExtensionGroupKinds []schema.GroupKind
+
+	// Namespace is the namespace that Envoy Gateway runs in.
+	Namespace string
+}
+
+type TranslateResult struct {
+	Resources
+	XdsIR   XdsIRMap   `json:"xdsIR" yaml:"xdsIR"`
+	InfraIR InfraIRMap `json:"infraIR" yaml:"infraIR"`
+}
+
+func newTranslateResult(gateways []*GatewayContext,
+	httpRoutes []*HTTPRouteContext,
+	grpcRoutes []*GRPCRouteContext,
+	tlsRoutes []*TLSRouteContext,
+	tcpRoutes []*TCPRouteContext,
+	udpRoutes []*UDPRouteContext,
+	xdsIR XdsIRMap, infraIR InfraIRMap) *TranslateResult {
+	translateResult := &TranslateResult{
+		XdsIR:   xdsIR,
+		InfraIR: infraIR,
+	}
+
+	for _, gateway := range gateways {
+		translateResult.Gateways = append(translateResult.Gateways, gateway.Gateway)
+	}
+	for _, httpRoute := range httpRoutes {
+		translateResult.HTTPRoutes = append(translateResult.HTTPRoutes, httpRoute.HTTPRoute)
+	}
+	for _, grpcRoute := range grpcRoutes {
+		translateResult.GRPCRoutes = append(translateResult.GRPCRoutes, grpcRoute.GRPCRoute)
+	}
+	for _, tlsRoute := range tlsRoutes {
+		translateResult.TLSRoutes = append(translateResult.TLSRoutes, tlsRoute.TLSRoute)
+	}
+	for _, tcpRoute := range tcpRoutes {
+		translateResult.TCPRoutes = append(translateResult.TCPRoutes, tcpRoute.TCPRoute)
+	}
+	for _, udpRoute := range udpRoutes {
+		translateResult.UDPRoutes = append(translateResult.UDPRoutes, udpRoute.UDPRoute)
+	}
+	return translateResult
+}
+
+func (t *Translator) Translate(resources *Resources) *TranslateResult {
+	// Get Gateways belonging to our GatewayClass.
+	gateways := t.GetRelevantGateways(resources.Gateways)
+
+	// Build IR maps.
+	xdsIR, infraIR := t.InitIRs(gateways, resources)
+
+	// Process all Listeners for all relevant Gateways.
+	t.ProcessListeners(gateways, xdsIR, infraIR, resources)
+
+	// Process all Addresses for all relevant Gateways.
+	t.ProcessAddresses(gateways, infraIR)
+
+	// Process all relevant HTTPRoutes.
+	httpRoutes := t.ProcessHTTPRoutes(resources.HTTPRoutes, gateways, resources, xdsIR)
+
+	// Process all relevant GRPCRoutes.
+	// grpcRoutes := t.ProcessGRPCRoutes(resources.GRPCRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant TLSRoutes.
+	// tlsRoutes := t.ProcessTLSRoutes(resources.TLSRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant TCPRoutes.
+	// tcpRoutes := t.ProcessTCPRoutes(resources.TCPRoutes, gateways, resources, xdsIR)
+
+	// // Process all relevant UDPRoutes.
+	// udpRoutes := t.ProcessUDPRoutes(resources.UDPRoutes, gateways, resources, xdsIR)
+
+	// Process BackendTrafficPolicies
+	// routes := []RouteContext{}
+	// for _, h := range httpRoutes {
+	// 	routes = append(routes, h)
+	// }
+	// for _, g := range grpcRoutes {
+	// 	routes = append(routes, g)
+	// }
+	// for _, t := range tlsRoutes {
+	// 	routes = append(routes, t)
+	// }
+	// for _, t := range tcpRoutes {
+	// 	routes = append(routes, t)
+	// }
+	// for _, u := range udpRoutes {
+	// 	routes = append(routes, u)
+	// }
+
+	// Process BackendTrafficPolicies
+	// backendTrafficPolicies := t.ProcessBackendTrafficPolicies(
+	// 	resources.BackendTrafficPolicies, gateways, routes, xdsIR)
+
+	// // Process SecurityPolicies
+	// securityPolicies := t.ProcessSecurityPolicies(
+	// 	resources.SecurityPolicies, gateways, routes, resources, xdsIR)
+
+	// Sort xdsIR based on the Gateway API spec
+	sortXdsIRMap(xdsIR)
+
+	return newTranslateResult(gateways, httpRoutes, nil, nil, nil, nil, xdsIR, infraIR)
+
+}
+
+// GetRelevantGateways returns GatewayContexts, containing a copy of the original
+// Gateway with the Listener statuses reset.
+func (t *Translator) GetRelevantGateways(gateways []*gwapiv1.Gateway) []*GatewayContext {
+	var relevant []*GatewayContext
+
+	for _, gateway := range gateways {
+		if gateway == nil {
+			panic("received nil gateway")
+		}
+
+		if gateway.Spec.GatewayClassName == t.GatewayClassName {
+			gc := &GatewayContext{
+				Gateway: gateway.DeepCopy(),
+			}
+			gc.ResetListeners()
+
+			relevant = append(relevant, gc)
+		}
+	}
+
+	return relevant
+}
+
+// InitIRs checks if mergeGateways is enabled in EnvoyProxy config and initializes XdsIR and InfraIR maps with adequate keys.
+func (t *Translator) InitIRs(gateways []*GatewayContext, resources *Resources) (map[string]*ir.Xds, map[string]*ir.Infra) {
+	xdsIR := make(XdsIRMap)
+	infraIR := make(InfraIRMap)
+
+	var irKey string
+	for _, gateway := range gateways {
+		gwXdsIR := &ir.Xds{}
+		gwInfraIR := ir.NewInfra()
+		labels := infrastructureLabels(gateway.Gateway)
+		annotations := infrastructureAnnotations(gateway.Gateway)
+		gwInfraIR.Proxy.GetProxyMetadata().Annotations = annotations
+
+		irKey = irStringKey(gateway.Gateway.Namespace, gateway.Gateway.Name)
+
+		maps.Copy(labels, GatewayOwnerLabels(gateway.Namespace, gateway.Name))
+		gwInfraIR.Proxy.GetProxyMetadata().Labels = labels
+
+		gwInfraIR.Proxy.Name = irKey
+		// save the IR references in the map before the translation starts
+		xdsIR[irKey] = gwXdsIR
+		infraIR[irKey] = gwInfraIR
+	}
+
+	return xdsIR, infraIR
+}
+
+func infrastructureAnnotations(gtw *gwapiv1.Gateway) map[string]string {
+	if gtw.Spec.Infrastructure != nil && len(gtw.Spec.Infrastructure.Annotations) > 0 {
+		res := make(map[string]string)
+		for k, v := range gtw.Spec.Infrastructure.Annotations {
+			res[string(k)] = string(v)
+		}
+		return res
+	}
+	return nil
+}
+
+func infrastructureLabels(gtw *gwapiv1.Gateway) map[string]string {
+	res := make(map[string]string)
+	if gtw.Spec.Infrastructure != nil {
+		for k, v := range gtw.Spec.Infrastructure.Labels {
+			res[string(k)] = string(v)
+		}
+	}
+	return res
+}
+
+// XdsIR and InfraIR map keys by default are {GatewayNamespace}/{GatewayName}, but if mergeGateways is set, they are merged under {GatewayClassName} key.
+func (t *Translator) getIRKey(gateway *gwapiv1.Gateway) string {
+	irKey := irStringKey(gateway.Namespace, gateway.Name)
+	if t.MergeGateways {
+		return string(t.GatewayClassName)
+	}
+
+	return irKey
+}
diff --git a/adapter/internal/operator/gateway-api/translator/accesslog.go b/adapter/internal/operator/gateway-api/translator/accesslog.go
new file mode 100644
index 000000000..eb53fe8b3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/accesslog.go
@@ -0,0 +1,277 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"sort"
+
+	accesslog "github.com/envoyproxy/go-control-plane/envoy/config/accesslog/v3"
+	cfgcore "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	fileaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/file/v3"
+	grpcaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/grpc/v3"
+	otelaccesslog "github.com/envoyproxy/go-control-plane/envoy/extensions/access_loggers/open_telemetry/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	otlpcommonv1 "go.opentelemetry.io/proto/otlp/common/v1"
+	"golang.org/x/exp/maps"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/structpb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	// EnvoyTextLogFormat is the default log format for Envoy.
+	// See https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#default-format-string
+	EnvoyTextLogFormat = "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\"," +
+		"\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\"," +
+		"\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\"," +
+		"\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\"," +
+		"\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\"," +
+		"\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\"," +
+		"\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\"," +
+		"\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\"," +
+		"\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\"," +
+		"\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\"," +
+		"\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\"," +
+		"\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\"," +
+		"\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\"," +
+		"\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\"," +
+		"\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+
+	otelLogName   = "otel_envoy_accesslog"
+	otelAccessLog = "envoy.access_loggers.open_telemetry"
+)
+
+var (
+	// for the case when a route does not exist to upstream, hcm logs will not be present
+	listenerAccessLogFilter = &accesslog.AccessLogFilter{
+		FilterSpecifier: &accesslog.AccessLogFilter_ResponseFlagFilter{
+			ResponseFlagFilter: &accesslog.ResponseFlagFilter{Flags: []string{"NR"}},
+		},
+	}
+)
+
+func buildXdsAccessLog(al *ir.AccessLog, forListener bool) []*accesslog.AccessLog {
+	if al == nil {
+		return nil
+	}
+
+	totalLen := len(al.Text) + len(al.JSON) + len(al.OpenTelemetry)
+	accessLogs := make([]*accesslog.AccessLog, 0, totalLen)
+	// handle text file access logs
+	for _, text := range al.Text {
+		filelog := &fileaccesslog.FileAccessLog{
+			Path: text.Path,
+		}
+		format := EnvoyTextLogFormat
+		if text.Format != nil {
+			format = *text.Format
+		}
+
+		filelog.AccessLogFormat = &fileaccesslog.FileAccessLog_LogFormat{
+			LogFormat: &cfgcore.SubstitutionFormatString{
+				Format: &cfgcore.SubstitutionFormatString_TextFormatSource{
+					TextFormatSource: &cfgcore.DataSource{
+						Specifier: &cfgcore.DataSource_InlineString{
+							InlineString: format,
+						},
+					},
+				},
+			},
+		}
+
+		// TODO: find a better way to handle this
+		accesslogAny, _ := anypb.New(filelog)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: wellknown.FileAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+	// handle json file access logs
+	for _, json := range al.JSON {
+		jsonFormat := &structpb.Struct{
+			Fields: make(map[string]*structpb.Value, len(json.JSON)),
+		}
+
+		// sort keys to ensure consistent ordering
+		keys := maps.Keys(json.JSON)
+		sort.Strings(keys)
+
+		for _, key := range keys {
+			jsonFormat.Fields[key] = &structpb.Value{
+				Kind: &structpb.Value_StringValue{
+					StringValue: json.JSON[key],
+				},
+			}
+		}
+
+		filelog := &fileaccesslog.FileAccessLog{
+			Path: json.Path,
+			AccessLogFormat: &fileaccesslog.FileAccessLog_LogFormat{
+				LogFormat: &cfgcore.SubstitutionFormatString{
+					Format: &cfgcore.SubstitutionFormatString_JsonFormat{
+						JsonFormat: jsonFormat,
+					},
+				},
+			},
+		}
+
+		accesslogAny, _ := anypb.New(filelog)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: wellknown.FileAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+	// handle open telemetry access logs
+	for _, otel := range al.OpenTelemetry {
+		al := &otelaccesslog.OpenTelemetryAccessLogConfig{
+			CommonConfig: &grpcaccesslog.CommonGrpcAccessLogConfig{
+				LogName: otelLogName,
+				GrpcService: &cfgcore.GrpcService{
+					TargetSpecifier: &cfgcore.GrpcService_EnvoyGrpc_{
+						EnvoyGrpc: &cfgcore.GrpcService_EnvoyGrpc{
+							ClusterName: buildClusterName("accesslog", otel.Host, otel.Port),
+							Authority:   otel.Host,
+						},
+					},
+				},
+				TransportApiVersion: cfgcore.ApiVersion_V3,
+			},
+			ResourceAttributes: convertToKeyValueList(otel.Resources, false),
+		}
+
+		format := EnvoyTextLogFormat
+		if otel.Text != nil {
+			format = *otel.Text
+		}
+
+		if format != "" {
+			al.Body = &otlpcommonv1.AnyValue{
+				Value: &otlpcommonv1.AnyValue_StringValue{
+					StringValue: format,
+				},
+			}
+		}
+
+		al.Attributes = convertToKeyValueList(otel.Attributes, true)
+
+		accesslogAny, _ := anypb.New(al)
+		accessLogs = append(accessLogs, &accesslog.AccessLog{
+			Name: otelAccessLog,
+			ConfigType: &accesslog.AccessLog_TypedConfig{
+				TypedConfig: accesslogAny,
+			},
+		})
+	}
+
+	// add filter for listener access logs
+	if forListener {
+		for _, al := range accessLogs {
+			al.Filter = listenerAccessLogFilter
+		}
+	}
+
+	return accessLogs
+}
+
+// read more here: https://opentelemetry.io/docs/specs/otel/resource/semantic_conventions/k8s/
+const (
+	k8sNamespaceNameKey = "k8s.namespace.name"
+	k8sPodNameKey       = "k8s.pod.name"
+)
+
+func convertToKeyValueList(attributes map[string]string, additionalLabels bool) *otlpcommonv1.KeyValueList {
+	maxLen := len(attributes)
+	if additionalLabels {
+		maxLen += 2
+	}
+	keyValueList := &otlpcommonv1.KeyValueList{
+		Values: make([]*otlpcommonv1.KeyValue, 0, maxLen),
+	}
+
+	// always set the k8s namespace and pod name for better UX
+	// EG cannot know the client namespace and pod name,
+	// so we set these on attributes that read from the environment.
+	if additionalLabels {
+		// TODO: check the provider type and set the appropriate attributes
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   k8sNamespaceNameKey,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%"}},
+		})
+
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   k8sPodNameKey,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: "%ENVIRONMENT(ENVOY_POD_NAME)%"}},
+		})
+	}
+
+	if len(attributes) == 0 {
+		return keyValueList
+	}
+
+	// sort keys to ensure consistent ordering
+	keys := maps.Keys(attributes)
+	sort.Strings(keys)
+
+	for _, key := range keys {
+		keyValueList.Values = append(keyValueList.Values, &otlpcommonv1.KeyValue{
+			Key:   key,
+			Value: &otlpcommonv1.AnyValue{Value: &otlpcommonv1.AnyValue_StringValue{StringValue: attributes[key]}},
+		})
+	}
+
+	return keyValueList
+}
+
+func processClusterForAccessLog(tCtx *types.ResourceVersionTable, al *ir.AccessLog) error {
+	if al == nil {
+		return nil
+	}
+
+	for _, otel := range al.OpenTelemetry {
+		clusterName := buildClusterName("accesslog", otel.Host, otel.Port)
+
+		ds := &ir.DestinationSetting{
+			Weight:    ptr.To[uint32](1),
+			Protocol:  ir.GRPC,
+			Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(otel.Host, otel.Port)},
+		}
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         clusterName,
+			settings:     []*ir.DestinationSetting{ds},
+			tSocket:      nil,
+			endpointType: EndpointTypeDNS,
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			return err
+		}
+
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
new file mode 100644
index 000000000..5fd4932f9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	basicauthv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/basic_auth/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	basicAuthFilter = "envoy.filters.http.basic_auth"
+)
+
+func init() {
+	registerHTTPFilter(&basicAuth{})
+}
+
+type basicAuth struct {
+}
+
+var _ httpFilter = &basicAuth{}
+
+// patchHCM builds and appends the basic_auth Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an basic_auth filter for each route that contains an BasicAuth config.
+// The filter is disabled by default. It is enabled on the route level.
+func (*basicAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsBasicAuth(route) {
+			continue
+		}
+
+		filter, err := buildHCMBasicAuthFilter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMBasicAuthFilter returns a basic_auth HTTP filter from the provided IR HTTPRoute.
+func buildHCMBasicAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	basicAuthProto := basicAuthConfig(route)
+
+	if err := basicAuthProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	basicAuthAny, err := anypb.New(basicAuthProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     basicAuthFilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: basicAuthAny,
+		},
+	}, nil
+}
+
+func basicAuthFilterName(route *ir.HTTPRoute) string {
+	return perRouteFilterName(basicAuthFilter, route.Name)
+}
+
+func basicAuthConfig(route *ir.HTTPRoute) *basicauthv3.BasicAuth {
+	return &basicauthv3.BasicAuth{
+		Users: &corev3.DataSource{
+			Specifier: &corev3.DataSource_InlineBytes{
+				InlineBytes: route.BasicAuth.Users,
+			},
+		},
+	}
+}
+
+// routeContainsBasicAuth returns true if BasicAuth exists for the provided route.
+func routeContainsBasicAuth(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.BasicAuth != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*basicAuth) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
+
+// patchRoute patches the provided route with the basicAuth config if applicable.
+// Note: this method enables the corresponding basicAuth filter for the provided route.
+func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.BasicAuth == nil {
+		return nil
+	}
+	return enableFilterOnRoute(basicAuthFilter, route, irRoute)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/cluster.go b/adapter/internal/operator/gateway-api/translator/cluster.go
new file mode 100644
index 000000000..fe29398cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/cluster.go
@@ -0,0 +1,629 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"encoding/hex"
+	"fmt"
+	"sort"
+	"time"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	preservecasev3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
+	proxyprotocolv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/proxy_protocol/v3"
+	rawbufferv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/raw_buffer/v3"
+	httpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/upstreams/http/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/structpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	extensionOptionsKey = "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/cluster/v3/cluster.proto#envoy-v3-api-field-config-cluster-v3-cluster-per-connection-buffer-limit-bytes
+	tcpClusterPerConnectionBufferLimitBytes = 32768
+	tcpClusterPerConnectTimeout             = 10 * time.Second
+)
+
+type xdsClusterArgs struct {
+	name           string
+	settings       []*ir.DestinationSetting
+	tSocket        *corev3.TransportSocket
+	endpointType   EndpointType
+	loadBalancer   *ir.LoadBalancer
+	proxyProtocol  *ir.ProxyProtocol
+	circuitBreaker *ir.CircuitBreaker
+	healthCheck    *ir.HealthCheck
+	http1Settings  *ir.HTTP1Settings
+	timeout        *ir.Timeout
+	tcpkeepalive   *ir.TCPKeepalive
+}
+
+type EndpointType int
+
+const (
+	EndpointTypeDNS EndpointType = iota
+	EndpointTypeStatic
+)
+
+func buildEndpointType(settings []*ir.DestinationSetting) EndpointType {
+	// Get endpoint address type for xds cluster by returning the first DestinationSetting's AddressType,
+	// since there's no Mixed AddressType among all the DestinationSettings.
+	if settings == nil {
+		return EndpointTypeStatic
+	}
+
+	addrType := settings[0].AddressType
+
+	if addrType != nil && *addrType == ir.FQDN {
+		return EndpointTypeDNS
+	}
+
+	return EndpointTypeStatic
+}
+
+func buildXdsCluster(args *xdsClusterArgs) *clusterv3.Cluster {
+	cluster := &clusterv3.Cluster{
+		Name:            args.name,
+		DnsLookupFamily: clusterv3.Cluster_V4_ONLY,
+		CommonLbConfig: &clusterv3.Cluster_CommonLbConfig{
+			LocalityConfigSpecifier: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig_{
+				LocalityWeightedLbConfig: &clusterv3.Cluster_CommonLbConfig_LocalityWeightedLbConfig{}}},
+		OutlierDetection:              &clusterv3.OutlierDetection{},
+		PerConnectionBufferLimitBytes: wrapperspb.UInt32(tcpClusterPerConnectionBufferLimitBytes),
+	}
+
+	cluster.ConnectTimeout = buildConnectTimeout(args.timeout)
+
+	// Set Proxy Protocol
+	if args.proxyProtocol != nil {
+		cluster.TransportSocket = buildProxyProtocolSocket(args.proxyProtocol, args.tSocket)
+	} else if args.tSocket != nil {
+		cluster.TransportSocket = args.tSocket
+	}
+
+	for i, ds := range args.settings {
+		if ds.TLS != nil {
+			socket, err := buildXdsUpstreamTLSSocketWthCert(ds.TLS)
+			if err != nil {
+				// TODO: Log something here
+				return nil
+			}
+			if args.proxyProtocol != nil {
+				socket = buildProxyProtocolSocket(args.proxyProtocol, socket)
+			}
+			matchName := fmt.Sprintf("%s/tls/%d", args.name, i)
+			cluster.TransportSocketMatches = append(cluster.TransportSocketMatches, &clusterv3.Cluster_TransportSocketMatch{
+				Name: matchName,
+				Match: &structpb.Struct{
+					Fields: map[string]*structpb.Value{
+						"name": structpb.NewStringValue(matchName),
+					},
+				},
+				TransportSocket: socket,
+			})
+		}
+	}
+
+	if args.endpointType == EndpointTypeStatic {
+		cluster.ClusterDiscoveryType = &clusterv3.Cluster_Type{Type: clusterv3.Cluster_EDS}
+		cluster.EdsClusterConfig = &clusterv3.Cluster_EdsClusterConfig{
+			ServiceName: args.name,
+			EdsConfig: &corev3.ConfigSource{
+				ResourceApiVersion: resource.DefaultAPIVersion,
+				ConfigSourceSpecifier: &corev3.ConfigSource_Ads{
+					Ads: &corev3.AggregatedConfigSource{},
+				},
+			},
+		}
+	} else {
+		cluster.ClusterDiscoveryType = &clusterv3.Cluster_Type{Type: clusterv3.Cluster_STRICT_DNS}
+		cluster.DnsRefreshRate = durationpb.New(30 * time.Second)
+		cluster.RespectDnsTtl = true
+	}
+
+	// build common, HTTP/1 and HTTP/2  protocol options for cluster
+	epo := buildTypedExtensionProtocolOptions(args)
+	if epo != nil {
+		cluster.TypedExtensionProtocolOptions = epo
+	}
+
+	// Set Load Balancer policy
+	//nolint:gocritic
+	if args.loadBalancer == nil {
+		cluster.LbPolicy = clusterv3.Cluster_LEAST_REQUEST
+	} else if args.loadBalancer.LeastRequest != nil {
+		cluster.LbPolicy = clusterv3.Cluster_LEAST_REQUEST
+		if args.loadBalancer.LeastRequest.SlowStart != nil {
+			if args.loadBalancer.LeastRequest.SlowStart.Window != nil {
+				cluster.LbConfig = &clusterv3.Cluster_LeastRequestLbConfig_{
+					LeastRequestLbConfig: &clusterv3.Cluster_LeastRequestLbConfig{
+						SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
+							SlowStartWindow: durationpb.New(args.loadBalancer.LeastRequest.SlowStart.Window.Duration),
+						},
+					},
+				}
+			}
+		}
+	} else if args.loadBalancer.RoundRobin != nil {
+		cluster.LbPolicy = clusterv3.Cluster_ROUND_ROBIN
+		if args.loadBalancer.RoundRobin.SlowStart != nil {
+			if args.loadBalancer.RoundRobin.SlowStart.Window != nil {
+				cluster.LbConfig = &clusterv3.Cluster_RoundRobinLbConfig_{
+					RoundRobinLbConfig: &clusterv3.Cluster_RoundRobinLbConfig{
+						SlowStartConfig: &clusterv3.Cluster_SlowStartConfig{
+							SlowStartWindow: durationpb.New(args.loadBalancer.RoundRobin.SlowStart.Window.Duration),
+						},
+					},
+				}
+			}
+		}
+	} else if args.loadBalancer.Random != nil {
+		cluster.LbPolicy = clusterv3.Cluster_RANDOM
+	} else if args.loadBalancer.ConsistentHash != nil {
+		cluster.LbPolicy = clusterv3.Cluster_MAGLEV
+	}
+
+	if args.healthCheck != nil && args.healthCheck.Active != nil {
+		cluster.HealthChecks = buildXdsHealthCheck(args.healthCheck.Active)
+	}
+
+	if args.healthCheck != nil && args.healthCheck.Passive != nil {
+		cluster.OutlierDetection = buildXdsOutlierDetection(args.healthCheck.Passive)
+
+	}
+
+	cluster.CircuitBreakers = buildXdsClusterCircuitBreaker(args.circuitBreaker)
+
+	if args.tcpkeepalive != nil {
+		cluster.UpstreamConnectionOptions = buildXdsClusterUpstreamOptions(args.tcpkeepalive)
+	}
+	return cluster
+}
+
+func buildXdsHealthCheck(healthcheck *ir.ActiveHealthCheck) []*corev3.HealthCheck {
+	hc := &corev3.HealthCheck{
+		Timeout:  durationpb.New(healthcheck.Timeout.Duration),
+		Interval: durationpb.New(healthcheck.Interval.Duration),
+	}
+	if healthcheck.UnhealthyThreshold != nil {
+		hc.UnhealthyThreshold = wrapperspb.UInt32(*healthcheck.UnhealthyThreshold)
+	}
+	if healthcheck.HealthyThreshold != nil {
+		hc.HealthyThreshold = wrapperspb.UInt32(*healthcheck.HealthyThreshold)
+	}
+	if healthcheck.HTTP != nil {
+		httpChecker := &corev3.HealthCheck_HttpHealthCheck{
+			Host: healthcheck.HTTP.Host,
+			Path: healthcheck.HTTP.Path,
+		}
+		if healthcheck.HTTP.Method != nil {
+			httpChecker.Method = corev3.RequestMethod(corev3.RequestMethod_value[*healthcheck.HTTP.Method])
+		}
+		httpChecker.ExpectedStatuses = buildHTTPStatusRange(healthcheck.HTTP.ExpectedStatuses)
+		if receive := buildHealthCheckPayload(healthcheck.HTTP.ExpectedResponse); receive != nil {
+			httpChecker.Receive = append(httpChecker.Receive, receive)
+		}
+		hc.HealthChecker = &corev3.HealthCheck_HttpHealthCheck_{
+			HttpHealthCheck: httpChecker,
+		}
+	}
+	if healthcheck.TCP != nil {
+		tcpChecker := &corev3.HealthCheck_TcpHealthCheck{
+			Send: buildHealthCheckPayload(healthcheck.TCP.Send),
+		}
+		if receive := buildHealthCheckPayload(healthcheck.TCP.Receive); receive != nil {
+			tcpChecker.Receive = append(tcpChecker.Receive, receive)
+		}
+		hc.HealthChecker = &corev3.HealthCheck_TcpHealthCheck_{
+			TcpHealthCheck: tcpChecker,
+		}
+	}
+	return []*corev3.HealthCheck{hc}
+}
+
+func buildXdsOutlierDetection(outlierDetection *ir.OutlierDetection) *clusterv3.OutlierDetection {
+	od := &clusterv3.OutlierDetection{
+		BaseEjectionTime: durationpb.New(outlierDetection.BaseEjectionTime.Duration),
+		Interval:         durationpb.New(outlierDetection.Interval.Duration),
+	}
+	if outlierDetection.SplitExternalLocalOriginErrors != nil {
+		od.SplitExternalLocalOriginErrors = *outlierDetection.SplitExternalLocalOriginErrors
+	}
+
+	if outlierDetection.MaxEjectionPercent != nil && *outlierDetection.MaxEjectionPercent > 0 {
+		od.MaxEjectionPercent = wrapperspb.UInt32(uint32(*outlierDetection.MaxEjectionPercent))
+	}
+
+	if outlierDetection.ConsecutiveLocalOriginFailures != nil {
+		od.ConsecutiveLocalOriginFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveLocalOriginFailures)
+	}
+
+	if outlierDetection.Consecutive5xxErrors != nil {
+		od.Consecutive_5Xx = wrapperspb.UInt32(*outlierDetection.Consecutive5xxErrors)
+	}
+
+	if outlierDetection.ConsecutiveGatewayErrors != nil {
+		od.ConsecutiveGatewayFailure = wrapperspb.UInt32(*outlierDetection.ConsecutiveGatewayErrors)
+	}
+
+	return od
+}
+
+// buildHTTPStatusRange converts an array of http status to an array of the range of http status.
+func buildHTTPStatusRange(irStatuses []ir.HTTPStatus) []*xdstype.Int64Range {
+	if len(irStatuses) == 0 {
+		return nil
+	}
+	ranges := []*xdstype.Int64Range{}
+	sort.Slice(irStatuses, func(i int, j int) bool {
+		return irStatuses[i] < irStatuses[j]
+	})
+	var start, end int64
+	for i := 0; i < len(irStatuses); i++ {
+		switch {
+		case start == 0:
+			start = int64(irStatuses[i])
+			end = int64(irStatuses[i] + 1)
+		case int64(irStatuses[i]) == end:
+			end++
+		default:
+			ranges = append(ranges, &xdstype.Int64Range{Start: start, End: end})
+			start = int64(irStatuses[i])
+			end = int64(irStatuses[i] + 1)
+		}
+	}
+	if start != 0 {
+		ranges = append(ranges, &xdstype.Int64Range{Start: start, End: end})
+	}
+	return ranges
+}
+
+func buildHealthCheckPayload(irLoad *ir.HealthCheckPayload) *corev3.HealthCheck_Payload {
+	if irLoad == nil {
+		return nil
+	}
+
+	var hcp corev3.HealthCheck_Payload
+	if irLoad.Text != nil && *irLoad.Text != "" {
+		hcp.Payload = &corev3.HealthCheck_Payload_Text{
+			Text: hex.EncodeToString([]byte(*irLoad.Text)),
+		}
+	}
+	if len(irLoad.Binary) > 0 {
+		binPayload := &corev3.HealthCheck_Payload_Binary{
+			Binary: make([]byte, len(irLoad.Binary)),
+		}
+		copy(binPayload.Binary, irLoad.Binary)
+		hcp.Payload = binPayload
+	}
+	return &hcp
+}
+
+func buildXdsClusterCircuitBreaker(circuitBreaker *ir.CircuitBreaker) *clusterv3.CircuitBreakers {
+	// Always allow the same amount of retries as regular requests to handle surges in retries
+	// related to pod restarts
+	cbt := &clusterv3.CircuitBreakers_Thresholds{
+		Priority: corev3.RoutingPriority_DEFAULT,
+		MaxRetries: &wrapperspb.UInt32Value{
+			Value: uint32(1024),
+		},
+	}
+
+	if circuitBreaker != nil {
+		if circuitBreaker.MaxConnections != nil {
+			cbt.MaxConnections = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxConnections,
+			}
+		}
+
+		if circuitBreaker.MaxPendingRequests != nil {
+			cbt.MaxPendingRequests = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxPendingRequests,
+			}
+		}
+
+		if circuitBreaker.MaxParallelRequests != nil {
+			cbt.MaxRequests = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxParallelRequests,
+			}
+		}
+
+		if circuitBreaker.MaxParallelRetries != nil {
+			cbt.MaxRetries = &wrapperspb.UInt32Value{
+				Value: *circuitBreaker.MaxParallelRetries,
+			}
+		}
+	}
+
+	ecb := &clusterv3.CircuitBreakers{
+		Thresholds: []*clusterv3.CircuitBreakers_Thresholds{cbt},
+	}
+
+	return ecb
+}
+
+func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.DestinationSetting) *endpointv3.ClusterLoadAssignment {
+	localities := make([]*endpointv3.LocalityLbEndpoints, 0, len(destSettings))
+	for i, ds := range destSettings {
+
+		endpoints := make([]*endpointv3.LbEndpoint, 0, len(ds.Endpoints))
+
+		var metadata *corev3.Metadata
+		if ds.TLS != nil {
+			metadata = &corev3.Metadata{
+				FilterMetadata: map[string]*structpb.Struct{
+					"envoy.transport_socket_match": {
+						Fields: map[string]*structpb.Value{
+							"name": structpb.NewStringValue(fmt.Sprintf("%s/tls/%d", clusterName, i)),
+						},
+					},
+				},
+			}
+		}
+
+		for _, irEp := range ds.Endpoints {
+			lbEndpoint := &endpointv3.LbEndpoint{
+				Metadata: metadata,
+				HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+					Endpoint: &endpointv3.Endpoint{
+						Address: &corev3.Address{
+							Address: &corev3.Address_SocketAddress{
+								SocketAddress: &corev3.SocketAddress{
+									Protocol: corev3.SocketAddress_TCP,
+									Address:  irEp.Host,
+									PortSpecifier: &corev3.SocketAddress_PortValue{
+										PortValue: irEp.Port,
+									},
+								},
+							},
+						},
+					},
+				},
+			}
+			// Set default weight of 1 for all endpoints.
+			lbEndpoint.LoadBalancingWeight = &wrapperspb.UInt32Value{Value: 1}
+			endpoints = append(endpoints, lbEndpoint)
+		}
+
+		// Envoy requires a distinct region to be set for each LocalityLbEndpoints.
+		// If we don't do this, Envoy will merge all LocalityLbEndpoints into one.
+		// We use the name of the backendRef as a pseudo region name.
+		locality := &endpointv3.LocalityLbEndpoints{
+			Locality: &corev3.Locality{
+				Region: fmt.Sprintf("%s/backend/%d", clusterName, i),
+			},
+			LbEndpoints: endpoints,
+			Priority:    0,
+		}
+
+		// Set locality weight
+		var weight uint32
+		if ds.Weight != nil {
+			weight = *ds.Weight
+		} else {
+			weight = 1
+		}
+		locality.LoadBalancingWeight = &wrapperspb.UInt32Value{Value: weight}
+
+		localities = append(localities, locality)
+	}
+	return &endpointv3.ClusterLoadAssignment{ClusterName: clusterName, Endpoints: localities}
+}
+
+func buildTypedExtensionProtocolOptions(args *xdsClusterArgs) map[string]*anypb.Any {
+	requiresHTTP2Options := false
+	for _, ds := range args.settings {
+		if ds.Protocol == ir.GRPC ||
+			ds.Protocol == ir.HTTP2 {
+			requiresHTTP2Options = true
+			break
+		}
+	}
+
+	requiresCommonHTTPOptions := (args.timeout != nil && args.timeout.HTTP != nil &&
+		(args.timeout.HTTP.MaxConnectionDuration != nil || args.timeout.HTTP.ConnectionIdleTimeout != nil)) ||
+		(args.circuitBreaker != nil && args.circuitBreaker.MaxRequestsPerConnection != nil)
+
+	requiresHTTP1Options := args.http1Settings != nil && (args.http1Settings.EnableTrailers || args.http1Settings.PreserveHeaderCase || args.http1Settings.HTTP10 != nil)
+
+	if !(requiresCommonHTTPOptions || requiresHTTP1Options || requiresHTTP2Options) {
+		return nil
+	}
+
+	protocolOptions := httpv3.HttpProtocolOptions{}
+
+	if requiresCommonHTTPOptions {
+		protocolOptions.CommonHttpProtocolOptions = &corev3.HttpProtocolOptions{}
+
+		if args.timeout != nil && args.timeout.HTTP != nil {
+			if args.timeout.HTTP.ConnectionIdleTimeout != nil {
+				protocolOptions.CommonHttpProtocolOptions.IdleTimeout =
+					durationpb.New(args.timeout.HTTP.ConnectionIdleTimeout.Duration)
+			}
+
+			if args.timeout.HTTP.MaxConnectionDuration != nil {
+				protocolOptions.CommonHttpProtocolOptions.MaxConnectionDuration =
+					durationpb.New(args.timeout.HTTP.MaxConnectionDuration.Duration)
+			}
+		}
+
+		if args.circuitBreaker != nil && args.circuitBreaker.MaxRequestsPerConnection != nil {
+			protocolOptions.CommonHttpProtocolOptions.MaxRequestsPerConnection = &wrapperspb.UInt32Value{
+				Value: *args.circuitBreaker.MaxRequestsPerConnection,
+			}
+		}
+
+	}
+
+	// When setting any Typed Extension Protocol Options, UpstreamProtocolOptions are mandatory
+	// If translation requires HTTP2 enablement or HTTP1 trailers, set appropriate setting
+	// Default to http1 otherwise
+	// TODO: If the cluster is TLS enabled, use AutoHTTPConfig instead of ExplicitHttpConfig
+	// so that when ALPN is supported then enabling http1 options doesn't force HTTP/1.1
+	switch {
+	case requiresHTTP2Options:
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_Http2ProtocolOptions{},
+			},
+		}
+	case requiresHTTP1Options:
+		http1opts := &corev3.Http1ProtocolOptions{
+			EnableTrailers: args.http1Settings.EnableTrailers,
+		}
+		if args.http1Settings.PreserveHeaderCase {
+			preservecaseAny, _ := anypb.New(&preservecasev3.PreserveCaseFormatterConfig{})
+			http1opts.HeaderKeyFormat = &corev3.Http1ProtocolOptions_HeaderKeyFormat{
+				HeaderFormat: &corev3.Http1ProtocolOptions_HeaderKeyFormat_StatefulFormatter{
+					StatefulFormatter: &corev3.TypedExtensionConfig{
+						Name:        "preserve_case",
+						TypedConfig: preservecaseAny,
+					},
+				},
+			}
+		}
+		if args.http1Settings.HTTP10 != nil {
+			http1opts.AcceptHttp_10 = true
+			http1opts.DefaultHostForHttp_10 = ptr.Deref(args.http1Settings.HTTP10.DefaultHost, "")
+		}
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_HttpProtocolOptions{
+					HttpProtocolOptions: http1opts,
+				},
+			},
+		}
+	default:
+		protocolOptions.UpstreamProtocolOptions = &httpv3.HttpProtocolOptions_ExplicitHttpConfig_{
+			ExplicitHttpConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig{
+				ProtocolConfig: &httpv3.HttpProtocolOptions_ExplicitHttpConfig_HttpProtocolOptions{},
+			},
+		}
+	}
+
+	anyProtocolOptions, _ := anypb.New(&protocolOptions)
+
+	extensionOptions := map[string]*anypb.Any{
+		extensionOptionsKey: anyProtocolOptions,
+	}
+
+	return extensionOptions
+}
+
+// buildClusterName returns a cluster name for the given `host` and `port`.
+// The format is: <type>|<host>|<port>, where type is "accesslog" for access logs.
+// It's easy to distinguish when debugging.
+func buildClusterName(prefix string, host string, port uint32) string {
+	return fmt.Sprintf("%s|%s|%d", prefix, host, port)
+}
+
+// buildProxyProtocolSocket builds the ProxyProtocol transport socket.
+func buildProxyProtocolSocket(proxyProtocol *ir.ProxyProtocol, tSocket *corev3.TransportSocket) *corev3.TransportSocket {
+	if proxyProtocol == nil {
+		return nil
+	}
+
+	ppCtx := &proxyprotocolv3.ProxyProtocolUpstreamTransport{}
+
+	switch proxyProtocol.Version {
+	case ir.ProxyProtocolVersionV1:
+		ppCtx.Config = &corev3.ProxyProtocolConfig{
+			Version: corev3.ProxyProtocolConfig_V1,
+		}
+	case ir.ProxyProtocolVersionV2:
+		ppCtx.Config = &corev3.ProxyProtocolConfig{
+			Version: corev3.ProxyProtocolConfig_V2,
+		}
+	}
+
+	// If existing transport socket does not exist wrap around raw buffer
+	if tSocket == nil {
+		rawCtx := &rawbufferv3.RawBuffer{}
+		rawCtxAny, err := anypb.New(rawCtx)
+		if err != nil {
+			return nil
+		}
+		rawSocket := &corev3.TransportSocket{
+			Name: wellknown.TransportSocketRawBuffer,
+			ConfigType: &corev3.TransportSocket_TypedConfig{
+				TypedConfig: rawCtxAny,
+			},
+		}
+		ppCtx.TransportSocket = rawSocket
+	} else {
+		ppCtx.TransportSocket = tSocket
+	}
+
+	ppCtxAny, err := anypb.New(ppCtx)
+	if err != nil {
+		return nil
+	}
+
+	return &corev3.TransportSocket{
+		Name: "envoy.transport_sockets.upstream_proxy_protocol",
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: ppCtxAny,
+		},
+	}
+}
+
+func buildConnectTimeout(to *ir.Timeout) *durationpb.Duration {
+	if to != nil && to.TCP != nil && to.TCP.ConnectTimeout != nil {
+		return durationpb.New(to.TCP.ConnectTimeout.Duration)
+	}
+	return durationpb.New(tcpClusterPerConnectTimeout)
+}
+
+func buildXdsClusterUpstreamOptions(tcpkeepalive *ir.TCPKeepalive) *clusterv3.UpstreamConnectionOptions {
+	if tcpkeepalive == nil {
+		return nil
+	}
+
+	ka := &clusterv3.UpstreamConnectionOptions{
+		TcpKeepalive: &corev3.TcpKeepalive{},
+	}
+
+	if tcpkeepalive.Probes != nil {
+		ka.TcpKeepalive.KeepaliveProbes = wrapperspb.UInt32(*tcpkeepalive.Probes)
+	}
+
+	if tcpkeepalive.Probes != nil {
+		ka.TcpKeepalive.KeepaliveTime = wrapperspb.UInt32(*tcpkeepalive.IdleTime)
+	}
+
+	if tcpkeepalive.Interval != nil {
+		ka.TcpKeepalive.KeepaliveInterval = wrapperspb.UInt32(*tcpkeepalive.Interval)
+	}
+
+	return ka
+
+}
diff --git a/adapter/internal/operator/gateway-api/translator/cors.go b/adapter/internal/operator/gateway-api/translator/cors.go
new file mode 100644
index 000000000..ba2724016
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/cors.go
@@ -0,0 +1,186 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	corsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/cors/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func init() {
+	registerHTTPFilter(&cors{})
+}
+
+type cors struct {
+}
+
+var _ httpFilter = &cors{}
+
+// patchHCM builds and appends the CORS Filter to the HTTP Connection Manager if
+// applicable.
+func (*cors) patchHCM(
+	mgr *hcmv3.HttpConnectionManager,
+	irListener *ir.HTTPListener) error {
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	if !listenerContainsCORS(irListener) {
+		return nil
+	}
+
+	// Return early if filter already exists.
+	for _, httpFilter := range mgr.HttpFilters {
+		if httpFilter.Name == wellknown.CORS {
+			return nil
+		}
+	}
+
+	corsFilter, err := buildHCMCORSFilter()
+	if err != nil {
+		return err
+	}
+
+	// Ensure the CORS filter is the first one in the filter chain.
+	mgr.HttpFilters = append([]*hcmv3.HttpFilter{corsFilter}, mgr.HttpFilters...)
+
+	return nil
+}
+
+// buildHCMCORSFilter returns a CORS filter from the provided IR listener.
+func buildHCMCORSFilter() (*hcmv3.HttpFilter, error) {
+	corsProto := &corsv3.Cors{}
+
+	corsAny, err := anypb.New(corsProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name: wellknown.CORS,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: corsAny,
+		},
+	}, nil
+}
+
+// listenerContainsCORS returns true if the provided listener has CORS
+// policies attached to its routes.
+func listenerContainsCORS(irListener *ir.HTTPListener) bool {
+	if irListener == nil {
+		return false
+	}
+
+	for _, route := range irListener.Routes {
+		if route.CORS != nil {
+			return true
+		}
+	}
+
+	return false
+}
+
+// patchRoute patches the provided route with the CORS config if applicable.
+func (*cors) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.CORS == nil {
+		return nil
+	}
+
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[wellknown.CORS]; ok {
+		// This should not happen since this is the only place where the CORS
+		// filter is added in a route.
+		return fmt.Errorf("route already contains cors config: %+v", route)
+	}
+
+	var (
+		allowOrigins     []*matcherv3.StringMatcher
+		allowMethods     string
+		allowHeaders     string
+		exposeHeaders    string
+		maxAge           string
+		allowCredentials *wrappers.BoolValue
+	)
+
+	//nolint:gocritic
+
+	for _, origin := range irRoute.CORS.AllowOrigins {
+		allowOrigins = append(allowOrigins, buildXdsStringMatcher(origin))
+	}
+
+	allowMethods = strings.Join(irRoute.CORS.AllowMethods, ", ")
+	allowHeaders = strings.Join(irRoute.CORS.AllowHeaders, ", ")
+	exposeHeaders = strings.Join(irRoute.CORS.ExposeHeaders, ", ")
+	if irRoute.CORS.MaxAge != nil {
+		maxAge = strconv.Itoa(int(irRoute.CORS.MaxAge.Seconds()))
+	}
+	allowCredentials = &wrappers.BoolValue{Value: irRoute.CORS.AllowCredentials}
+
+	routeCfgProto := &corsv3.CorsPolicy{
+		AllowOriginStringMatch: allowOrigins,
+		AllowMethods:           allowMethods,
+		AllowHeaders:           allowHeaders,
+		ExposeHeaders:          exposeHeaders,
+		MaxAge:                 maxAge,
+		AllowCredentials:       allowCredentials,
+	}
+
+	routeCfgAny, err := anypb.New(routeCfgProto)
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[wellknown.CORS] = routeCfgAny
+
+	return nil
+}
+
+func (c *cors) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
new file mode 100644
index 000000000..c50c584cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -0,0 +1,300 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"net/url"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	extauthv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/golang/protobuf/ptypes/duration"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	extAuthFilter = "envoy.filters.http.ext_authz"
+)
+
+func init() {
+	registerHTTPFilter(&extAuth{})
+}
+
+type extAuth struct {
+}
+
+var _ httpFilter = &extAuth{}
+
+// patchHCM builds and appends the ext_authz Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an ext_authz filter for each route that contains an ExtAuthz config.
+// The filter is disabled by default. It is enabled on the route level.
+// TODO: zhaohuabing avoid duplicated HTTP filters
+func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsExtAuth(route) {
+			continue
+		}
+
+		filter, err := buildHCMExtAuthFilter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMExtAuthFilter returns an ext_authz HTTP filter from the provided IR HTTPRoute.
+func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	extAuthProto := extAuthConfig(route.ExtAuth)
+	if err := extAuthProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	extAuthAny, err := anypb.New(extAuthProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     extAuthFilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: extAuthAny,
+		},
+	}, nil
+}
+
+func extAuthFilterName(route *ir.HTTPRoute) string {
+	return perRouteFilterName(extAuthFilter, route.Name)
+}
+
+func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
+	config := &extauthv3.ExtAuthz{
+		TransportApiVersion: corev3.ApiVersion_V3,
+		FailureModeAllow:    false,
+	}
+
+	var headersToExtAuth []*matcherv3.StringMatcher
+	for _, header := range extAuth.HeadersToExtAuth {
+		headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: header,
+			},
+		})
+	}
+
+	if len(headersToExtAuth) > 0 {
+		config.AllowedHeaders = &matcherv3.ListStringMatcher{
+			Patterns: headersToExtAuth,
+		}
+	}
+
+	if extAuth.HTTP != nil {
+		config.Services = &extauthv3.ExtAuthz_HttpService{
+			HttpService: httpService(extAuth.HTTP),
+		}
+	} else if extAuth.GRPC != nil {
+		config.Services = &extauthv3.ExtAuthz_GrpcService{
+			GrpcService: &corev3.GrpcService{
+				TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
+					EnvoyGrpc: grpcService(extAuth.GRPC),
+				},
+				Timeout: &duration.Duration{
+					Seconds: defaultExtServiceRequestTimeout,
+				},
+			},
+		}
+	}
+
+	return config
+}
+
+func httpService(http *ir.HTTPExtAuthService) *extauthv3.HttpService {
+	var (
+		uri              string
+		headersToBackend []*matcherv3.StringMatcher
+		service          *extauthv3.HttpService
+	)
+
+	service = &extauthv3.HttpService{
+		PathPrefix: http.Path,
+	}
+
+	u := url.URL{
+		// scheme should be decided by the TLS setting, but we don't have that info now.
+		// It's safe to set it to http because the ext auth filter doesn't use the
+		// uri to make the request. It only uses the cluster.
+		Scheme: "http",
+		Host:   http.Authority,
+		Path:   http.Path,
+	}
+	uri = u.String()
+
+	service.ServerUri = &corev3.HttpUri{
+		Uri: uri,
+		HttpUpstreamType: &corev3.HttpUri_Cluster{
+			Cluster: http.Destination.Name,
+		},
+		Timeout: &duration.Duration{
+			Seconds: defaultExtServiceRequestTimeout,
+		},
+	}
+
+	for _, header := range http.HeadersToBackend {
+		headersToBackend = append(headersToBackend, &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: header,
+			},
+		})
+	}
+
+	if len(headersToBackend) > 0 {
+		service.AuthorizationResponse = &extauthv3.AuthorizationResponse{
+			AllowedUpstreamHeaders: &matcherv3.ListStringMatcher{
+				Patterns: headersToBackend,
+			},
+		}
+	}
+
+	return service
+}
+
+func grpcService(grpc *ir.GRPCExtAuthService) *corev3.GrpcService_EnvoyGrpc {
+	return &corev3.GrpcService_EnvoyGrpc{
+		ClusterName: grpc.Destination.Name,
+		Authority:   grpc.Authority,
+	}
+}
+
+// routeContainsExtAuth returns true if ExtAuth exists for the provided route.
+func routeContainsExtAuth(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.ExtAuth != nil {
+		return true
+	}
+
+	return false
+}
+
+// patchResources patches the cluster resources for the external auth services.
+func (*extAuth) patchResources(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if tCtx == nil || tCtx.XdsResources == nil {
+		return errors.New("xds resource table is nil")
+	}
+
+	var errs error
+	for _, route := range routes {
+		if !routeContainsExtAuth(route) {
+			continue
+		}
+		if route.ExtAuth.HTTP != nil {
+			if err := createExtServiceXDSCluster(
+				&route.ExtAuth.HTTP.Destination, tCtx); err != nil && !errors.Is(
+				err, ErrXdsClusterExists) {
+				errs = errors.Join(errs, err)
+			}
+		} else {
+			if err := createExtServiceXDSCluster(
+				&route.ExtAuth.GRPC.Destination, tCtx); err != nil && !errors.Is(
+				err, ErrXdsClusterExists) {
+				errs = errors.Join(errs, err)
+			}
+		}
+	}
+
+	return errs
+}
+
+func createExtServiceXDSCluster(rd *ir.RouteDestination, tCtx *types.ResourceVersionTable) error {
+	var (
+		endpointType EndpointType
+		tSocket      *corev3.TransportSocket
+		err          error
+	)
+
+	// Get the address type from the first setting.
+	// This is safe because no mixed address types in the settings.
+	addrTypeState := rd.Settings[0].AddressType
+	if addrTypeState != nil && *addrTypeState == ir.FQDN {
+		endpointType = EndpointTypeDNS
+	} else {
+		endpointType = EndpointTypeStatic
+	}
+
+	if rd.Settings[0].TLS != nil {
+		tSocket, err = processTLSSocket(rd.Settings[0].TLS, tCtx)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err = addXdsCluster(tCtx, &xdsClusterArgs{
+		name:         rd.Name,
+		settings:     rd.Settings,
+		tSocket:      tSocket,
+		endpointType: endpointType,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+	return nil
+}
+
+// patchRoute patches the provided route with the extAuth config if applicable.
+// Note: this method enables the corresponding extAuth filter for the provided route.
+func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.ExtAuth == nil {
+		return nil
+	}
+	return enableFilterOnRoute(extAuthFilter, route, irRoute)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/fault.go b/adapter/internal/operator/gateway-api/translator/fault.go
new file mode 100644
index 000000000..3e8858033
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/fault.go
@@ -0,0 +1,218 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	xdsfault "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/common/fault/v3"
+	xdshttpfaultv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/fault/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+)
+
+const (
+	faultFilter = "envoy.filters.http.fault"
+)
+
+func init() {
+	registerHTTPFilter(&fault{})
+}
+
+type fault struct {
+}
+
+var _ httpFilter = &fault{}
+
+// patchHCM builds and appends the fault Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an fault filter for each route that contains an Fault config.
+func (*fault) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	if !listenerContainsFault(irListener) {
+		return nil
+	}
+
+	// Return early if the fault filter already exists.
+	for _, existingFilter := range mgr.HttpFilters {
+		if existingFilter.Name == faultFilter {
+			return nil
+		}
+	}
+
+	faultFilter, err := buildHCMFaultFilter(irListener)
+	if err != nil {
+		return err
+	}
+	mgr.HttpFilters = append(mgr.HttpFilters, faultFilter)
+
+	return nil
+}
+
+// buildHCMFaultFilter returns a basic_auth HTTP filter from the provided IR HTTPRoute.
+func buildHCMFaultFilter(irListener *ir.HTTPListener) (*hcmv3.HttpFilter, error) {
+	faultProto := faultConfig(irListener)
+
+	if err := faultProto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	faultAny, err := anypb.New(faultProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name: faultFilter,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: faultAny,
+		},
+	}, nil
+}
+
+func faultConfig(irListener *ir.HTTPListener) *xdshttpfaultv3.HTTPFault {
+	return &xdshttpfaultv3.HTTPFault{}
+}
+
+// listenerContainsFault returns true if Fault exists for the provided listener.
+func listenerContainsFault(irListener *ir.HTTPListener) bool {
+	for _, route := range irListener.Routes {
+		if routeContainsFault(route) {
+			return true
+		}
+	}
+	return false
+}
+
+// routeContainsFault returns true if Fault exists for the provided route.
+func routeContainsFault(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.FaultInjection != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*fault) patchResources(*types.ResourceVersionTable, []*ir.HTTPRoute) error {
+	return nil
+}
+
+// patchRoute patches the provided route with the fault config if applicable.
+// Note: this method enables the corresponding fault filter for the provided route.
+func (*fault) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.FaultInjection == nil {
+		return nil
+	}
+
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[wellknown.Fault]; ok {
+		// This should not happen since this is the only place where the fault
+		// filter is added in a route.
+		return fmt.Errorf("route already contains fault config: %+v", route)
+	}
+
+	routeCfgProto := &xdshttpfaultv3.HTTPFault{}
+
+	if irRoute.FaultInjection.Delay != nil {
+		routeCfgProto.Delay = &xdsfault.FaultDelay{}
+		if irRoute.FaultInjection.Delay.Percentage != nil {
+			routeCfgProto.Delay.Percentage = translatePercentToFractionalPercent(irRoute.FaultInjection.Delay.Percentage)
+		}
+		if irRoute.FaultInjection.Delay.FixedDelay != nil {
+			routeCfgProto.Delay.FaultDelaySecifier = &xdsfault.FaultDelay_FixedDelay{
+				FixedDelay: durationpb.New(irRoute.FaultInjection.Delay.FixedDelay.Duration),
+			}
+		}
+	}
+
+	if irRoute.FaultInjection.Abort != nil {
+		routeCfgProto.Abort = &xdshttpfaultv3.FaultAbort{}
+		if irRoute.FaultInjection.Abort.Percentage != nil {
+			routeCfgProto.Abort.Percentage = translatePercentToFractionalPercent(irRoute.FaultInjection.Abort.Percentage)
+		}
+		if irRoute.FaultInjection.Abort.HTTPStatus != nil {
+			routeCfgProto.Abort.ErrorType = &xdshttpfaultv3.FaultAbort_HttpStatus{
+				HttpStatus: uint32(*irRoute.FaultInjection.Abort.HTTPStatus),
+			}
+		}
+		if irRoute.FaultInjection.Abort.GrpcStatus != nil {
+			routeCfgProto.Abort.ErrorType = &xdshttpfaultv3.FaultAbort_GrpcStatus{
+				GrpcStatus: uint32(*irRoute.FaultInjection.Abort.GrpcStatus),
+			}
+		}
+
+	}
+
+	if routeCfgProto.Delay == nil && routeCfgProto.Abort == nil {
+		return nil
+	}
+
+	routeCfgAny, err := anypb.New(routeCfgProto)
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[wellknown.Fault] = routeCfgAny
+
+	return nil
+
+}
+
+// translatePercentToFractionalPercent translates an v1alpha3 Percent instance
+// to an envoy.type.FractionalPercent instance.
+func translatePercentToFractionalPercent(p *float32) *xdstype.FractionalPercent {
+	return &xdstype.FractionalPercent{
+		Numerator:   uint32(*p * 10000),
+		Denominator: xdstype.FractionalPercent_MILLION,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator/httpfilters.go b/adapter/internal/operator/gateway-api/translator/httpfilters.go
new file mode 100644
index 000000000..5086dc891
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/httpfilters.go
@@ -0,0 +1,243 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"sort"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/filters"
+	"github.com/wso2/apk/adapter/internal/types"
+	"k8s.io/utils/ptr"
+)
+
+var httpFilters []httpFilter
+
+// registerHTTPFilter registers the provided HTTP filter.
+func registerHTTPFilter(filter httpFilter) {
+	httpFilters = append(httpFilters, filter)
+}
+
+// httpFilter is the interface for all the HTTP filters.
+//
+// There are two ways to support per-route configuration for an HTTP filter:
+// - For the filters with native per-route configuration support:
+//   - patchHCM: EG adds the filter to the HCM filter chain only once.
+//   - patchRoute: EG adds the filter's native per-route configuration to each
+//     route's typedFilterConfig.
+//
+// - For the filters without native per-route configuration support:
+//   - patchHCM: EG adds a filter for each route in the HCM filter chain, the
+//     filter name is prefixed with the filter's type name, for example,
+//     "envoy.filters.http.oauth2", and suffixed with the route name. Each filter
+//     is configured with the route's per-route configuration. The filter is
+//     disabled by default and is enabled on the route level.
+//   - PatchRouteWithPerRouteConfig: EG enables the corresponding filter for each
+//     route in the typedFilterConfig of that route.
+//
+// The filter types that haven't native per-route support: oauth2, basic authn, ext_authz.
+// Note: The filter types that have native per-route configuration support should
+// always se their own native per-route configuration.
+type httpFilter interface {
+	// patchHCM patches the HttpConnectionManager with the filter.
+	// Note: this method may be called multiple times for the same filter, please
+	// make sure to avoid duplicate additions of the same filter.
+	patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error
+
+	// patchRoute patches the provide Route with a filter's Route level configuration.
+	patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
+
+	// patchResources adds all the other needed resources referenced by this
+	// filter to the resource version table.
+	// for example:
+	// - a jwt filter needs to add the cluster for the jwks.
+	// - an oidc filter needs to add the cluster for token endpoint and the secret
+	//   for the oauth2 client secret and the hmac secret.
+	patchResources(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error
+}
+
+type OrderedHTTPFilter struct {
+	filter *hcmv3.HttpFilter
+	order  int
+}
+
+type OrderedHTTPFilters []*OrderedHTTPFilter
+
+// newOrderedHTTPFilter gives each HTTP filter a rational order.
+// This is needed because the order of the filters is important.
+// For example, the cors filter should be put at the first to avoid unnecessary
+// processing of other filters for unauthorized cross-region access.
+// The router filter must be the last one since it's a terminal filter.
+//
+// Important: please modify this method and set the order for the new filter
+// when adding a new filter in the HCM filter chain.
+// If the order is not explicitly specified in this method, a filter will be set
+// a default order 50.
+func newOrderedHTTPFilter(filter *hcmv3.HttpFilter) *OrderedHTTPFilter {
+	order := 50
+
+	// Set a rational order for all the filters.
+	switch {
+	case filter.Name == wellknown.CORS:
+		order = 1
+	case isFilterType(filter, extAuthFilter):
+		order = 2
+	case isFilterType(filter, basicAuthFilter):
+		order = 3
+	case isFilterType(filter, oauth2Filter):
+		order = 4
+	case filter.Name == wellknown.Fault:
+		order = 6
+	// case filter.Name == localRateLimitFilter:
+	// 	order = 7
+	case filter.Name == wellknown.HTTPRateLimit:
+		order = 8
+	case filter.Name == wellknown.Router:
+		order = 100
+	}
+
+	return &OrderedHTTPFilter{
+		filter: filter,
+		order:  order,
+	}
+}
+
+// sort.Interface implementation.
+
+func (o OrderedHTTPFilters) Len() int {
+	return len(o)
+}
+
+func (o OrderedHTTPFilters) Less(i, j int) bool {
+	return o[i].order < o[j].order
+}
+
+func (o OrderedHTTPFilters) Swap(i, j int) {
+	o[i], o[j] = o[j], o[i]
+}
+
+// sortHTTPFilters sorts the HTTP filters in the correct order.
+// This is needed because the order of the filters is important.
+// For example, the cors filter should be put at the first to avoid unnecessary
+// processing of other filters for unauthorized cross-region access.
+// The router filter must be the last one since it's a terminal filter.
+func sortHTTPFilters(filters []*hcmv3.HttpFilter) []*hcmv3.HttpFilter {
+	orderedFilters := make(OrderedHTTPFilters, len(filters))
+	for i := 0; i < len(filters); i++ {
+		orderedFilters[i] = newOrderedHTTPFilter(filters[i])
+	}
+	sort.Sort(orderedFilters)
+
+	for i := 0; i < len(filters); i++ {
+		filters[i] = orderedFilters[i].filter
+	}
+	return filters
+}
+
+// patchHCMWithFilters builds and appends HTTP Filters to the HTTP connection
+// manager.
+// Important: don't forget to set the order for newly added filters in the
+// newOrderedHTTPFilter method.
+func (t *Translator) patchHCMWithFilters(
+	mgr *hcmv3.HttpConnectionManager,
+	irListener *ir.HTTPListener) error {
+	// The order of filter patching is not relevant here.
+	// All the filters will be sorted in correct order after the patching is done.
+	//
+	// Important: don't forget to set the order for new filters in the
+	// newOrderedHTTPFilter method.
+	for _, filter := range httpFilters {
+		if err := filter.patchHCM(mgr, irListener); err != nil {
+			return err
+		}
+	}
+
+	// // RateLimit filter is handled separately because it relies on the global
+	// // rate limit server configuration.
+	// t.patchHCMWithRateLimit(mgr, irListener)
+
+	// Add the router filter if it doesn't exist.
+	hasRouter := false
+	for _, filter := range mgr.HttpFilters {
+		if filter.Name == wellknown.Router {
+			hasRouter = true
+			break
+		}
+	}
+	if !hasRouter {
+		headerSettings := ptr.Deref(irListener.Headers, ir.HeaderSettings{})
+		mgr.HttpFilters = append(mgr.HttpFilters, filters.GenerateRouterFilter(headerSettings.EnableEnvoyHeaders))
+	}
+
+	// Sort the filters in the correct order.
+	mgr.HttpFilters = sortHTTPFilters(mgr.HttpFilters)
+	return nil
+}
+
+// patchRouteWithPerRouteConfig appends per-route filter configuration to the
+// provided route.
+func patchRouteWithPerRouteConfig(
+	route *routev3.Route,
+	irRoute *ir.HTTPRoute) error {
+
+	for _, filter := range httpFilters {
+		if err := filter.patchRoute(route, irRoute); err != nil {
+			return err
+		}
+	}
+
+	// RateLimit filter is handled separately because it relies on the global
+	// rate limit server configuration.
+	// if err :=
+	// 	patchRouteWithRateLimit(route.GetRoute(), irRoute); err != nil {
+	// 	return nil
+	// }
+
+	return nil
+}
+
+// isFilterType returns true if the filter is the provided filter type.
+func isFilterType(filter *hcmv3.HttpFilter, filterType string) bool {
+	// Multiple filters of the same types are added to the HCM filter chain, one for each
+	// route. The filter name is prefixed with the filter type, for example:
+	// "envoy.filters.http.oauth2_first-route".
+	return strings.HasPrefix(filter.Name, filterType)
+}
+
+// patchResources adds all the other needed resources referenced by this
+// filter to the resource version table.
+// for example:
+// - a jwt filter needs to add the cluster for the jwks.
+// - an oidc filter needs to add the secret for the oauth2 client secret.
+func patchResources(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error {
+	for _, filter := range httpFilters {
+		if err := filter.patchResources(tCtx, routes); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/listener.go b/adapter/internal/operator/gateway-api/translator/listener.go
new file mode 100644
index 000000000..49bd76dcc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/listener.go
@@ -0,0 +1,691 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+
+	xdscore "github.com/cncf/xds/go/xds/core/v3"
+	matcher "github.com/cncf/xds/go/xds/type/matcher/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	tls_inspectorv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/tls_inspector/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tcpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/tcp_proxy/v3"
+	udpv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/udp/udp_proxy/v3"
+	preservecasev3 "github.com/envoyproxy/go-control-plane/envoy/extensions/http/header_formatters/preserve_case/v3"
+	quicv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/quic/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/wrappers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	xdsfilters "github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/filters"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/listener/v3/listener.proto#envoy-v3-api-field-config-listener-v3-listener-per-connection-buffer-limit-bytes
+	tcpListenerPerConnectionBufferLimitBytes = 32768
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-max-concurrent-streams
+	http2MaxConcurrentStreamsLimit = 100
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-initial-stream-window-size
+	http2InitialStreamWindowSize = 65536 // 64 KiB
+	// https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/protocol.proto#envoy-v3-api-field-config-core-v3-http2protocoloptions-initial-connection-window-size
+	http2InitialConnectionWindowSize = 1048576 // 1 MiB
+)
+
+func http1ProtocolOptions(opts *ir.HTTP1Settings) *corev3.Http1ProtocolOptions {
+	if opts == nil {
+		return nil
+	}
+	if !opts.EnableTrailers && !opts.PreserveHeaderCase && opts.HTTP10 == nil {
+		return nil
+	}
+	// If PreserveHeaderCase is true and EnableTrailers is false then setting the EnableTrailers field to false
+	// is simply keeping it at its default value of "disabled".
+	r := &corev3.Http1ProtocolOptions{
+		EnableTrailers: opts.EnableTrailers,
+	}
+	if opts.PreserveHeaderCase {
+		preservecaseAny, _ := anypb.New(&preservecasev3.PreserveCaseFormatterConfig{})
+		r.HeaderKeyFormat = &corev3.Http1ProtocolOptions_HeaderKeyFormat{
+			HeaderFormat: &corev3.Http1ProtocolOptions_HeaderKeyFormat_StatefulFormatter{
+				StatefulFormatter: &corev3.TypedExtensionConfig{
+					Name:        "preserve_case",
+					TypedConfig: preservecaseAny,
+				},
+			},
+		}
+	}
+	if opts.HTTP10 != nil {
+		r.AcceptHttp_10 = true
+		r.DefaultHostForHttp_10 = ptr.Deref(opts.HTTP10.DefaultHost, "")
+	}
+	return r
+}
+
+func http2ProtocolOptions() *corev3.Http2ProtocolOptions {
+	return &corev3.Http2ProtocolOptions{
+		MaxConcurrentStreams: &wrappers.UInt32Value{
+			Value: http2MaxConcurrentStreamsLimit,
+		},
+		InitialStreamWindowSize: &wrappers.UInt32Value{
+			Value: http2InitialStreamWindowSize,
+		},
+		InitialConnectionWindowSize: &wrappers.UInt32Value{
+			Value: http2InitialConnectionWindowSize,
+		},
+	}
+}
+
+// func xffNumTrustedHops(clientIPDetection *ir.ClientIPDetectionSettings) uint32 {
+// 	if clientIPDetection != nil && clientIPDetection.XForwardedFor != nil && clientIPDetection.XForwardedFor.NumTrustedHops != nil {
+// 		return *clientIPDetection.XForwardedFor.NumTrustedHops
+// 	}
+// 	return 0
+// }
+
+// func originalIPDetectionExtensions(clientIPDetection *ir.ClientIPDetectionSettings) []*corev3.TypedExtensionConfig {
+// 	// Return early if settings are nil
+// 	if clientIPDetection == nil {
+// 		return nil
+// 	}
+
+// 	var extensionConfig []*corev3.TypedExtensionConfig
+
+// 	// Custom header extension
+// 	if clientIPDetection.CustomHeader != nil {
+// 		var rejectWithStatus *typev3.HttpStatus
+// 		if ptr.Deref(clientIPDetection.CustomHeader.FailClosed, false) {
+// 			rejectWithStatus = &typev3.HttpStatus{Code: typev3.StatusCode_Forbidden}
+// 		}
+
+// 		customHeaderConfigAny, _ := anypb.New(&customheaderv3.CustomHeaderConfig{
+// 			HeaderName:       clientIPDetection.CustomHeader.Name,
+// 			RejectWithStatus: rejectWithStatus,
+
+// 			AllowExtensionToSetAddressAsTrusted: true,
+// 		})
+
+// 		extensionConfig = append(extensionConfig, &corev3.TypedExtensionConfig{
+// 			Name:        "envoy.extensions.http.original_ip_detection.custom_header",
+// 			TypedConfig: customHeaderConfigAny,
+// 		})
+// 	}
+
+// 	return extensionConfig
+// }
+
+// buildXdsTCPListener creates a xds Listener resource
+// TODO: Improve function parameters
+func buildXdsTCPListener(name, address string, port uint32, keepalive *ir.TCPKeepalive, accesslog *ir.AccessLog) *listenerv3.Listener {
+	socketOptions := buildTCPSocketOptions(keepalive)
+	al := buildXdsAccessLog(accesslog, true)
+	return &listenerv3.Listener{
+		Name:                          name,
+		AccessLog:                     al,
+		SocketOptions:                 socketOptions,
+		PerConnectionBufferLimitBytes: wrapperspb.UInt32(tcpListenerPerConnectionBufferLimitBytes),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_TCP,
+					Address:  address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: port,
+					},
+				},
+			},
+		},
+		// Remove /healthcheck/fail from endpoints that trigger a drain of listeners for better control
+		// over the drain process while still allowing the healthcheck to be failed during pod shutdown.
+		DrainType: listenerv3.Listener_MODIFY_ONLY,
+	}
+}
+
+// buildXdsQuicListener creates a xds Listener resource for quic
+func buildXdsQuicListener(name, address string, port uint32, accesslog *ir.AccessLog) *listenerv3.Listener {
+	xdsListener := &listenerv3.Listener{
+		Name:      name + "-quic",
+		AccessLog: buildXdsAccessLog(accesslog, true),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_UDP,
+					Address:  address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: port,
+					},
+				},
+			},
+		},
+		UdpListenerConfig: &listenerv3.UdpListenerConfig{
+			DownstreamSocketConfig: &corev3.UdpSocketConfig{},
+			QuicOptions:            &listenerv3.QuicProtocolOptions{},
+		},
+		// Remove /healthcheck/fail from endpoints that trigger a drain of listeners for better control
+		// over the drain process while still allowing the healthcheck to be failed during pod shutdown.
+		DrainType: listenerv3.Listener_MODIFY_ONLY,
+	}
+
+	return xdsListener
+}
+
+func (t *Translator) addXdsHTTPFilterChain(xdsListener *listenerv3.Listener, irListener *ir.HTTPListener,
+	accesslog *ir.AccessLog, tracing *ir.Tracing, http3Listener bool) error {
+	al := buildXdsAccessLog(accesslog, false)
+
+	hcmTracing, err := buildHCMTracing(tracing)
+	if err != nil {
+		return err
+	}
+
+	// HTTP filter configuration
+	var statPrefix string
+	if irListener.TLS != nil {
+		statPrefix = "https"
+	} else {
+		statPrefix = "http"
+	}
+
+	// Client IP detection
+	var useRemoteAddress = true
+	// var originalIPDetectionExtensions = originalIPDetectionExtensions(irListener.ClientIPDetection)
+	// if originalIPDetectionExtensions != nil {
+	// 	useRemoteAddress = false
+	// }
+
+	mgr := &hcmv3.HttpConnectionManager{
+		AccessLog:  al,
+		CodecType:  hcmv3.HttpConnectionManager_AUTO,
+		StatPrefix: statPrefix,
+		RouteSpecifier: &hcmv3.HttpConnectionManager_Rds{
+			Rds: &hcmv3.Rds{
+				ConfigSource: makeConfigSource(),
+				// Configure route name to be found via RDS.
+				RouteConfigName: irListener.Name,
+			},
+		},
+		HttpProtocolOptions: http1ProtocolOptions(irListener.HTTP1),
+		// Hide the Envoy proxy in the Server header by default
+		ServerHeaderTransformation: hcmv3.HttpConnectionManager_PASS_THROUGH,
+		// Add HTTP2 protocol options
+		// Set it by default to also support HTTP1.1 to HTTP2 Upgrades
+		Http2ProtocolOptions: http2ProtocolOptions(),
+		// https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for
+		UseRemoteAddress: &wrappers.BoolValue{Value: useRemoteAddress},
+		// XffNumTrustedHops:             xffNumTrustedHops(irListener.ClientIPDetection),
+		// OriginalIpDetectionExtensions: originalIPDetectionExtensions,
+		// normalize paths according to RFC 3986
+		NormalizePath: &wrapperspb.BoolValue{Value: true},
+		MergeSlashes:  irListener.Path.MergeSlashes,
+		// PathWithEscapedSlashesAction: translateEscapePath(irListener.Path.EscapedSlashesAction),
+		CommonHttpProtocolOptions: &corev3.HttpProtocolOptions{
+			HeadersWithUnderscoresAction: corev3.HttpProtocolOptions_REJECT_REQUEST,
+		},
+		Tracing: hcmTracing,
+	}
+
+	if irListener.Timeout != nil && irListener.Timeout.HTTP != nil && irListener.Timeout.HTTP.RequestReceivedTimeout != nil {
+		mgr.RequestTimeout = durationpb.New(irListener.Timeout.HTTP.RequestReceivedTimeout.Duration)
+	}
+
+	// Add the proxy protocol filter if needed
+	patchProxyProtocolFilter(xdsListener, irListener)
+
+	if irListener.IsHTTP2 {
+		mgr.HttpFilters = append(mgr.HttpFilters, xdsfilters.GRPCWeb)
+		// always enable grpc stats filter
+		mgr.HttpFilters = append(mgr.HttpFilters, xdsfilters.GRPCStats)
+	}
+
+	if http3Listener {
+		mgr.CodecType = hcmv3.HttpConnectionManager_HTTP3
+		mgr.Http3ProtocolOptions = &corev3.Http3ProtocolOptions{}
+	}
+	// Add HTTP filters to the HCM, the filters have already been sorted in the
+	// correct order in the patchHCMWithFilters function.
+	if err := t.patchHCMWithFilters(mgr, irListener); err != nil {
+		return err
+	}
+
+	mgrAny, err := protocov.ToAnyWithError(mgr)
+	if err != nil {
+		return err
+	}
+
+	filterChain := &listenerv3.FilterChain{
+		Filters: []*listenerv3.Filter{{
+			Name: wellknown.HTTPConnectionManager,
+			ConfigType: &listenerv3.Filter_TypedConfig{
+				TypedConfig: mgrAny,
+			},
+		}},
+	}
+
+	if irListener.TLS != nil {
+		var tSocket *corev3.TransportSocket
+		if http3Listener {
+			tSocket, err = buildDownstreamQUICTransportSocket(irListener.TLS, http3Listener)
+			if err != nil {
+				return err
+			}
+		} else {
+			tSocket, err = buildXdsDownstreamTLSSocket(irListener.TLS, http3Listener)
+			if err != nil {
+				return err
+			}
+		}
+		filterChain.TransportSocket = tSocket
+		if err := addServerNamesMatch(xdsListener, filterChain, irListener.Hostnames); err != nil {
+			return err
+		}
+
+		xdsListener.FilterChains = append(xdsListener.FilterChains, filterChain)
+	} else {
+		// Add the HTTP filter chain as the default filter chain
+		// Make sure one does not exist
+		if xdsListener.DefaultFilterChain != nil {
+			return errors.New("default filter chain already exists")
+		}
+		xdsListener.DefaultFilterChain = filterChain
+	}
+
+	return nil
+}
+
+func addServerNamesMatch(xdsListener *listenerv3.Listener, filterChain *listenerv3.FilterChain, hostnames []string) error {
+	// Dont add a filter chain match if the hostname is a wildcard character.
+	if len(hostnames) > 0 && hostnames[0] != "*" {
+		filterChain.FilterChainMatch = &listenerv3.FilterChainMatch{
+			ServerNames: hostnames,
+		}
+
+		if err := addXdsTLSInspectorFilter(xdsListener); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// findXdsHTTPRouteConfigName finds the name of the route config associated with the
+// http connection manager within the default filter chain and returns an empty string if
+// not found.
+func findXdsHTTPRouteConfigName(xdsListener *listenerv3.Listener) string {
+	if xdsListener == nil || xdsListener.DefaultFilterChain == nil || xdsListener.DefaultFilterChain.Filters == nil {
+		return ""
+	}
+
+	for _, filter := range xdsListener.DefaultFilterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			m := new(hcmv3.HttpConnectionManager)
+			if err := filter.GetTypedConfig().UnmarshalTo(m); err != nil {
+				return ""
+			}
+			rds := m.GetRds()
+			if rds == nil {
+				return ""
+			}
+			return rds.GetRouteConfigName()
+		}
+	}
+	return ""
+}
+
+func addXdsTCPFilterChain(xdsListener *listenerv3.Listener, irListener *ir.TCPListener, clusterName string, accesslog *ir.AccessLog) error {
+	if irListener == nil {
+		return errors.New("tcp listener is nil")
+	}
+
+	isTLSPassthrough := irListener.TLS != nil && irListener.TLS.Passthrough != nil
+	isTLSTerminate := irListener.TLS != nil && irListener.TLS.Terminate != nil
+	statPrefix := "tcp"
+	if isTLSPassthrough {
+		statPrefix = "passthrough"
+	}
+
+	if isTLSTerminate {
+		statPrefix = "terminate"
+	}
+
+	mgr := &tcpv3.TcpProxy{
+		AccessLog:  buildXdsAccessLog(accesslog, false),
+		StatPrefix: statPrefix,
+		ClusterSpecifier: &tcpv3.TcpProxy_Cluster{
+			Cluster: clusterName,
+		},
+	}
+	mgrAny, err := anypb.New(mgr)
+	if err != nil {
+		return err
+	}
+
+	filterChain := &listenerv3.FilterChain{
+		Filters: []*listenerv3.Filter{{
+			Name: wellknown.TCPProxy,
+			ConfigType: &listenerv3.Filter_TypedConfig{
+				TypedConfig: mgrAny,
+			},
+		}},
+	}
+
+	if isTLSPassthrough {
+		if err := addServerNamesMatch(xdsListener, filterChain, irListener.TLS.Passthrough.SNIs); err != nil {
+			return err
+		}
+	}
+
+	if isTLSTerminate {
+		tSocket, err := buildXdsDownstreamTLSSocket(irListener.TLS.Terminate, false)
+		if err != nil {
+			return err
+		}
+		filterChain.TransportSocket = tSocket
+	}
+
+	xdsListener.FilterChains = append(xdsListener.FilterChains, filterChain)
+
+	return nil
+}
+
+// addXdsTLSInspectorFilter adds a Tls Inspector filter if it does not yet exist.
+func addXdsTLSInspectorFilter(xdsListener *listenerv3.Listener) error {
+	// Return early if it exists
+	for _, filter := range xdsListener.ListenerFilters {
+		if filter.Name == wellknown.TlsInspector {
+			return nil
+		}
+	}
+
+	tlsInspector := &tls_inspectorv3.TlsInspector{}
+	tlsInspectorAny, err := anypb.New(tlsInspector)
+	if err != nil {
+		return err
+	}
+
+	filter := &listenerv3.ListenerFilter{
+		Name: wellknown.TlsInspector,
+		ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+			TypedConfig: tlsInspectorAny,
+		},
+	}
+
+	xdsListener.ListenerFilters = append(xdsListener.ListenerFilters, filter)
+
+	return nil
+}
+
+func buildDownstreamQUICTransportSocket(tlsConfig *ir.TLSConfig, http3Listener bool) (*corev3.TransportSocket, error) {
+	tlsCtx := &quicv3.QuicDownstreamTransport{
+		DownstreamTlsContext: &tlsv3.DownstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				TlsParams:     buildTLSParams(tlsConfig),
+				AlpnProtocols: buildALPNProtocols(tlsConfig.ALPNProtocols, http3Listener),
+			},
+		},
+	}
+
+	for _, tlsConfig := range tlsConfig.Certificates {
+		tlsCtx.DownstreamTlsContext.CommonTlsContext.TlsCertificateSdsSecretConfigs = append(
+			tlsCtx.DownstreamTlsContext.CommonTlsContext.TlsCertificateSdsSecretConfigs,
+			&tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.Name,
+				SdsConfig: makeConfigSource(),
+			})
+	}
+
+	if tlsConfig.CACertificate != nil {
+		tlsCtx.DownstreamTlsContext.RequireClientCertificate = &wrappers.BoolValue{Value: true}
+		tlsCtx.DownstreamTlsContext.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+			ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.CACertificate.Name,
+				SdsConfig: makeConfigSource(),
+			},
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketQuic,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
+
+func buildXdsDownstreamTLSSocket(tlsConfig *ir.TLSConfig, http3Listener bool) (*corev3.TransportSocket, error) {
+	tlsCtx := &tlsv3.DownstreamTlsContext{
+		CommonTlsContext: &tlsv3.CommonTlsContext{
+			TlsParams:                      buildTLSParams(tlsConfig),
+			AlpnProtocols:                  buildALPNProtocols(tlsConfig.ALPNProtocols, http3Listener),
+			TlsCertificateSdsSecretConfigs: []*tlsv3.SdsSecretConfig{},
+		},
+	}
+
+	for _, tlsConfig := range tlsConfig.Certificates {
+		tlsCtx.CommonTlsContext.TlsCertificateSdsSecretConfigs = append(
+			tlsCtx.CommonTlsContext.TlsCertificateSdsSecretConfigs,
+			&tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.Name,
+				SdsConfig: makeConfigSource(),
+			})
+	}
+
+	if tlsConfig.CACertificate != nil {
+		tlsCtx.RequireClientCertificate = &wrappers.BoolValue{Value: true}
+		tlsCtx.CommonTlsContext.ValidationContextType = &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+			ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+				Name:      tlsConfig.CACertificate.Name,
+				SdsConfig: makeConfigSource(),
+			},
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTls,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
+
+func buildTLSParams(tlsConfig *ir.TLSConfig) *tlsv3.TlsParameters {
+	p := &tlsv3.TlsParameters{}
+	isEmpty := true
+	if tlsConfig.MinVersion != nil {
+		p.TlsMinimumProtocolVersion = buildTLSVersion(tlsConfig.MinVersion)
+		isEmpty = false
+	}
+	if tlsConfig.MaxVersion != nil {
+		p.TlsMaximumProtocolVersion = buildTLSVersion(tlsConfig.MaxVersion)
+		isEmpty = false
+	}
+	if len(tlsConfig.Ciphers) > 0 {
+		p.CipherSuites = tlsConfig.Ciphers
+		isEmpty = false
+	}
+	if len(tlsConfig.ECDHCurves) > 0 {
+		p.EcdhCurves = tlsConfig.ECDHCurves
+		isEmpty = false
+	}
+	if len(tlsConfig.SignatureAlgorithms) > 0 {
+		p.SignatureAlgorithms = tlsConfig.SignatureAlgorithms
+		isEmpty = false
+	}
+	if isEmpty {
+		return nil
+	}
+	return p
+}
+
+func buildTLSVersion(version *ir.TLSVersion) tlsv3.TlsParameters_TlsProtocol {
+	lookup := map[ir.TLSVersion]tlsv3.TlsParameters_TlsProtocol{
+		ir.TLSv10: tlsv3.TlsParameters_TLSv1_0,
+		ir.TLSv11: tlsv3.TlsParameters_TLSv1_1,
+		ir.TLSv12: tlsv3.TlsParameters_TLSv1_2,
+		ir.TLSv13: tlsv3.TlsParameters_TLSv1_3,
+	}
+	if r, found := lookup[*version]; found {
+		return r
+	}
+	return tlsv3.TlsParameters_TLS_AUTO
+}
+
+func buildALPNProtocols(alpn []string, http3Listener bool) []string {
+	if len(alpn) == 0 {
+		out := []string{"h2", "http/1.1"}
+		if http3Listener {
+			out = append(out, "h3")
+		}
+		return out
+	}
+	return alpn
+}
+
+func buildXdsTLSCertSecret(tlsConfig ir.TLSCertificate) *tlsv3.Secret {
+	return &tlsv3.Secret{
+		Name: tlsConfig.Name,
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.ServerCertificate},
+				},
+				PrivateKey: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.PrivateKey},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsTLSCaCertSecret(caCertificate *ir.TLSCACertificate) *tlsv3.Secret {
+	return &tlsv3.Secret{
+		Name: caCertificate.Name,
+		Type: &tlsv3.Secret_ValidationContext{
+			ValidationContext: &tlsv3.CertificateValidationContext{
+				TrustedCa: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: caCertificate.Certificate},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsUDPListener(clusterName string, udpListener *ir.UDPListener, accesslog *ir.AccessLog) (*listenerv3.Listener, error) {
+	if udpListener == nil {
+		return nil, errors.New("udp listener is nil")
+	}
+
+	statPrefix := "service"
+
+	route := &udpv3.Route{
+		Cluster: clusterName,
+	}
+	routeAny, err := anypb.New(route)
+	if err != nil {
+		return nil, err
+	}
+
+	udpProxy := &udpv3.UdpProxyConfig{
+		StatPrefix: statPrefix,
+		AccessLog:  buildXdsAccessLog(accesslog, false),
+		RouteSpecifier: &udpv3.UdpProxyConfig_Matcher{
+			Matcher: &matcher.Matcher{
+				OnNoMatch: &matcher.Matcher_OnMatch{
+					OnMatch: &matcher.Matcher_OnMatch_Action{
+						Action: &xdscore.TypedExtensionConfig{
+							Name:        "route",
+							TypedConfig: routeAny,
+						},
+					},
+				},
+			},
+		},
+	}
+	udpProxyAny, err := anypb.New(udpProxy)
+	if err != nil {
+		return nil, err
+	}
+
+	xdsListener := &listenerv3.Listener{
+		Name:      udpListener.Name,
+		AccessLog: buildXdsAccessLog(accesslog, true),
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Protocol: corev3.SocketAddress_UDP,
+					Address:  udpListener.Address,
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: udpListener.Port,
+					},
+				},
+			},
+		},
+		ListenerFilters: []*listenerv3.ListenerFilter{{
+			Name: "envoy.filters.udp_listener.udp_proxy",
+			ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+				TypedConfig: udpProxyAny,
+			},
+		}},
+	}
+
+	return xdsListener, nil
+}
+
+// Point to xds cluster.
+func makeConfigSource() *corev3.ConfigSource {
+	source := &corev3.ConfigSource{}
+	source.ResourceApiVersion = resource.DefaultAPIVersion
+	source.ConfigSourceSpecifier = &corev3.ConfigSource_Ads{
+		Ads: &corev3.AggregatedConfigSource{},
+	}
+	return source
+}
+
+// func translateEscapePath(in ir.PathEscapedSlashAction) hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction {
+
+// 	lookup := map[ir.PathEscapedSlashAction]hcmv3.HttpConnectionManager_PathWithEscapedSlashesAction{
+// 		ir.KeepUnchangedAction: hcmv3.HttpConnectionManager_KEEP_UNCHANGED,
+// 		ir.RejectRequestAction: hcmv3.HttpConnectionManager_REJECT_REQUEST,
+// 		ir.UnescapeAndRedirect: hcmv3.HttpConnectionManager_UNESCAPE_AND_REDIRECT,
+// 		ir.UnescapeAndForward:  hcmv3.HttpConnectionManager_UNESCAPE_AND_FORWARD,
+// 	}
+// 	if r, found := lookup[in]; found {
+// 		return r
+// 	}
+// 	return hcmv3.HttpConnectionManager_IMPLEMENTATION_SPECIFIC_DEFAULT
+// }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
new file mode 100644
index 000000000..08d87017f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -0,0 +1,392 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	oauth2v3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/oauth2/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/golang/protobuf/ptypes/duration"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"google.golang.org/protobuf/types/known/anypb"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	oauth2Filter     = "envoy.filters.http.oauth2"
+	envoyTrustBundle = "/etc/ssl/certs/ca-certificates.crt"
+)
+
+func init() {
+	registerHTTPFilter(&oidc{})
+}
+
+type oidc struct {
+}
+
+var _ httpFilter = &oidc{}
+
+// patchHCM builds and appends the oauth2 Filters to the HTTP Connection Manager
+// if applicable, and it does not already exist.
+// Note: this method creates an oauth2 filter for each route that contains an OIDC config.
+// the filter is disabled by default. It is enabled on the route level.
+func (*oidc) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPListener) error {
+	var errs error
+
+	if mgr == nil {
+		return errors.New("hcm is nil")
+	}
+
+	if irListener == nil {
+		return errors.New("ir listener is nil")
+	}
+
+	for _, route := range irListener.Routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		filter, err := buildHCMOAuth2Filter(route)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		mgr.HttpFilters = append(mgr.HttpFilters, filter)
+	}
+
+	return errs
+}
+
+// buildHCMOAuth2Filter returns an OAuth2 HTTP filter from the provided IR HTTPRoute.
+func buildHCMOAuth2Filter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	oauth2Proto, err := oauth2Config(route)
+	if err != nil {
+		return nil, err
+	}
+
+	if err := oauth2Proto.ValidateAll(); err != nil {
+		return nil, err
+	}
+
+	OAuth2Any, err := anypb.New(oauth2Proto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &hcmv3.HttpFilter{
+		Name:     oauth2FilterName(route),
+		Disabled: true,
+		ConfigType: &hcmv3.HttpFilter_TypedConfig{
+			TypedConfig: OAuth2Any,
+		},
+	}, nil
+}
+
+func oauth2FilterName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s_%s", oauth2Filter, route.Name)
+}
+
+func oauth2Config(route *ir.HTTPRoute) (*oauth2v3.OAuth2, error) {
+	cluster, err := url2Cluster(route.OIDC.Provider.TokenEndpoint)
+	if err != nil {
+		return nil, err
+	}
+	if cluster.endpointType == EndpointTypeStatic {
+		return nil, fmt.Errorf(
+			"static IP cluster is not allowed: %s",
+			route.OIDC.Provider.TokenEndpoint)
+	}
+
+	oauth2 := &oauth2v3.OAuth2{
+		Config: &oauth2v3.OAuth2Config{
+			TokenEndpoint: &corev3.HttpUri{
+				Uri: route.OIDC.Provider.TokenEndpoint,
+				HttpUpstreamType: &corev3.HttpUri_Cluster{
+					Cluster: cluster.name,
+				},
+				Timeout: &duration.Duration{
+					Seconds: defaultExtServiceRequestTimeout,
+				},
+			},
+			AuthorizationEndpoint: route.OIDC.Provider.AuthorizationEndpoint,
+			RedirectUri:           route.OIDC.RedirectURL,
+			RedirectPathMatcher: &matcherv3.PathMatcher{
+				Rule: &matcherv3.PathMatcher_Path{
+					Path: &matcherv3.StringMatcher{
+						MatchPattern: &matcherv3.StringMatcher_Exact{
+							Exact: route.OIDC.RedirectPath,
+						},
+					},
+				},
+			},
+			SignoutPath: &matcherv3.PathMatcher{
+				Rule: &matcherv3.PathMatcher_Path{
+					Path: &matcherv3.StringMatcher{
+						MatchPattern: &matcherv3.StringMatcher_Exact{
+							Exact: route.OIDC.LogoutPath,
+						},
+					},
+				},
+			},
+			ForwardBearerToken: true,
+			Credentials: &oauth2v3.OAuth2Credentials{
+				ClientId: route.OIDC.ClientID,
+				TokenSecret: &tlsv3.SdsSecretConfig{
+					Name:      oauth2ClientSecretName(route),
+					SdsConfig: makeConfigSource(),
+				},
+				TokenFormation: &oauth2v3.OAuth2Credentials_HmacSecret{
+					HmacSecret: &tlsv3.SdsSecretConfig{
+						Name:      oauth2HMACSecretName(route),
+						SdsConfig: makeConfigSource(),
+					},
+				},
+				CookieNames: &oauth2v3.OAuth2Credentials_CookieNames{
+					BearerToken:  fmt.Sprintf("BearerToken-%s", route.OIDC.CookieSuffix),
+					OauthHmac:    fmt.Sprintf("OauthHMAC-%s", route.OIDC.CookieSuffix),
+					OauthExpires: fmt.Sprintf("OauthExpires-%s", route.OIDC.CookieSuffix),
+					IdToken:      fmt.Sprintf("IdToken-%s", route.OIDC.CookieSuffix),
+					RefreshToken: fmt.Sprintf("RefreshToken-%s", route.OIDC.CookieSuffix),
+				},
+			},
+			// every OIDC provider supports basic auth
+			AuthType:   oauth2v3.OAuth2Config_BASIC_AUTH,
+			AuthScopes: route.OIDC.Scopes,
+		},
+	}
+	return oauth2, nil
+}
+
+// routeContainsOIDC returns true if OIDC exists for the provided route.
+func routeContainsOIDC(irRoute *ir.HTTPRoute) bool {
+	if irRoute == nil {
+		return false
+	}
+
+	if irRoute != nil &&
+		irRoute.OIDC != nil {
+		return true
+	}
+
+	return false
+}
+
+func (*oidc) patchResources(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if err := createOAuth2TokenEndpointClusters(tCtx, routes); err != nil {
+		return err
+	}
+	return createOAuth2Secrets(tCtx, routes)
+}
+
+// createOAuth2TokenEndpointClusters creates token endpoint clusters from the
+// provided routes, if needed.
+func createOAuth2TokenEndpointClusters(tCtx *types.ResourceVersionTable,
+	routes []*ir.HTTPRoute) error {
+	if tCtx == nil || tCtx.XdsResources == nil {
+		return errors.New("xds resource table is nil")
+	}
+
+	var errs error
+	for _, route := range routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		var (
+			cluster *urlCluster
+			ds      *ir.DestinationSetting
+			tSocket *corev3.TransportSocket
+			err     error
+		)
+
+		cluster, err = url2Cluster(route.OIDC.Provider.TokenEndpoint)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		// EG does not support static IP clusters for token endpoint clusters.
+		// This validation could be removed since it's already validated in the
+		// Gateway API translator.
+		if cluster.endpointType == EndpointTypeStatic {
+			errs = errors.Join(errs, fmt.Errorf(
+				"static IP cluster is not allowed: %s",
+				route.OIDC.Provider.TokenEndpoint))
+			continue
+		}
+
+		ds = &ir.DestinationSetting{
+			Weight: ptr.To[uint32](1),
+			Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(
+				cluster.hostname,
+				cluster.port),
+			},
+		}
+
+		clusterArgs := &xdsClusterArgs{
+			name:         cluster.name,
+			settings:     []*ir.DestinationSetting{ds},
+			tSocket:      tSocket,
+			endpointType: cluster.endpointType,
+		}
+		if cluster.tls {
+			tSocket, err = buildXdsUpstreamTLSSocket(cluster.hostname)
+			if err != nil {
+				errs = errors.Join(errs, err)
+				continue
+			}
+			clusterArgs.tSocket = tSocket
+		}
+
+		if err = addXdsCluster(tCtx, clusterArgs); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+// createOAuth2Secrets creates OAuth2 client and HMAC secrets from the provided
+// routes, if needed.
+func createOAuth2Secrets(tCtx *types.ResourceVersionTable, routes []*ir.HTTPRoute) error {
+	var errs error
+
+	for _, route := range routes {
+		if !routeContainsOIDC(route) {
+			continue
+		}
+
+		// a separate secret is created for each route, even they share the same
+		// oauth2 client ID and secret.
+		clientSecret := buildOAuth2ClientSecret(route)
+		if err := addXdsSecret(tCtx, clientSecret); err != nil {
+			errs = errors.Join(errs, err)
+		}
+
+		if err := addXdsSecret(tCtx, buildOAuth2HMACSecret(route)); err != nil {
+			errs = errors.Join(errs, err)
+		}
+	}
+
+	return errs
+}
+
+func buildOAuth2ClientSecret(route *ir.HTTPRoute) *tlsv3.Secret {
+	clientSecret := &tlsv3.Secret{
+		Name: oauth2ClientSecretName(route),
+		Type: &tlsv3.Secret_GenericSecret{
+			GenericSecret: &tlsv3.GenericSecret{
+				Secret: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: route.OIDC.ClientSecret,
+					},
+				},
+			},
+		},
+	}
+
+	return clientSecret
+}
+
+func buildOAuth2HMACSecret(route *ir.HTTPRoute) *tlsv3.Secret {
+	hmacSecret := &tlsv3.Secret{
+		Name: oauth2HMACSecretName(route),
+		Type: &tlsv3.Secret_GenericSecret{
+			GenericSecret: &tlsv3.GenericSecret{
+				Secret: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: route.OIDC.HMACSecret,
+					},
+				},
+			},
+		},
+	}
+
+	return hmacSecret
+}
+
+func oauth2ClientSecretName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s/oauth2/client_secret", route.Name)
+}
+
+func oauth2HMACSecretName(route *ir.HTTPRoute) string {
+	return fmt.Sprintf("%s/oauth2/hmac_secret", route.Name)
+}
+
+// patchRoute patches the provided route with the oauth2 config if applicable.
+// Note: this method enables the corresponding oauth2 filter for the provided route.
+func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+	if irRoute.OIDC == nil {
+		return nil
+	}
+
+	return enableFilterOnRoute(oauth2Filter, route, irRoute)
+}
+
+// buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle
+// as the CA to authenticate server certificates.
+// TODO huabing: add support for custom CA and client certificate.
+func buildXdsUpstreamTLSSocket(sni string) (*corev3.TransportSocket, error) {
+	tlsCtxProto := &tlsv3.UpstreamTlsContext{
+		Sni: sni,
+		CommonTlsContext: &tlsv3.CommonTlsContext{
+			ValidationContextType: &tlsv3.CommonTlsContext_ValidationContext{
+				ValidationContext: &tlsv3.CertificateValidationContext{
+					TrustedCa: &corev3.DataSource{
+						Specifier: &corev3.DataSource_Filename{
+							Filename: envoyTrustBundle,
+						},
+					},
+				},
+			},
+		},
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtxProto)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTls,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/proxy_protocol.go b/adapter/internal/operator/gateway-api/translator/proxy_protocol.go
new file mode 100644
index 000000000..99f529cf7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/proxy_protocol.go
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	proxyprotocolv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/listener/proxy_protocol/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+// patchProxyProtocolFilter builds and appends the Proxy Protocol Filter to the
+// HTTP Listener's Listener Filters if applicable.
+func patchProxyProtocolFilter(xdsListener *listenerv3.Listener, irListener *ir.HTTPListener) {
+	// Return early if unset
+	if xdsListener == nil || irListener == nil || !irListener.EnableProxyProtocol {
+		return
+	}
+
+	// Return early if filter already exists.
+	for _, filter := range xdsListener.ListenerFilters {
+		if filter.Name == wellknown.ProxyProtocol {
+			return
+		}
+	}
+
+	proxyProtocolFilter := buildProxyProtocolFilter()
+
+	if proxyProtocolFilter != nil {
+		xdsListener.ListenerFilters = append(xdsListener.ListenerFilters, proxyProtocolFilter)
+	}
+}
+
+// buildProxypProtocolFilter returns a Proxy Protocol listener filter from the provided IR listener.
+func buildProxyProtocolFilter() *listenerv3.ListenerFilter {
+	pp := &proxyprotocolv3.ProxyProtocol{}
+
+	ppAny, err := anypb.New(pp)
+	if err != nil {
+		return nil
+	}
+
+	return &listenerv3.ListenerFilter{
+		Name: wellknown.ProxyProtocol,
+		ConfigType: &listenerv3.ListenerFilter_TypedConfig{
+			TypedConfig: ppAny,
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/translator/route.go b/adapter/internal/operator/gateway-api/translator/route.go
new file mode 100644
index 000000000..d0ee7873a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/route.go
@@ -0,0 +1,585 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"strings"
+	"time"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	previoushost "github.com/envoyproxy/go-control-plane/envoy/extensions/retry/host/previous_hosts/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/durationpb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+const (
+	retryDefaultRetryOn             = "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"
+	retryDefaultRetriableStatusCode = 503
+	retryDefaultNumRetries          = 2
+)
+
+func buildXdsRoute(httpRoute *ir.HTTPRoute) (*routev3.Route, error) {
+	router := &routev3.Route{
+		Name:  httpRoute.Name,
+		Match: buildXdsRouteMatch(httpRoute.PathMatch, httpRoute.HeaderMatches, httpRoute.QueryParamMatches),
+	}
+
+	if len(httpRoute.AddRequestHeaders) > 0 {
+		router.RequestHeadersToAdd = buildXdsAddedHeaders(httpRoute.AddRequestHeaders)
+	}
+	if len(httpRoute.RemoveRequestHeaders) > 0 {
+		router.RequestHeadersToRemove = httpRoute.RemoveRequestHeaders
+	}
+
+	if len(httpRoute.AddResponseHeaders) > 0 {
+		router.ResponseHeadersToAdd = buildXdsAddedHeaders(httpRoute.AddResponseHeaders)
+	}
+	if len(httpRoute.RemoveResponseHeaders) > 0 {
+		router.ResponseHeadersToRemove = httpRoute.RemoveResponseHeaders
+	}
+
+	switch {
+	case httpRoute.DirectResponse != nil:
+		router.Action = &routev3.Route_DirectResponse{DirectResponse: buildXdsDirectResponseAction(httpRoute.DirectResponse)}
+	case httpRoute.Redirect != nil:
+		router.Action = &routev3.Route_Redirect{Redirect: buildXdsRedirectAction(httpRoute)}
+	case httpRoute.URLRewrite != nil:
+		routeAction := buildXdsURLRewriteAction(httpRoute.Destination.Name, httpRoute.URLRewrite, httpRoute.PathMatch)
+		if httpRoute.Mirrors != nil {
+			routeAction.RequestMirrorPolicies = buildXdsRequestMirrorPolicies(httpRoute.Mirrors)
+		}
+
+		if !httpRoute.IsHTTP2 {
+			// Allow websocket upgrades for HTTP 1.1
+			// Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism
+			routeAction.UpgradeConfigs = []*routev3.RouteAction_UpgradeConfig{
+				{
+					UpgradeType: "websocket",
+				},
+			}
+		}
+
+		router.Action = &routev3.Route_Route{Route: routeAction}
+	default:
+		var routeAction *routev3.RouteAction
+		if httpRoute.BackendWeights.Invalid != 0 {
+			// If there are invalid backends then a weighted cluster is required for the route
+			routeAction = buildXdsWeightedRouteAction(httpRoute)
+		} else {
+			routeAction = buildXdsRouteAction(httpRoute)
+		}
+		if httpRoute.Mirrors != nil {
+			routeAction.RequestMirrorPolicies = buildXdsRequestMirrorPolicies(httpRoute.Mirrors)
+		}
+		if !httpRoute.IsHTTP2 {
+			// Allow websocket upgrades for HTTP 1.1
+			// Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Protocol_upgrade_mechanism
+			routeAction.UpgradeConfigs = []*routev3.RouteAction_UpgradeConfig{
+				{
+					UpgradeType: "websocket",
+				},
+			}
+		}
+		router.Action = &routev3.Route_Route{Route: routeAction}
+	}
+
+	// Hash Policy
+	if router.GetRoute() != nil {
+		router.GetRoute().HashPolicy = buildHashPolicy(httpRoute)
+	}
+
+	// Timeouts
+	if router.GetRoute() != nil && httpRoute.Timeout != nil && httpRoute.Timeout.HTTP != nil &&
+		httpRoute.Timeout.HTTP.RequestTimeout != nil {
+		router.GetRoute().Timeout = durationpb.New(httpRoute.Timeout.HTTP.RequestTimeout.Duration)
+	}
+
+	// Retries
+	if router.GetRoute() != nil && httpRoute.Retry != nil {
+		if rp, err := buildRetryPolicy(httpRoute); err == nil {
+			router.GetRoute().RetryPolicy = rp
+		} else {
+			return nil, err
+		}
+	}
+
+	// Add per route filter configs to the route, if needed.
+	if err := patchRouteWithPerRouteConfig(router, httpRoute); err != nil {
+		return nil, err
+	}
+
+	return router, nil
+}
+
+func buildXdsRouteMatch(pathMatch *ir.StringMatch, headerMatches []*ir.StringMatch, queryParamMatches []*ir.StringMatch) *routev3.RouteMatch {
+	outMatch := &routev3.RouteMatch{}
+
+	// Add a prefix match to '/' if no matches are specified
+	if pathMatch == nil {
+		// Setup default path specifier. It may be overwritten by :host:.
+		outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+			Prefix: "/",
+		}
+	} else {
+		// Path match
+		//nolint:gocritic
+		if pathMatch.Exact != nil {
+			outMatch.PathSpecifier = &routev3.RouteMatch_Path{
+				Path: *pathMatch.Exact,
+			}
+		} else if pathMatch.Prefix != nil {
+			if *pathMatch.Prefix == "/" {
+				outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+					Prefix: "/",
+				}
+			} else {
+				// Remove trailing /
+				trimmedPrefix := strings.TrimSuffix(*pathMatch.Prefix, "/")
+				outMatch.PathSpecifier = &routev3.RouteMatch_PathSeparatedPrefix{
+					PathSeparatedPrefix: trimmedPrefix,
+				}
+			}
+		} else if pathMatch.SafeRegex != nil {
+			outMatch.PathSpecifier = &routev3.RouteMatch_SafeRegex{
+				SafeRegex: &matcherv3.RegexMatcher{
+					Regex: *pathMatch.SafeRegex,
+				},
+			}
+		}
+	}
+	// Header matches
+	for _, headerMatch := range headerMatches {
+		stringMatcher := buildXdsStringMatcher(headerMatch)
+
+		headerMatcher := &routev3.HeaderMatcher{
+			Name: headerMatch.Name,
+			HeaderMatchSpecifier: &routev3.HeaderMatcher_StringMatch{
+				StringMatch: stringMatcher,
+			},
+		}
+		outMatch.Headers = append(outMatch.Headers, headerMatcher)
+	}
+
+	// Query param matches
+	for _, queryParamMatch := range queryParamMatches {
+		stringMatcher := buildXdsStringMatcher(queryParamMatch)
+
+		queryParamMatcher := &routev3.QueryParameterMatcher{
+			Name: queryParamMatch.Name,
+			QueryParameterMatchSpecifier: &routev3.QueryParameterMatcher_StringMatch{
+				StringMatch: stringMatcher,
+			},
+		}
+		outMatch.QueryParameters = append(outMatch.QueryParameters, queryParamMatcher)
+	}
+
+	return outMatch
+}
+
+func buildXdsStringMatcher(irMatch *ir.StringMatch) *matcherv3.StringMatcher {
+	stringMatcher := new(matcherv3.StringMatcher)
+
+	//nolint:gocritic
+	if irMatch.Exact != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Exact{
+				Exact: *irMatch.Exact,
+			},
+		}
+	} else if irMatch.Prefix != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Prefix{
+				Prefix: *irMatch.Prefix,
+			},
+		}
+	} else if irMatch.Suffix != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_Suffix{
+				Suffix: *irMatch.Suffix,
+			},
+		}
+	} else if irMatch.SafeRegex != nil {
+		stringMatcher = &matcherv3.StringMatcher{
+			MatchPattern: &matcherv3.StringMatcher_SafeRegex{
+				SafeRegex: &matcherv3.RegexMatcher{
+					Regex: *irMatch.SafeRegex,
+				},
+			},
+		}
+	}
+
+	return stringMatcher
+}
+
+func buildXdsRouteAction(httpRoute *ir.HTTPRoute) *routev3.RouteAction {
+	return &routev3.RouteAction{
+		ClusterSpecifier: &routev3.RouteAction_Cluster{
+			Cluster: httpRoute.Destination.Name,
+		},
+		IdleTimeout: idleTimeout(httpRoute),
+	}
+}
+
+func buildXdsWeightedRouteAction(httpRoute *ir.HTTPRoute) *routev3.RouteAction {
+	clusters := []*routev3.WeightedCluster_ClusterWeight{
+		{
+			Name:   "invalid-backend-cluster",
+			Weight: &wrapperspb.UInt32Value{Value: httpRoute.BackendWeights.Invalid},
+		},
+	}
+
+	if httpRoute.BackendWeights.Valid > 0 {
+		validCluster := &routev3.WeightedCluster_ClusterWeight{
+			Name:   httpRoute.Destination.Name,
+			Weight: &wrapperspb.UInt32Value{Value: httpRoute.BackendWeights.Valid},
+		}
+		clusters = append(clusters, validCluster)
+	}
+
+	return &routev3.RouteAction{
+		// Intentionally route to a non-existent cluster and return a 500 error when it is not found
+		ClusterNotFoundResponseCode: routev3.RouteAction_INTERNAL_SERVER_ERROR,
+		ClusterSpecifier: &routev3.RouteAction_WeightedClusters{
+			WeightedClusters: &routev3.WeightedCluster{
+				Clusters: clusters,
+			},
+		},
+		IdleTimeout: idleTimeout(httpRoute),
+	}
+}
+
+func idleTimeout(httpRoute *ir.HTTPRoute) *durationpb.Duration {
+	if httpRoute.Timeout != nil && httpRoute.Timeout.HTTP != nil {
+		if httpRoute.Timeout.HTTP.RequestTimeout != nil {
+			timeout := time.Hour // Default to 1 hour
+
+			// Ensure is not less than the request timeout
+			if timeout < httpRoute.Timeout.HTTP.RequestTimeout.Duration {
+				timeout = httpRoute.Timeout.HTTP.RequestTimeout.Duration
+			}
+
+			// Disable idle timeout when request timeout is disabled
+			if httpRoute.Timeout.HTTP.RequestTimeout.Duration == 0 {
+				timeout = 0
+			}
+
+			return durationpb.New(timeout)
+		}
+	}
+	return nil
+}
+
+func buildXdsRedirectAction(httpRoute *ir.HTTPRoute) *routev3.RedirectAction {
+	var (
+		redirection = httpRoute.Redirect
+		routeAction = &routev3.RedirectAction{}
+	)
+
+	if redirection.Scheme != nil {
+		routeAction.SchemeRewriteSpecifier = &routev3.RedirectAction_SchemeRedirect{
+			SchemeRedirect: *redirection.Scheme,
+		}
+	}
+	if redirection.Path != nil {
+		if redirection.Path.FullReplace != nil {
+			routeAction.PathRewriteSpecifier = &routev3.RedirectAction_PathRedirect{
+				PathRedirect: *redirection.Path.FullReplace,
+			}
+		} else if redirection.Path.PrefixMatchReplace != nil {
+			if useRegexRewriteForPrefixMatchReplace(httpRoute.PathMatch, *redirection.Path.PrefixMatchReplace) {
+				routeAction.PathRewriteSpecifier = &routev3.RedirectAction_RegexRewrite{
+					RegexRewrite: prefix2RegexRewrite(*httpRoute.PathMatch.Prefix),
+				}
+			} else {
+				routeAction.PathRewriteSpecifier = &routev3.RedirectAction_PrefixRewrite{
+					PrefixRewrite: *redirection.Path.PrefixMatchReplace,
+				}
+			}
+		}
+	}
+	if redirection.Hostname != nil {
+		routeAction.HostRedirect = *redirection.Hostname
+	}
+	if redirection.Port != nil {
+		routeAction.PortRedirect = *redirection.Port
+	}
+	if redirection.StatusCode != nil {
+		if *redirection.StatusCode == 302 {
+			routeAction.ResponseCode = routev3.RedirectAction_FOUND
+		} // no need to check for 301 since Envoy will use 301 as the default if the field is not configured
+	}
+
+	return routeAction
+}
+
+// useRegexRewriteForPrefixMatchReplace checks if the regex rewrite should be used for prefix match replace
+// due to the issue with Envoy not handling the case of "//" when the replace string is "/".
+// See: https://github.com/envoyproxy/envoy/issues/26055
+func useRegexRewriteForPrefixMatchReplace(pathMatch *ir.StringMatch, prefixMatchReplace string) bool {
+	return pathMatch != nil &&
+		pathMatch.Prefix != nil &&
+		(prefixMatchReplace == "" || prefixMatchReplace == "/")
+}
+
+func prefix2RegexRewrite(prefix string) *matcherv3.RegexMatchAndSubstitute {
+	return &matcherv3.RegexMatchAndSubstitute{
+		Pattern: &matcherv3.RegexMatcher{
+			Regex: "^" + prefix + `\/*`,
+		},
+		Substitution: "/",
+	}
+}
+
+func buildXdsURLRewriteAction(destName string, urlRewrite *ir.URLRewrite, pathMatch *ir.StringMatch) *routev3.RouteAction {
+	routeAction := &routev3.RouteAction{
+		ClusterSpecifier: &routev3.RouteAction_Cluster{
+			Cluster: destName,
+		},
+	}
+
+	if urlRewrite.Path != nil {
+		if urlRewrite.Path.FullReplace != nil {
+			routeAction.RegexRewrite = &matcherv3.RegexMatchAndSubstitute{
+				Pattern: &matcherv3.RegexMatcher{
+					Regex: "/.+",
+				},
+				Substitution: *urlRewrite.Path.FullReplace,
+			}
+		} else if urlRewrite.Path.PrefixMatchReplace != nil {
+			// Circumvent the case of "//" when the replace string is "/"
+			// An empty replace string does not seem to solve the issue so we are using
+			// a regex match and replace instead
+			// Remove this workaround once https://github.com/envoyproxy/envoy/issues/26055 is fixed
+			if useRegexRewriteForPrefixMatchReplace(pathMatch, *urlRewrite.Path.PrefixMatchReplace) {
+				routeAction.RegexRewrite = prefix2RegexRewrite(*pathMatch.Prefix)
+			} else {
+				routeAction.PrefixRewrite = *urlRewrite.Path.PrefixMatchReplace
+			}
+		}
+	}
+
+	if urlRewrite.Hostname != nil {
+		routeAction.HostRewriteSpecifier = &routev3.RouteAction_HostRewriteLiteral{
+			HostRewriteLiteral: *urlRewrite.Hostname,
+		}
+
+		routeAction.AppendXForwardedHost = true
+	}
+
+	return routeAction
+}
+
+func buildXdsDirectResponseAction(res *ir.DirectResponse) *routev3.DirectResponseAction {
+	routeAction := &routev3.DirectResponseAction{Status: res.StatusCode}
+
+	if res.Body != nil {
+		routeAction.Body = &corev3.DataSource{
+			Specifier: &corev3.DataSource_InlineString{
+				InlineString: *res.Body,
+			},
+		}
+	}
+
+	return routeAction
+}
+
+func buildXdsRequestMirrorPolicies(mirrorDestinations []*ir.RouteDestination) []*routev3.RouteAction_RequestMirrorPolicy {
+	var mirrorPolicies []*routev3.RouteAction_RequestMirrorPolicy
+
+	for _, mirrorDest := range mirrorDestinations {
+		mirrorPolicies = append(mirrorPolicies, &routev3.RouteAction_RequestMirrorPolicy{
+			Cluster: mirrorDest.Name,
+		})
+	}
+
+	return mirrorPolicies
+}
+
+func buildXdsAddedHeaders(headersToAdd []ir.AddHeader) []*corev3.HeaderValueOption {
+	headerValueOptions := make([]*corev3.HeaderValueOption, len(headersToAdd))
+
+	for i, header := range headersToAdd {
+		var appendAction corev3.HeaderValueOption_HeaderAppendAction
+
+		if header.Append {
+			appendAction = corev3.HeaderValueOption_APPEND_IF_EXISTS_OR_ADD
+		} else {
+			appendAction = corev3.HeaderValueOption_OVERWRITE_IF_EXISTS_OR_ADD
+		}
+
+		headerValueOptions[i] = &corev3.HeaderValueOption{
+			Header: &corev3.HeaderValue{
+				Key:   header.Name,
+				Value: header.Value,
+			},
+			AppendAction: appendAction,
+		}
+
+		// Allow empty headers to be set, but don't add the config to do so unless necessary
+		if header.Value == "" {
+			headerValueOptions[i].KeepEmptyValue = true
+		}
+	}
+
+	return headerValueOptions
+}
+
+func buildHashPolicy(httpRoute *ir.HTTPRoute) []*routev3.RouteAction_HashPolicy {
+	// Return early
+	if httpRoute == nil || httpRoute.LoadBalancer == nil || httpRoute.LoadBalancer.ConsistentHash == nil {
+		return nil
+	}
+
+	if httpRoute.LoadBalancer.ConsistentHash.SourceIP != nil && *httpRoute.LoadBalancer.ConsistentHash.SourceIP {
+		hashPolicy := &routev3.RouteAction_HashPolicy{
+			PolicySpecifier: &routev3.RouteAction_HashPolicy_ConnectionProperties_{
+				ConnectionProperties: &routev3.RouteAction_HashPolicy_ConnectionProperties{
+					SourceIp: true,
+				},
+			},
+		}
+		return []*routev3.RouteAction_HashPolicy{hashPolicy}
+	}
+
+	return nil
+}
+
+func buildRetryPolicy(route *ir.HTTPRoute) (*routev3.RetryPolicy, error) {
+	if route.Retry != nil {
+		rr := route.Retry
+		rp := &routev3.RetryPolicy{
+			RetryOn:              retryDefaultRetryOn,
+			RetriableStatusCodes: []uint32{retryDefaultRetriableStatusCode},
+			NumRetries:           &wrapperspb.UInt32Value{Value: retryDefaultNumRetries},
+			RetryHostPredicate: []*routev3.RetryPolicy_RetryHostPredicate{
+				{
+					Name: "envoy.retry_host_predicates.previous_hosts",
+					ConfigType: &routev3.RetryPolicy_RetryHostPredicate_TypedConfig{
+						TypedConfig: protocov.ToAny(&previoushost.PreviousHostsPredicate{}),
+					},
+				},
+			},
+			HostSelectionRetryMaxAttempts: 5,
+		}
+
+		if rr.NumRetries != nil {
+			rp.NumRetries = &wrapperspb.UInt32Value{Value: *rr.NumRetries}
+		}
+
+		if rr.RetryOn != nil {
+			if rr.RetryOn.Triggers != nil && len(rr.RetryOn.Triggers) > 0 {
+				if ro, err := buildRetryOn(rr.RetryOn.Triggers); err == nil {
+					rp.RetryOn = ro
+				} else {
+					return nil, err
+				}
+			}
+
+			if rr.RetryOn.HTTPStatusCodes != nil && len(rr.RetryOn.HTTPStatusCodes) > 0 {
+				rp.RetriableStatusCodes = buildRetryStatusCodes(rr.RetryOn.HTTPStatusCodes)
+			}
+		}
+
+		if rr.PerRetry != nil {
+			if rr.PerRetry.Timeout != nil {
+				rp.PerTryTimeout = durationpb.New(rr.PerRetry.Timeout.Duration)
+			}
+
+			if rr.PerRetry.BackOff != nil {
+				bbo := false
+				rbo := &routev3.RetryPolicy_RetryBackOff{}
+				if rr.PerRetry.BackOff.BaseInterval != nil {
+					rbo.BaseInterval = durationpb.New(rr.PerRetry.BackOff.BaseInterval.Duration)
+					bbo = true
+				}
+
+				if rr.PerRetry.BackOff.MaxInterval != nil {
+					rbo.MaxInterval = durationpb.New(rr.PerRetry.BackOff.MaxInterval.Duration)
+					bbo = true
+				}
+
+				if bbo {
+					rp.RetryBackOff = rbo
+				}
+			}
+		}
+		return rp, nil
+	}
+
+	return nil, nil
+}
+
+func buildRetryStatusCodes(codes []ir.HTTPStatus) []uint32 {
+	ret := make([]uint32, len(codes))
+	for i, c := range codes {
+		ret[i] = uint32(c)
+	}
+	return ret
+}
+
+// buildRetryOn concatenates triggers to a comma-delimited string.
+// An error is returned if a trigger is not in the list of supported values (not likely, due to prior validations).
+func buildRetryOn(triggers []ir.TriggerEnum) (string, error) {
+	if len(triggers) == 0 {
+		return "", nil
+	}
+
+	lookup := map[ir.TriggerEnum]string{
+		ir.Error5XX:             "5xx",
+		ir.GatewayError:         "gateway-error",
+		ir.Reset:                "reset",
+		ir.ConnectFailure:       "connect-failure",
+		ir.Retriable4XX:         "retriable-4xx",
+		ir.RefusedStream:        "refused-stream",
+		ir.RetriableStatusCodes: "retriable-status-codes",
+		ir.Cancelled:            "cancelled",
+		ir.DeadlineExceeded:     "deadline-exceeded",
+		ir.Internal:             "internal",
+		ir.ResourceExhausted:    "resource-exhausted",
+		ir.Unavailable:          "unavailable",
+	}
+
+	var b strings.Builder
+
+	if t, found := lookup[triggers[0]]; found {
+		b.WriteString(t)
+	} else {
+		return "", errors.New("unsupported RetryOn trigger")
+	}
+
+	for _, v := range triggers[1:] {
+		if t, found := lookup[v]; found {
+			b.WriteString(",")
+			b.WriteString(t)
+		} else {
+			return "", errors.New("unsupported RetryOn trigger")
+		}
+	}
+
+	return b.String(), nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner.go b/adapter/internal/operator/gateway-api/translator/runner/runner.go
new file mode 100644
index 000000000..be0131072
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner.go
@@ -0,0 +1,139 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/translator"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+type Config struct {
+	XdsIR *message.XdsIR
+	Xds   *message.Xds
+	// ExtensionManager  extension.Manager
+	ProviderResources *message.ProviderResources
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("xds-translator")
+}
+
+// Start starts the xds-translator runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	go r.subscribeAndTranslate(ctx)
+	loggers.LoggerAPKOperator.Info("Started xds translator ...")
+	return
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: "xds-translator", Message: "xds-ir"}, r.XdsIR.Subscribe(ctx),
+		func(update message.Update[string, *ir.Xds], errChan chan error) {
+			loggers.LoggerAPKOperator.Info("Received an update in xds translator ...")
+			key := update.Key
+			val := update.Value
+
+			if update.Delete {
+				r.Xds.Delete(key)
+			} else {
+				// Translate to xds resources
+				t := &translator.Translator{}
+
+				// Set the extension manager if an extension is loaded
+				// if r.ExtensionManager != nil {
+				// 	t.ExtensionManager = &r.ExtensionManager
+				// }
+
+				// Set the rate limit service URL if global rate limiting is enabled.
+				// if r.EnvoyGateway.RateLimit != nil {
+				// 	t.GlobalRateLimit = &translator.GlobalRateLimitSettings{
+				// 		ServiceURL: ratelimit.GetServiceURL(r.Namespace, r.DNSDomain),
+				// 		FailClosed: r.EnvoyGateway.RateLimit.FailClosed,
+				// 	}
+				// 	if r.EnvoyGateway.RateLimit.Timeout != nil {
+				// 		t.GlobalRateLimit.Timeout = r.EnvoyGateway.RateLimit.Timeout.Duration
+				// 	}
+				// }
+
+				result, err := t.Translate(val)
+				if err != nil {
+					loggers.LoggerAPKOperator.Error("Failed to translate xds ir ", err)
+					errChan <- err
+				}
+
+				// xDS translation is done in a best-effort manner, so the result
+				// may contain partial resources even if there are errors.
+				if result == nil {
+					loggers.LoggerAPKOperator.Info("No xds resources to publish")
+					return
+				}
+
+				// Get all status keys from watchable and save them in the map statusesToDelete.
+				// Iterating through result.EnvoyPatchPolicyStatuses, any valid keys will be removed from statusesToDelete.
+				// Remaining keys will be deleted from watchable before we exit this function.
+				// statusesToDelete := make(map[ktypes.NamespacedName]bool)
+				// for key := range r.ProviderResources.EnvoyPatchPolicyStatuses.LoadAll() {
+				// 	statusesToDelete[key] = true
+				// }
+
+				// // Publish EnvoyPatchPolicyStatus
+				// for _, e := range result.EnvoyPatchPolicyStatuses {
+				// 	key := ktypes.NamespacedName{
+				// 		Name:      e.Name,
+				// 		Namespace: e.Namespace,
+				// 	}
+				// 	// Skip updating status for policies with empty status
+				// 	// They may have been skipped in this translation because
+				// 	// their target is not found (not relevant)
+				// 	if !(reflect.ValueOf(e.Status).IsZero()) {
+				// 		r.ProviderResources.EnvoyPatchPolicyStatuses.Store(key, e.Status)
+				// 	}
+				// 	delete(statusesToDelete, key)
+				// }
+				// // Discard the EnvoyPatchPolicyStatuses to reduce memory footprint
+				// result.EnvoyPatchPolicyStatuses = nil
+
+				// Publish
+				r.Xds.Store(key, result)
+
+				// Delete all the deletable status keys
+				// for key := range statusesToDelete {
+				// 	r.ProviderResources.EnvoyPatchPolicyStatuses.Delete(key)
+				// }
+			}
+		},
+	)
+	loggers.LoggerAPKOperator.Info("subscriber shutting down")
+}
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner_test.go b/adapter/internal/operator/gateway-api/translator/runner/runner_test.go
new file mode 100644
index 000000000..205f36236
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner_test.go
@@ -0,0 +1,199 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestRunner(t *testing.T) {
+	// Setup
+	xdsIR := new(message.XdsIR)
+	xds := new(message.Xds)
+	pResource := new(message.ProviderResources)
+	// cfg, err := config.New()
+	// require.NoError(t, err)
+	r := New(&Config{
+		// Server:            *cfg,
+		ProviderResources: pResource,
+		XdsIR:             xdsIR,
+		Xds:               xds,
+	})
+
+	ctx := context.Background()
+	// Start
+	err := r.Start(ctx)
+	require.NoError(t, err)
+
+	// xDS is nil at start
+	require.Equal(t, map[string]*ir.Xds{}, xdsIR.LoadAll())
+
+	// test translation
+	path := "example"
+	res := ir.Xds{
+		HTTP: []*ir.HTTPListener{
+			{
+				Name:      "test",
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes: []*ir.HTTPRoute{
+					{
+						Name: "test-route",
+						PathMatch: &ir.StringMatch{
+							Exact: &path,
+						},
+						Destination: &ir.RouteDestination{
+							Name: "test-dest",
+							Settings: []*ir.DestinationSetting{
+								{
+									Endpoints: []*ir.DestinationEndpoint{
+										{
+											Host: "10.11.12.13",
+											Port: 8080,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	xdsIR.Store("test", &res)
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		if out == nil {
+			return false
+		}
+		if out["test"] == nil {
+			return false
+		}
+		// Ensure an xds listener is created
+		return len(out["test"].XdsResources[resourcev3.ListenerType]) == 1
+	}, time.Second*5, time.Millisecond*50)
+
+	// Delete the IR triggering an xds delete
+	xdsIR.Delete("test")
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		// Ensure that xds has no key, value pairs
+		return len(out) == 0
+	}, time.Second*5, time.Millisecond*50)
+
+}
+
+func TestRunner_withExtensionManager(t *testing.T) {
+	// Setup
+	xdsIR := new(message.XdsIR)
+	xds := new(message.Xds)
+	pResource := new(message.ProviderResources)
+
+	// cfg, err := config.New()
+	// require.NoError(t, err)
+	r := New(&Config{
+		// Server:            *cfg,
+		ProviderResources: pResource,
+		XdsIR:             xdsIR,
+		Xds:               xds,
+		// ExtensionManager:  &extManagerMock{},
+	})
+
+	ctx := context.Background()
+	// Start
+	err := r.Start(ctx)
+	require.NoError(t, err)
+
+	// xDS is nil at start
+	require.Equal(t, map[string]*ir.Xds{}, xdsIR.LoadAll())
+
+	// test translation
+	path := "example"
+	res := ir.Xds{
+		HTTP: []*ir.HTTPListener{
+			{
+				Name:      "test",
+				Address:   "0.0.0.0",
+				Port:      80,
+				Hostnames: []string{"example.com"},
+				Routes: []*ir.HTTPRoute{
+					{
+						Name: "test-route",
+						PathMatch: &ir.StringMatch{
+							Exact: &path,
+						},
+						Destination: &ir.RouteDestination{
+							Name: "test-dest",
+							Settings: []*ir.DestinationSetting{
+								{
+									Endpoints: []*ir.DestinationEndpoint{
+										{
+											Host: "10.11.12.13",
+											Port: 8080,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	xdsIR.Store("test", &res)
+	require.Eventually(t, func() bool {
+		out := xds.LoadAll()
+		// xDS translation is done in a best-effort manner, so event the extension
+		// manager returns an error, the xDS resources should still be created.
+		return len(out) == 1
+	}, time.Second*5, time.Millisecond*50)
+}
+
+// type extManagerMock struct {
+// 	types.Manager
+// }
+
+// func (m *extManagerMock) GetPostXDSHookClient(xdsHookType v1alpha1.XDSTranslatorHook) types.XDSHookClient {
+// 	if xdsHookType == v1alpha1.XDSHTTPListener {
+// 		return &xdsHookClientMock{}
+// 	}
+
+// 	return nil
+// }
+
+// type xdsHookClientMock struct {
+// 	types.XDSHookClient
+// }
+
+// func (c *xdsHookClientMock) PostHTTPListenerModifyHook(*listenerv3.Listener) (*listenerv3.Listener, error) {
+// 	return nil, fmt.Errorf("assuming a network error during the call")
+// }
diff --git a/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go b/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
new file mode 100644
index 000000000..a3d5b06f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/tcpkeepalive.go
@@ -0,0 +1,82 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+)
+
+// buildTCPSocketOptions converts listener downstream settings to xds socketOptions
+func buildTCPSocketOptions(keepAlive *ir.TCPKeepalive) []*corev3.SocketOption {
+	if keepAlive == nil {
+		return nil
+	}
+
+	socketOptions := make([]*corev3.SocketOption, 0)
+	// Enable Keep Alives
+	socketOption := &corev3.SocketOption{
+		Description: "socket option to enable tcp keep alive",
+		Level:       0x1,                                        // syscall.SOL_SOCKET has a different value for Darwin, resulting in `go test` failing
+		Name:        0x9,                                        // syscall.SO_KEEPALIVE has a different value for Darwin, resulting in `go test` failing
+		Value:       &corev3.SocketOption_IntValue{IntValue: 1}, // Enable
+	}
+
+	socketOptions = append(socketOptions, socketOption)
+
+	if keepAlive.Probes != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive probes",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x6, // Darwin lacks syscall.TCP_KEEPCNT,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.Probes)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	if keepAlive.IdleTime != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive idle time",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x4, // Darwin lacks syscall.TCP_KEEPIDLE,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.IdleTime)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	if keepAlive.Interval != nil {
+		socketOption = &corev3.SocketOption{
+			Description: "socket option for keep alive interval",
+			Level:       0x6, // Darwin lacks syscall.SOL_TCP
+			Name:        0x5, // Darwin lacks syscall.TCP_KEEPINTVL,
+			Value:       &corev3.SocketOption_IntValue{IntValue: int64(*keepAlive.Interval)},
+			State:       corev3.SocketOption_STATE_PREBIND,
+		}
+		socketOptions = append(socketOptions, socketOption)
+	}
+
+	return socketOptions
+
+}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
new file mode 100644
index 000000000..37ce0958e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog-invalid.yaml
@@ -0,0 +1,43 @@
+name: "accesslog"
+accesslog:
+  text:
+  - path: "/dev/stdout"
+    format: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+  json:
+  - path: "/dev/stdout"
+    json:
+      start_time: "%START_TIME%"
+      method: "%REQ(:METHOD)%"
+      path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
+      protocol: "%PROTOCOL%"
+      response_code: "%RESPONSE_CODE%"
+  openTelemetry:
+  - text: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+    attributes:
+      "response_code": "%RESPONSE_CODE%"
+    resources:
+      "cluster_name": "cluster1"
+    host: ""
+    port: 4317
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
new file mode 100644
index 000000000..f4ec43ac0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/accesslog.yaml
@@ -0,0 +1,44 @@
+name: "accesslog"
+accesslog:
+  text:
+  - path: "/dev/stdout"
+    format: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+  json:
+  - path: "/dev/stdout"
+    json:
+      start_time: "%START_TIME%"
+      method: "%REQ(:METHOD)%"
+      path: "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%"
+      protocol: "%PROTOCOL%"
+      response_code: "%RESPONSE_CODE%"
+  openTelemetry:
+  - text: |
+      [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+    attributes:
+      "response_code": "%RESPONSE_CODE%"
+    resources:
+      "cluster_name": "cluster1"
+    host: otel-collector.default.svc.cluster.local
+    port: 4317
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    hostname: "*"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
new file mode 100644
index 000000000..af6baa0b7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/basic-auth.yaml
@@ -0,0 +1,22 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    basicAuth:
+      users: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
new file mode 100644
index 000000000..a63297e26
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/circuit-breaker.yaml
@@ -0,0 +1,24 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    circuitBreaker:
+      maxConnections: 1
+      maxPendingRequests: 1
+      maxParallelRequests: 1
+      maxParallelRetries: 2
+      maxRequestsPerConnection: 10
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
new file mode 100644
index 000000000..1c05b605a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/client-timeout.yaml
@@ -0,0 +1,22 @@
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "first-route"
+        hostname: "*"
+        destination:
+          name: "first-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+    timeout:
+      http:
+        requestReceivedTimeout: "5s"
+
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
new file mode 100644
index 000000000..c5a07bee8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/cors.yaml
@@ -0,0 +1,39 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    cors:
+      allowOrigins:
+      - name: example.com
+        stringMatch:
+        safeRegex: "*.example.com"
+      - name: foo.bar.com
+        stringMatch:
+        exact: foo.bar.com
+      allowMethods:
+      - GET
+      - POST
+      allowHeaders:
+      - "x-header-1"
+      - "x-header-2"
+      exposeHeaders:
+      - "x-header-3"
+      - "x-header-4"
+      allowCredentials: true
+      maxAge: 1000s
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/empty.yaml
new file mode 100644
index 000000000..e69de29bb
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
new file mode 100644
index 000000000..d1451e968
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/ext-auth.yaml
@@ -0,0 +1,61 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "www.example.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+    hostname: "*"
+    pathMatch:
+      exact: "foo"
+    destination:
+      name: httproute/default/httproute-1/rule/0
+      settings:
+      - endpoints:
+        - host: "10.0.0.1"
+          port: 50000
+    extAuth:
+      http:
+        authority: http-backend.envoy-gateway:80
+        headersToBackend:
+        - header1
+        - header2
+        path: /auth
+        destination:
+          name: securitypolicy/default/policy-for-first-route/http-backend
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 7.7.7.7
+              port: 80
+            protocol: HTTP
+            weight: 1
+  - name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+    hostname: "*"
+    pathMatch:
+      exact: "bar"
+    destination:
+      name: httproute/default/httproute-2/rule/0
+      settings:
+      - endpoints:
+        - host: "10.0.0.2"
+          port: 60000
+    extAuth:
+      grpc:
+        authority: grpc-backend.default:9000
+        destination:
+          name: securitypolicy/default/policy-for-second-route/grpc-backend
+          settings:
+          - addressType: IP
+            endpoints:
+            - host: 8.8.8.8
+              port: 9000
+            protocol: GRPC
+            weight: 1
+      headersToExtAuth:
+      - header1
+      - header2
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
new file mode 100644
index 000000000..a99b77d5e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/fault-injection.yaml
@@ -0,0 +1,83 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  hostnames:
+  - "*"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 0.01
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    faultInjection:
+      delay:
+        fixedDelay: 5.4s
+        percentage: 80
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        httpStatus: 500
+        percentage: 100
+      delay:
+        fixedDelay: 5.005s
+        percentage: 100
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    faultInjection:
+      abort:
+        grpcStatus: 14
+        percentage: 100
+      delay:
+        fixedDelay: 5.005s
+        percentage: 100
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fifth-route"
+    hostname: "*"
+    faultInjection:
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
new file mode 100644
index 000000000..a767bdab2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/health-check.yaml
@@ -0,0 +1,124 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  port: 10080
+  hostnames:
+  - "*"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "500ms"
+        interval: "3s"
+        unhealthyThreshold: 3
+        healthyThreshold: 1
+        http:
+          host: "*"
+          path: "/healthz"
+          expectedResponse:
+            text: "ok"
+          expectedStatuses:
+          - 200
+          - 300
+      passive:
+        baseEjectionTime: 180s
+        interval: 2s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        http:
+          host: "*"
+          path: "/healthz"
+          expectedResponse:
+            binary: "cG9uZw=="
+          expectedStatuses:
+          - 200
+          - 201
+      passive:
+        baseEjectionTime: 180s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        tcp:
+          send:
+            text: "ping"
+          receive:
+            text: "pong"
+      passive:
+        baseEjectionTime: 160s
+        interval: 1s
+        maxEjectionPercent: 100
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: false
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    healthCheck:
+      active:
+        timeout: "1s"
+        interval: "5s"
+        unhealthyThreshold: 3
+        healthyThreshold: 3
+        tcp:
+          send:
+            binary: "cGluZw=="
+          receive:
+            binary: "cG9uZw=="
+      passive:
+        baseEjectionTime: 180s
+        interval: 1s
+        maxEjectionPercent: 90
+        consecutive5XxErrors: 5
+        consecutiveGatewayErrors: 0
+        consecutiveLocalOriginFailures: 5
+        splitExternalLocalOriginErrors: true
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
new file mode 100644
index 000000000..9db15c7fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-direct-response.yaml
@@ -0,0 +1,22 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "direct-route"
+    hostname: "*"
+    destination:
+      name: "direct-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    directResponse:
+      body: "Unknown custom filter type: UnsupportedType"
+      statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
new file mode 100644
index 000000000..1cb0be3ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-dns-cluster.yaml
@@ -0,0 +1,26 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      prefix: /
+    queryParamMatches:
+    - exact: "yes"
+      name: debug
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "foo.bar"
+          port: 50000
+        - host: "bar.foo"
+          port: 50001
+        addressType: FQDN
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
new file mode 100644
index 000000000..42184d404
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-invalid.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
new file mode 100644
index 000000000..b00449b38
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-mirror.yaml
@@ -0,0 +1,24 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "mirror-route"
+    hostname: "*"
+    destination:
+      name: "route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    mirror:
+      name: "mirror-route-dest"
+      settings:
+      - endpoints:
+        - host: "2.3.4.5"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
new file mode 100644
index 000000000..81fc7da10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-matches.yaml
@@ -0,0 +1,86 @@
+http:
+- name: first-listener
+  address: 0.0.0.0
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: example.com
+    name: envoy-gateway/httproute-2/rule/0/match/0/example.com
+    pathMatch:
+      prefix: /v1/example
+    queryParamMatches:
+    - exact: "yes"
+      name: debug
+  - destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: 8.8.8.8
+          port: 8080
+    hostname: example.com
+    name: envoy-gateway/httproute-3/rule/0/match/0/example.com
+    pathMatch:
+      prefix: /v1/example
+  - destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    headerMatches:
+    - exact: one
+      name: version
+    hostname: example.net
+    name: envoy-gateway/httproute-4/rule/0/match/0/example.net
+    pathMatch:
+      prefix: /v1/status
+  - destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: 8.8.8.8
+          port: 8080
+    hostname: example.net
+    name: envoy-gateway/httproute-5/rule/0/match/0/example.net
+    pathMatch:
+      prefix: /v1/status
+  - destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: '*.com'
+    name: envoy-gateway/httproute-1/rule/0/match/0/*.com
+    pathMatch:
+      prefix: /foo
+  - destination:
+      name: "sixth-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: '*.net'
+    name: envoy-gateway/httproute-1/rule/0/match/0/*.net
+    pathMatch:
+      prefix: /foo
+  - destination:
+      name: "seventh-route-dest"
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+    hostname: "*"
+    name: envoy-gateway/httproute-1/rule/0/match/0/*
+    pathMatch:
+      prefix: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
new file mode 100644
index 000000000..3d13de381
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-multiple-mirrors.yaml
@@ -0,0 +1,28 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "mirror-route"
+    hostname: "*"
+    destination:
+      name: "route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    mirrors:
+    - name: "mirror-route-dest"
+      settings:
+      - endpoints:
+        - host: "2.3.4.5"
+    - name: "mirror-route-dest1"
+      settings:
+      - endpoints:
+        - host: "3.4.5.6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
new file mode 100644
index 000000000..d72ec1d2c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-partial-invalid.yaml
@@ -0,0 +1,46 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "valid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "valid-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "invalid-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "invalid-route-dest"
+      settings:
+      - endpoints:
+        - host: ""
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
new file mode 100644
index 000000000..36599609d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-redirect.yaml
@@ -0,0 +1,52 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "redirect-route-1"
+    hostname: "*"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      scheme: https
+      statusCode: 302
+      hostname: "redirected.com"
+      port: 8443
+      path:
+        prefixMatchReplace: /redirected
+  - name: "redirect-route-2"
+    hostname: "*"
+    pathMatch:
+      prefix: "/redirect"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      path:
+        prefixMatchReplace: /
+  - name: "redirect-route-3"
+    hostname: "*"
+    pathMatch:
+      prefix: "/redirect/"
+    destination:
+      name: "redirect-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    redirect:
+      path:
+        prefixMatchReplace: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
new file mode 100644
index 000000000..d9558ad99
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-regex.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "regex-route"
+    hostname: "*"
+    pathMatch:
+      safeRegex: "/v1/.*"
+    headerMatches:
+    - name: re_header
+      stringMatch:
+      safeRegex: ".*"
+    queryParamMatches:
+    - name: re_query
+      stringMatch:
+      safeRegex: ".*"
+    destination:
+      name: "regex-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
new file mode 100644
index 000000000..c3dc4417d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-request-headers.yaml
@@ -0,0 +1,38 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "request-header-route"
+    hostname: "*"
+    destination:
+      name: "request-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addRequestHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
+    removeRequestHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
new file mode 100644
index 000000000..e3114e2d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-headers.yaml
@@ -0,0 +1,35 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addResponseHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
new file mode 100644
index 000000000..0e59f8f12
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-add-remove-headers.yaml
@@ -0,0 +1,38 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    addResponseHeaders:
+    - name: "some-header"
+      value: "some-value"
+      append: true
+    - name: "some-header-2"
+      value: "some-value"
+      append: true
+    - name: "some-header3"
+      value: "some-value"
+      append: false
+    - name: "some-header4"
+      value: "some-value"
+      append: false
+    - name: "empty-header"
+      value: ""
+      append: false
+    removeResponseHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
new file mode 100644
index 000000000..f7b30b3d7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-response-remove-headers.yaml
@@ -0,0 +1,22 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "response-header-route"
+    hostname: "*"
+    destination:
+      name: "response-header-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    removeResponseHeaders:
+    - "some-header5"
+    - "some-header6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
new file mode 100644
index 000000000..f43076445
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-root-path-url-prefix.yaml
@@ -0,0 +1,27 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin/"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        prefixMatchReplace: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
new file mode 100644
index 000000000..4d08acb93
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-fullpath.yaml
@@ -0,0 +1,24 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        fullReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
new file mode 100644
index 000000000..8cc673a7e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-host.yaml
@@ -0,0 +1,28 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      hostname: "3.3.3.3"
+      path:
+        prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
new file mode 100644
index 000000000..df4f2e9c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-rewrite-url-prefix.yaml
@@ -0,0 +1,27 @@
+name: "http-route"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "rewrite-route"
+    pathMatch:
+      prefix: "/origin"
+    hostname: gateway.envoyproxy.io
+    headerMatches:
+    - name: ":authority"
+      exact: gateway.envoyproxy.io
+    destination:
+      name: "rewrite-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    urlRewrite:
+      path:
+        prefixMatchReplace: /rewrite
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
new file mode 100644
index 000000000..fdd2b84ef
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-timeout.yaml
@@ -0,0 +1,47 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 5s
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 4000s
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50001
+  - name: "third-route"
+    hostname: "*"
+    timeout:
+      http:
+        requestTimeout: 0s
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50002
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
new file mode 100644
index 000000000..2540dec62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-backend.yaml
@@ -0,0 +1,31 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.1.1.1"
+          port: 50001
+        weight: 20
+      - endpoints:
+        - host: "2.2.2.2"
+          port: 50002
+        weight: 40
+      - endpoints:
+        - host: "3.3.3.3"
+          port: 50003
+        weight: 20
+      - endpoints:
+        - host: "4.4.4.4"
+          port: 50004
+        weight: 20
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
new file mode 100644
index 000000000..4419c5222
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-weighted-invalid-backend.yaml
@@ -0,0 +1,21 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    backendWeights:
+      invalid: 1
+      valid: 1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
new file mode 100644
index 000000000..3cc0e5e87
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tls-system-truststore.yaml
@@ -0,0 +1,32 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTP
+              tls:
+                sni: example.com
+                useSystemTrustStore: true
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
new file mode 100644
index 000000000..7dd532ab4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle-multiple-certs.yaml
@@ -0,0 +1,86 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.12
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca2
+                sni: bar.example.com
+              weight: 1
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca
+                sni: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
+  - address: 0.0.0.0
+    hostnames:
+      - 'example.com'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls-2/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10081
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        proxyProtocol:
+          version: "V2"
+        destination:
+          name: httproute/envoy-gateway/httproute-btls-2/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.12
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTPS
+              tls:
+                caCertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls-2/policies-ca
+                sni: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
new file mode 100644
index 000000000..e28cd14d6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route-with-tlsbundle.yaml
@@ -0,0 +1,34 @@
+http:
+  - address: 0.0.0.0
+    hostnames:
+      - '*'
+    isHTTP2: false
+    name: envoy-gateway/gateway-btls/http
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/envoy-gateway/httproute-btls/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 10.244.0.11
+                  port: 8080
+              protocol: HTTP
+              tls:
+                CACertificate:
+                  certificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+                  name: policy-btls/policies-ca
+                SNI: example.com
+              weight: 1
+        hostname: '*'
+        name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+        pathMatch:
+          distinct: false
+          exact: /exact
+          name: ""
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
new file mode 100644
index 000000000..0c89d5a18
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http-route.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    - name: test
+      stringMatch:
+      suffix: "end"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
new file mode 100644
index 000000000..f857ac8f8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-preserve-case.yaml
@@ -0,0 +1,40 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  http1:
+    preserveHeaderCase: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10081
+  hostnames:
+  - "*"
+  http1:
+    preserveHeaderCase: true
+    enableTrailers: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.5"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
new file mode 100644
index 000000000..511747449
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http1-trailers.yaml
@@ -0,0 +1,20 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  http1:
+    enableTrailers: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
new file mode 100644
index 000000000..47f57a044
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http10.yaml
@@ -0,0 +1,21 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  http1:
+    http10:
+      defaultHost: "foo.com"
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
new file mode 100644
index 000000000..f3dc12c5a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http2-route.yaml
@@ -0,0 +1,30 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  isHTTP2: true
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      name: "test"
+      exact: "foo/bar"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    queryParamMatches:
+    - name: "debug"
+      exact: "yes"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+        protocol: GRPC
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
new file mode 100644
index 000000000..299ea3241
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/http3.yaml
@@ -0,0 +1,34 @@
+http:
+- address: 0.0.0.0
+  http3:
+    quicPort: 443
+  hostnames:
+  - '*'
+  isHTTP2: false
+  name: envoy-gateway/gateway-1/tls
+  port: 10443
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - backendWeights:
+      invalid: 0
+      valid: 0
+    destination:
+      name: httproute/default/httproute-1/rule/0
+      settings:
+      - endpoints:
+        - host: 7.7.7.7
+          port: 8080
+        weight: 1
+    hostname: '*'
+    name: httproute/default/httproute-1/rule/0/match/0/*
+    pathMatch:
+      distinct: false
+      name: ""
+      prefix: /
+  tls:
+    certificates:
+    - name: envoy-gateway-tls-secret-1
+      privateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+      serverCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
new file mode 100644
index 000000000..ec101c8e8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-add-op-without-value.yaml
@@ -0,0 +1,45 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+    name: "first-listener"
+    operation:
+      op: "add"
+      path: "/virtual_hosts/0/rate_limits"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
new file mode 100644
index 000000000..09806682e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-listener.yaml
@@ -0,0 +1,37 @@
+jsonPatches:
+- type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+  name: "first-listener"
+  operation:
+    op: "add"
+    path: "/virtual_hosts/0/rate_limits"
+    value:
+    - actions:
+      - remote_address: {}
+- type: "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"
+  name: "first-route"
+  operation:
+    op: "replace"
+    path: "/endpoints/0/load_balancing_weight"
+    value: "50"
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
new file mode 100644
index 000000000..6224d909f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid-patch.yaml
@@ -0,0 +1,26 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
new file mode 100644
index 000000000..2d970ef21
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-invalid.yaml
@@ -0,0 +1,41 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.route.v3.RouteConfiguration"
+    name: "first-listener"
+    operation:
+      op: "add"
+      path: "/virtual_hosts/0/rate_limits"
+      value:
+      - actions:
+        - remote_address: {}
+  - type: "type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment"
+    name: "first-route"
+    operation:
+      op: "replace"
+      path: "/endpoints/0/load_balancing_weight"
+      value: "50"
+http:
+- name: "first-listener"
+  address: ""
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: ""
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
new file mode 100644
index 000000000..6224d909f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-missing-resource.yaml
@@ -0,0 +1,26 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
new file mode 100644
index 000000000..40ee65d1a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jsonpatch-move-op-with-value.yaml
@@ -0,0 +1,48 @@
+envoyPatchPolicies:
+- status: {}
+  name: "first-policy"
+  namespace: "default"
+  jsonPatches:
+  - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+    name: "first-listener"
+    operation:
+      op: "remove"
+      from: "/filter_chains/0/filters/0/typed_config/http_filters/0"
+      path: "/filter_chains/0/filters/0/typed_config/http_filters/1"
+      value:
+        test: "abc"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    headerMatches:
+    - name: user
+      stringMatch:
+      exact: "jason"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
new file mode 100644
index 000000000..2a362a469
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-custom-extractor.yaml
@@ -0,0 +1,36 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+        extractFrom:
+          cookies:
+          - session_access_token
+          headers:
+          - name: Authorization
+            valuePrefix: 'Bearer '
+          params:
+          - token
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
new file mode 100644
index 000000000..558049ed5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-multi-provider.yaml
@@ -0,0 +1,72 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route-www.test.com"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: http://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: one-route-example-key1
+          claim: claim.neteased.key
+      - name: example2
+        issuer: https://www.two.example.com
+        audiences:
+        - one.foo.com
+        - two.foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
+        recomputeRoute: true
+        claimToHeaders:
+        - header: one-route-example2-key1
+          claim: claim.neteased.key
+        - header: one-route-example2-key2
+          claim: name
+    destination:
+      name: "first-route-www.test.com-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-www.test.com"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/baz"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: http://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: second-route-example-key1
+          claim: claim.neteased.key
+      - name: example2
+        issuer: https://www.two.example.com
+        audiences:
+        - one.foo.com
+        - two.foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250:8080/jwt/public-key/jwks.json
+    destination:
+      name: "second-route-www.test.com-dest"
+      settings:
+      - endpoints:
+        - host: "5.6.7.8"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
new file mode 100644
index 000000000..7dd2a4b73
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-multi-route-single-provider.yaml
@@ -0,0 +1,52 @@
+accesslog:
+  text:
+  - path: "/dev/stdout"
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+        claimToHeaders:
+        - header: first-route-key
+          claim: claim.neteased.key
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/baz"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "5.6.7.8"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
new file mode 100644
index 000000000..9857cb58d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-ratelimit.yaml
@@ -0,0 +1,72 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - headerMatches:
+          - name: "x-user-id"
+            exact: "one"
+          limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://192.168.1.250/jwt/public-key/jwks.json
+  - name: "second-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - headerMatches:
+          - name: "x-user-id"
+            distinct: true
+          limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    rateLimit:
+      global:
+        rules:
+        - limit:
+            requests: 5
+            unit: second
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
new file mode 100644
index 000000000..4ff905bdc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/jwt-single-route-single-match.yaml
@@ -0,0 +1,28 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    jwt:
+      providers:
+      - name: example
+        issuer: https://www.example.com
+        audiences:
+        - foo.com
+        remoteJWKS:
+          uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
new file mode 100644
index 000000000..245099796
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-proxy-protocol.yaml
@@ -0,0 +1,32 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  enableProxyProtocol: true
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
new file mode 100644
index 000000000..1e4cdcdc5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/listener-tcp-keepalive.yaml
@@ -0,0 +1,66 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  tcpKeepalive: {}
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10081
+  hostnames:
+  - "foo.net"
+  tcpKeepalive:
+    probes: 7
+    interval: 200
+    idleTime: 50
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+tcp:
+- name: "third-listener"
+  address: "0.0.0.0"
+  port: 10082
+  tcpKeepalive: {}
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tls-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+- name: "fourth-listener"
+  address: "0.0.0.0"
+  tcpKeepalive:
+    probes: 10
+  port: 10083
+  destination:
+    name: "tcp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
new file mode 100644
index 000000000..fbf13ae88
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/load-balancer.yaml
@@ -0,0 +1,75 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    loadBalancer:
+      roundRobin: {}
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route"
+    hostname: "*"
+    loadBalancer:
+      random: {}
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route"
+    hostname: "*"
+    loadBalancer:
+      leastRequest: {}
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fourth-route"
+    hostname: "*"
+    loadBalancer:
+      consistentHash:
+        sourceIP: true
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "fifth-route"
+    hostname: "*"
+    loadBalancer:
+      leastRequest:
+        slowStart:
+          window: 60s
+    destination:
+      name: "fifth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "sixth-route"
+    hostname: "*"
+    loadBalancer:
+      roundRobin:
+        slowStart:
+          window: 300s
+    destination:
+      name: "sixth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
new file mode 100644
index 000000000..9e818b4d1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/local-ratelimit.yaml
@@ -0,0 +1,84 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route-ratelimit-single-rule"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+        rules:
+        - headerMatches:
+          - name: x-user-id
+            exact: one
+          - name: x-org-id
+            exact: foo
+          limit:
+            requests: 10
+            unit: Hour
+    pathMatch:
+      exact: "foo/bar"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-ratelimit-multiple-rules"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+        rules:
+        - headerMatches:
+          - name: x-user-id
+            exact: one
+          - name: x-org-id
+            exact: foo
+          limit:
+            requests: 10
+            unit: Hour
+        - cidrMatch:
+            cidr: 192.168.0.0/16
+            maskLen: 16
+          headerMatches:
+          - name: x-user-id
+            exact: two
+          - name: x-org-id
+            exact: bar
+          limit:
+            requests: 10
+            unit: Minute
+    pathMatch:
+      exact: "example"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route-ratelimit-no-rule"
+    hostname: "*"
+    rateLimit:
+      local:
+        default:
+          requests: 10
+          unit: Minute
+    pathMatch:
+      exact: "test"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
new file mode 100644
index 000000000..39f1a23dc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/metrics-virtual-host.yaml
@@ -0,0 +1,21 @@
+name: "metrics"
+metrics:
+  enableVirtualHostStats: true
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
new file mode 100644
index 000000000..36984ea69
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mixed-tls-jwt-authn.yaml
@@ -0,0 +1,35 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+  - name: first-listener
+    # byte slice representation of "cert-data"
+    serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+    # byte slice representation of "key-data"
+    privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo/bar"
+    requestAuthentication:
+      jwt:
+        providers:
+        - name: example
+          issuer: https://www.example.com
+          audiences:
+          - foo.com
+          remoteJWKS:
+            uri: https://localhost/jwt/public-key/jwks.json
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
new file mode 100644
index 000000000..bec261bee
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port-with-different-filters.yaml
@@ -0,0 +1,119 @@
+# This is a test file for multiple Gateway HTTP listeners on the same port with different filters.
+# These HTTP listeners should be merged into a single HTTP connection manager,
+# and the filters should be merged into the DefaultFilterChain of the HTTP connection manager.
+http:
+  - name: default/gateway-1/http
+    address: 0.0.0.0
+    hostnames:
+      - 'www.foo.com'
+    isHTTP2: false
+    http3:
+      quicPort: 443
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo1
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-1/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.1
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        basicAuth:
+          name: securitypolicy/default/policy-for-http-route-1
+          users: "dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo="
+      - name: httproute/default/httproute-2/rule/0/match/0/www_foo_com
+        hostname: www.foo.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /foo2
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-2/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.2
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        extAuth:
+          name: securitypolicy/default/policy-for-http-route-2
+          failOpen: true
+          http:
+            authority: http-backend.envoy-gateway:80
+            destination:
+              name: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+              settings:
+                - addressType: IP
+                  endpoints:
+                    - host: 7.7.7.7
+                      port: 80
+                  protocol: HTTP
+                  weight: 1
+            headersToBackend:
+              - header1
+              - header2
+            path: /auth
+  - name: default/gateway-2/http
+    address: 0.0.0.0
+    hostnames:
+      - 'www.bar.com'
+    isHTTP2: false
+    path:
+      escapedSlashesAction: UnescapeAndRedirect
+      mergeSlashes: true
+    port: 10080
+    routes:
+      - name: httproute/default/httproute-3/rule/0/match/0/www_bar_com
+        hostname: www.bar.com
+        isHTTP2: false
+        pathMatch:
+          distinct: false
+          name: ""
+          prefix: /bar
+        backendWeights:
+          invalid: 0
+          valid: 0
+        destination:
+          name: httproute/default/httproute-3/rule/0
+          settings:
+            - addressType: IP
+              endpoints:
+                - host: 192.168.1.3
+                  port: 8080
+              protocol: HTTP
+              weight: 1
+        oidc:
+          name: securitypolicy/default/policy-for-gateway-2
+          clientID: client.oauth.foo.com
+          clientSecret: Y2xpZW50MTpzZWNyZXQK
+          provider:
+            authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+            tokenEndpoint: https://oauth.foo.com/token
+          scopes:
+            - openid
+            - email
+            - profile
+          redirectURL: "https://www.example.com/foo/oauth2/callback"
+          redirectPath: "/foo/oauth2/callback"
+          logoutPath: "/foo/logout"
+          cookieSuffix: 5F93C2E4
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
new file mode 100644
index 000000000..fccf73d51
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-listeners-same-port.yaml
@@ -0,0 +1,116 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: first-listener
+      # byte slice representation of "cert-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "second-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.net"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: second-listener
+      # byte slice representation of "cert-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "second-route"
+    hostname: "*"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "third-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "example.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "third-route"
+    hostname: "*"
+    destination:
+      name: "third-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+- name: "fourth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "example.net"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "fourth-route"
+    hostname: "*"
+    destination:
+      name: "fourth-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+tcp:
+- name: "fifth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tcp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+- name: "sixth-listener"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - bar.net
+  destination:
+    name: "tls-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
new file mode 100644
index 000000000..fca8012cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/multiple-simple-tcp-route-same-port.yaml
@@ -0,0 +1,56 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-1"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-1-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-2"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-2-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-3"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-3-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tcp-route-simple-4"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-4-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
new file mode 100644
index 000000000..ea7ebf48a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/mutual-tls.yaml
@@ -0,0 +1,34 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    caCertificate:
+      name: ca-cert
+      certificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
new file mode 100644
index 000000000..b90a1c97f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/oidc.yaml
@@ -0,0 +1,58 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    pathMatch:
+      exact: "foo"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    oidc:
+      clientID: client.oauth.foo.com
+      clientSecret: Y2xpZW50MTpzZWNyZXQK
+      provider:
+        authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+        tokenEndpoint: https://oauth.foo.com/token
+      scopes:
+      - openid
+      - email
+      - profile
+      redirectURL: "https://www.example.com/foo/oauth2/callback"
+      redirectPath: "/foo/oauth2/callback"
+      logoutPath: "/foo/logout"
+      cookieSuffix: 5F93C2E4
+  - name: "second-route"
+    hostname: "*"
+    pathMatch:
+      exact: "bar"
+    destination:
+      name: "second-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+    oidc:
+      clientID: client.oauth.bar.com
+      clientSecret: Y2xpZW50MTpzZWNyZXQK
+      provider:
+        authorizationEndpoint: https://oauth.bar.com/oauth2/v2/auth
+        tokenEndpoint: https://oauth.bar.com/token
+      scopes:
+      - openid
+      - email
+      - profile
+      redirectURL: "https://www.example.com/bar/oauth2/callback"
+      redirectPath: "/bar/oauth2/callback"
+      logoutPath: "/bar/logout"
+      cookieSuffix: 5f93c2e4
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
new file mode 100644
index 000000000..1eddbaab2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/path-settings.yaml
@@ -0,0 +1,18 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: false
+    escapedSlashesAction: UnescapeAndForward
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
new file mode 100644
index 000000000..adf21ca8f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/proxy-protocol-upstream.yaml
@@ -0,0 +1,20 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    proxyProtocol:
+      version: "V2"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
new file mode 100644
index 000000000..7f5938fd6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/retry-partial-invalid.yaml
@@ -0,0 +1,54 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    retry:
+      numRetries: 5
+      retryOn:
+        httpStatusCodes:
+        - 429
+        - 503
+        triggers:
+        - reset
+        - connect-failure
+        - retriable-status-codes
+      perRetry:
+        timeout: 250ms
+        backoff:
+          baseInterval: 100ms
+          maxInterval: 10s
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "second-route-defaults"
+    hostname: "foo"
+    retry: {}
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
+  - name: "third-route-error"
+    hostname: "bar"
+    retry:
+      retryOn:
+        triggers:
+        - this-is-not-a-trigger
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
new file mode 100644
index 000000000..730902033
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/simple-tls.yaml
@@ -0,0 +1,31 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
new file mode 100644
index 000000000..f26d13b08
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/suppress-envoy-headers.yaml
@@ -0,0 +1,33 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "foo.com"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  tls:
+    alpnProtocols:
+    - h2
+    - http/1.1
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  headers:
+    enableEnvoyHeaders: true
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
new file mode 100644
index 000000000..05ac88669
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-complex.yaml
@@ -0,0 +1,18 @@
+tcp:
+- name: "tcp-route-complex"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+      - bar.com
+      - example.com
+  destination:
+    name: "tcp-route-complex-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
new file mode 100644
index 000000000..3885afa4f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid-endpoint.yaml
@@ -0,0 +1,11 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
new file mode 100644
index 000000000..d14b325d3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-invalid.yaml
@@ -0,0 +1,12 @@
+tcp:
+- name: "tcp-route-invalid"
+  address: ""
+  port: 10080
+  destination:
+    name: "tcp-route-invalid-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
new file mode 100644
index 000000000..f79cebf3e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-simple.yaml
@@ -0,0 +1,12 @@
+tcp:
+- name: "tcp-route-simple"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "tcp-route-simple-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
new file mode 100644
index 000000000..0bd68608b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-tls-terminate.yaml
@@ -0,0 +1,18 @@
+tcp:
+- name: "tls-terminate"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    terminate:
+      certificates:
+      - Name: envoy-gateway-tls-secret-1
+        PrivateKey: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
+        ServerCertificate: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+  destination:
+    name: "tls-terminate-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
new file mode 100644
index 000000000..0bd5ac621
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tcp-route-weighted-backend.yaml
@@ -0,0 +1,29 @@
+tcp:
+- name: "tcp-route-weighted-backend"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+      - bar.com
+      - example.com
+  destination:
+    name: "tcp-route-weighted-backend-dest"
+    settings:
+    - endpoints:
+      - host: "1.1.1.1"
+        port: 50001
+      weight: 20
+    - endpoints:
+      - host: "2.2.2.2"
+        port: 50002
+      weight: 40
+    - endpoints:
+      - host: "3.3.3.3"
+        port: 50003
+      weight: 20
+    - endpoints:
+      - host: "4.4.4.4"
+        port: 50004
+      weight: 20
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
new file mode 100644
index 000000000..daee154f0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/timeout.yaml
@@ -0,0 +1,24 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    timeout:
+      tcp:
+        connectTimeout: "31s"
+      http:
+        connectionIdleTimeout: "32s"
+        maxConnectionDuration: "33s"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
new file mode 100644
index 000000000..a798d00b8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-route-passthrough.yaml
@@ -0,0 +1,30 @@
+tcp:
+- name: "tls-passthrough-foo"
+  address: "0.0.0.0"
+  port: 10080
+  tls:
+    passthrough:
+      snis:
+      - foo.com
+  destination:
+    name: "tls-passthrough-foo-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
+- name: "tls-passthrough-bar"
+  address: "0.0.0.0"
+  port: 10081
+  tls:
+    passthrough:
+      snis:
+      - bar.com
+  destination:
+    name: "tls-passthrough-bar-dest"
+    settings:
+    - endpoints:
+      - host: "bar"
+        port: 50000
+      addressType: FQDN
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
new file mode 100644
index 000000000..c2dcb0302
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tls-with-ciphers-versions-alpn.yaml
@@ -0,0 +1,50 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  path:
+    escapedSlashesAction: UnescapeAndRedirect
+    mergeSlashes: true
+  port: 10080
+  hostnames:
+  - "foo.com"
+  tls:
+    ciphers:
+    - ECDHE-ECDSA-AES128-GCM-SHA256
+    - ECDHE-RSA-AES128-GCM-SHA256
+    - ECDHE-ECDSA-AES256-GCM-SHA384
+    - ECDHE-RSA-AES256-GCM-SHA384
+    ecdhCurves:
+    - X25519
+    - P-256
+    signatureAlgorithms:
+    - ecdsa_secp256r1_sha256
+    - rsa_pss_rsae_sha256
+    - rsa_pkcs1_sha256
+    - ecdsa_secp384r1_sha384
+    - rsa_pss_rsae_sha384
+    - rsa_pkcs1_sha384
+    - rsa_pss_rsae_sha512
+    - rsa_pkcs1_sha512
+    - rsa_pkcs1_sha1
+    maxVersion: "1.2"
+    minVersion: "1.0"
+    alpnProtocols:
+    - some-other-protocol
+    certificates:
+    - name: secret-1
+      # byte slice representation of "key-data"
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      # byte slice representation of "key-data"
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+    - name: secret-2
+      serverCertificate: [99, 101, 114, 116, 45, 100, 97, 116, 97]
+      privateKey: [107, 101, 121, 45, 100, 97, 116, 97]
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
new file mode 100644
index 000000000..d8b23c5d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing-invalid.yaml
@@ -0,0 +1,43 @@
+name: "tracing"
+tracing:
+  serviceName: "fake-name.fake-ns"
+  samplingRate: 90
+  customTags:
+    "literal1":
+      type: Literal
+      literal:
+        value: "value1"
+    "env1":
+      type: Environment
+      environment:
+        name: "env1"
+        defaultValue: "-"
+    "req1":
+      type: RequestHeader
+      requestHeader:
+        name: "X-Request-Id"
+        defaultValue: "-"
+  provider:
+    host: ""
+    port: 4317
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "direct-route"
+        hostname: "*"
+        destination:
+          name: "direct-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+        directResponse:
+          body: "Unknown custom filter type: UnsupportedType"
+          statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
new file mode 100644
index 000000000..d67ab2d01
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/tracing.yaml
@@ -0,0 +1,43 @@
+name: "tracing"
+tracing:
+  serviceName: "fake-name.fake-ns"
+  samplingRate: 90
+  customTags:
+    "literal1":
+      type: Literal
+      literal:
+        value: "value1"
+    "env1":
+      type: Environment
+      environment:
+        name: "env1"
+        defaultValue: "-"
+    "req1":
+      type: RequestHeader
+      requestHeader:
+        name: "X-Request-Id"
+        defaultValue: "-"
+  provider:
+    host: otel-collector.monitoring.svc.cluster.local
+    port: 4317
+http:
+  - name: "first-listener"
+    address: "0.0.0.0"
+    port: 10080
+    hostnames:
+      - "*"
+    path:
+      mergeSlashes: true
+      escapedSlashesAction: UnescapeAndRedirect
+    routes:
+      - name: "direct-route"
+        hostname: "*"
+        destination:
+          name: "direct-route-dest"
+          settings:
+            - endpoints:
+                - host: "1.2.3.4"
+                  port: 50000
+        directResponse:
+          body: "Unknown custom filter type: UnsupportedType"
+          statusCode: 500
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
new file mode 100644
index 000000000..39ab4e7f4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route-invalid.yaml
@@ -0,0 +1,10 @@
+udp:
+- name: "udp-route"
+  port: 10080
+  destination:
+    name: "udp-reoute-dest"
+    settings:
+    - endpoints:
+      - host: ""
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
new file mode 100644
index 000000000..fa4ffafc1
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/udp-route.yaml
@@ -0,0 +1,12 @@
+udp:
+- name: "udp-route"
+  address: "0.0.0.0"
+  port: 10080
+  destination:
+    name: "udp-route-dest"
+    settings:
+    - endpoints:
+      - host: "1.2.3.4"
+        port: 50000
+      - host: "5.6.7.8"
+        port: 50001
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
new file mode 100644
index 000000000..bb7febec8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/in/xds-ir/upstream-tcpkeepalive.yaml
@@ -0,0 +1,22 @@
+http:
+- name: "first-listener"
+  address: "0.0.0.0"
+  port: 10080
+  hostnames:
+  - "*"
+  path:
+    mergeSlashes: true
+    escapedSlashesAction: UnescapeAndRedirect
+  routes:
+  - name: "first-route"
+    hostname: "*"
+    tcpKeepalive:
+      idleTime: 1200
+      interval: 60
+      probes: 3
+    destination:
+      name: "first-route-dest"
+      settings:
+      - endpoints:
+        - host: "1.2.3.4"
+          port: 50000
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
new file mode 100644
index 000000000..716815648
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.clusters.yaml
@@ -0,0 +1,49 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: otel-collector.default.svc.cluster.local
+              portValue: 4317
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: accesslog|otel-collector.default.svc.cluster.local|4317/backend/0
+  name: accesslog|otel-collector.default.svc.cluster.local|4317
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
new file mode 100644
index 000000000..21e2c2f66
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.listeners.yaml
@@ -0,0 +1,143 @@
+- accessLog:
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      logFormat:
+        textFormatSource:
+          inlineString: |
+            [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+      path: /dev/stdout
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.file
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+      logFormat:
+        jsonFormat:
+          method: '%REQ(:METHOD)%'
+          path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+          protocol: '%PROTOCOL%'
+          response_code: '%RESPONSE_CODE%'
+          start_time: '%START_TIME%'
+      path: /dev/stdout
+  - filter:
+      responseFlagFilter:
+        flags:
+        - NR
+    name: envoy.access_loggers.open_telemetry
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+      attributes:
+        values:
+        - key: k8s.namespace.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+        - key: k8s.pod.name
+          value:
+            stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+        - key: response_code
+          value:
+            stringValue: '%RESPONSE_CODE%'
+      body:
+        stringValue: |
+          [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+      commonConfig:
+        grpcService:
+          envoyGrpc:
+            authority: otel-collector.default.svc.cluster.local
+            clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+        logName: otel_envoy_accesslog
+        transportApiVersion: V3
+      resourceAttributes:
+        values:
+        - key: cluster_name
+          value:
+            stringValue: cluster1
+  address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        accessLog:
+        - name: envoy.access_loggers.file
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            logFormat:
+              textFormatSource:
+                inlineString: |
+                  [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+            path: /dev/stdout
+        - name: envoy.access_loggers.file
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            logFormat:
+              jsonFormat:
+                method: '%REQ(:METHOD)%'
+                path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+                protocol: '%PROTOCOL%'
+                response_code: '%RESPONSE_CODE%'
+                start_time: '%START_TIME%'
+            path: /dev/stdout
+        - name: envoy.access_loggers.open_telemetry
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig
+            attributes:
+              values:
+              - key: k8s.namespace.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_GATEWAY_NAMESPACE)%'
+              - key: k8s.pod.name
+                value:
+                  stringValue: '%ENVIRONMENT(ENVOY_POD_NAME)%'
+              - key: response_code
+                value:
+                  stringValue: '%RESPONSE_CODE%'
+            body:
+              stringValue: |
+                [%START_TIME%] "%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%" %RESPONSE_CODE% %RESPONSE_FLAGS% %BYTES_RECEIVED% %BYTES_SENT% %DURATION% %RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)% "%REQ(X-FORWARDED-FOR)%" "%REQ(USER-AGENT)%" "%REQ(X-REQUEST-ID)%" "%REQ(:AUTHORITY)%" "%UPSTREAM_HOST%"
+            commonConfig:
+              grpcService:
+                envoyGrpc:
+                  authority: otel-collector.default.svc.cluster.local
+                  clusterName: accesslog|otel-collector.default.svc.cluster.local|4317
+              logName: otel_envoy_accesslog
+              transportApiVersion: V3
+            resourceAttributes:
+              values:
+              - key: cluster_name
+                value:
+                  stringValue: cluster1
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/accesslog.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
new file mode 100644
index 000000000..6fd92310d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
@@ -0,0 +1,39 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.basic_auth_first-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
new file mode 100644
index 000000000..f87be1147
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/basic-auth.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.basic_auth_first-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
new file mode 100644
index 000000000..90636e8ff
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.clusters.yaml
@@ -0,0 +1,27 @@
+- circuitBreakers:
+    thresholds:
+    - maxConnections: 1
+      maxPendingRequests: 1
+      maxRequests: 1
+      maxRetries: 2
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      commonHttpProtocolOptions:
+        maxRequestsPerConnection: 10
+      explicitHttpConfig:
+        httpProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
new file mode 100644
index 000000000..af7af6027
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
@@ -0,0 +1,34 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        requestTimeout: 5s
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/client-timeout.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
new file mode 100644
index 000000000..624c74704
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.cors
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.Cors
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
new file mode 100644
index 000000000..f77625786
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/cors.routes.yaml
@@ -0,0 +1,26 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.cors:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy
+          allowCredentials: true
+          allowHeaders: x-header-1, x-header-2
+          allowMethods: GET, POST
+          allowOriginStringMatch:
+          - safeRegex:
+              regex: '*.example.com'
+          - exact: foo.bar.com
+          exposeHeaders: x-header-3, x-header-4
+          maxAge: "1000"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.clusters.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.endpoints.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.listeners.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/empty.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
new file mode 100644
index 000000000..d02aa6b4a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.clusters.yaml
@@ -0,0 +1,73 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-first-route/http-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-first-route/http-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-second-route/grpc-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-second-route/grpc-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
new file mode 100644
index 000000000..ce53193cd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.0.0.1
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: httproute/default/httproute-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.0.0.2
+            portValue: 60000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: securitypolicy/default/policy-for-first-route/http-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 80
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-first-route/http-backend/backend/0
+- clusterName: securitypolicy/default/policy-for-second-route/grpc-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 9000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-second-route/grpc-backend/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
new file mode 100644
index 000000000..0913264d9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
@@ -0,0 +1,63 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-first-route/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            allowedHeaders:
+              patterns:
+              - exact: header1
+              - exact: header2
+            grpcService:
+              envoyGrpc:
+                authority: grpc-backend.default:9000
+                clusterName: securitypolicy/default/policy-for-second-route/grpc-backend
+              timeout: 10s
+            transportApiVersion: V3
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
new file mode 100644
index 000000000..0b039af3d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
@@ -0,0 +1,29 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo
+      name: httproute/default/httproute-1/rule/0/match/0/www_example_com
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        path: bar
+      name: httproute/default/httproute-2/rule/0/match/0/www_example_com
+      route:
+        cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
new file mode 100644
index 000000000..03e10ccd7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.clusters.yaml
@@ -0,0 +1,85 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
new file mode 100644
index 000000000..b93d9b43b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.endpoints.yaml
@@ -0,0 +1,60 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
new file mode 100644
index 000000000..ff6bf7f2a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.fault
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
new file mode 100644
index 000000000..1f093f5a0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/fault-injection.routes.yaml
@@ -0,0 +1,84 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            httpStatus: 500
+            percentage:
+              denominator: MILLION
+              numerator: 100
+    - match:
+        path: example
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          delay:
+            fixedDelay: 5.400s
+            percentage:
+              denominator: MILLION
+              numerator: 800000
+    - match:
+        path: test
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            httpStatus: 500
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+          delay:
+            fixedDelay: 5.005s
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+    - match:
+        path: test
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.fault:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
+          abort:
+            grpcStatus: 14
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+          delay:
+            fixedDelay: 5.005s
+            percentage:
+              denominator: MILLION
+              numerator: 1000000
+    - match:
+        path: test
+      name: fifth-route
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
new file mode 100644
index 000000000..b789b876c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.clusters.yaml
@@ -0,0 +1,141 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  healthChecks:
+  - healthyThreshold: 1
+    httpHealthCheck:
+      expectedStatuses:
+      - end: "201"
+        start: "200"
+      - end: "301"
+        start: "300"
+      host: '*'
+      path: /healthz
+      receive:
+      - text: 6f6b
+    interval: 3s
+    timeout: 0.500s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 2s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    httpHealthCheck:
+      expectedStatuses:
+      - end: "202"
+        start: "200"
+      host: '*'
+      path: /healthz
+      receive:
+      - binary: cG9uZw==
+    interval: 5s
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    interval: 5s
+    tcpHealthCheck:
+      receive:
+      - text: 706f6e67
+      send:
+        text: "70696e67"
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection:
+    baseEjectionTime: 160s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 100
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  healthChecks:
+  - healthyThreshold: 3
+    interval: 5s
+    tcpHealthCheck:
+      receive:
+      - binary: cG9uZw==
+      send:
+        binary: cGluZw==
+    timeout: 1s
+    unhealthyThreshold: 3
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection:
+    baseEjectionTime: 180s
+    consecutive5xx: 5
+    consecutiveGatewayFailure: 0
+    consecutiveLocalOriginFailure: 5
+    interval: 1s
+    maxEjectionPercent: 90
+    splitExternalLocalOriginErrors: true
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
new file mode 100644
index 000000000..f185af17d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
new file mode 100644
index 000000000..de4249178
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/health-check.routes.yaml
@@ -0,0 +1,35 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
new file mode 100644
index 000000000..f0ea3b323
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-direct-response.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
new file mode 100644
index 000000000..876e1084c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.clusters.yaml
@@ -0,0 +1,33 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: first-route-dest
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: foo.bar
+              portValue: 50000
+        loadBalancingWeight: 1
+      - endpoint:
+          address:
+            socketAddress:
+              address: bar.foo
+              portValue: 50001
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: first-route-dest/backend/0
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.endpoints.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
new file mode 100644
index 000000000..c27e2ea57
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
new file mode 100644
index 000000000..53d1f9a7c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-dest
+  lbPolicy: LEAST_REQUEST
+  name: route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
new file mode 100644
index 000000000..43cba2e79
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
new file mode 100644
index 000000000..c5a187d2c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: mirror-route
+      route:
+        cluster: route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
new file mode 100644
index 000000000..0322cbb61
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.clusters.yaml
@@ -0,0 +1,119 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: sixth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: sixth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: seventh-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: seventh-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
new file mode 100644
index 000000000..3787880a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.endpoints.yaml
@@ -0,0 +1,84 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 8.8.8.8
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
+- clusterName: sixth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: sixth-route-dest/backend/0
+- clusterName: seventh-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: seventh-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
new file mode 100644
index 000000000..25584aa3a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
@@ -0,0 +1,80 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - example.com
+    name: first-listener/example_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /v1/example
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: envoy-gateway/httproute-2/rule/0/match/0/example.com
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        pathSeparatedPrefix: /v1/example
+      name: envoy-gateway/httproute-3/rule/0/match/0/example.com
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - example.net
+    name: first-listener/example_net
+    routes:
+    - match:
+        headers:
+        - name: version
+          stringMatch:
+            exact: one
+        pathSeparatedPrefix: /v1/status
+      name: envoy-gateway/httproute-4/rule/0/match/0/example.net
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        pathSeparatedPrefix: /v1/status
+      name: envoy-gateway/httproute-5/rule/0/match/0/example.net
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*.com'
+    name: first-listener/*_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo
+      name: envoy-gateway/httproute-1/rule/0/match/0/*.com
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*.net'
+    name: first-listener/*_net
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo
+      name: envoy-gateway/httproute-1/rule/0/match/0/*.net
+      route:
+        cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: envoy-gateway/httproute-1/rule/0/match/0/*
+      route:
+        cluster: seventh-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
new file mode 100644
index 000000000..046021604
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.clusters.yaml
@@ -0,0 +1,51 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: route-dest
+  lbPolicy: LEAST_REQUEST
+  name: route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: mirror-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: mirror-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: mirror-route-dest1
+  lbPolicy: LEAST_REQUEST
+  name: mirror-route-dest1
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
new file mode 100644
index 000000000..f741af39c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.endpoints.yaml
@@ -0,0 +1,36 @@
+- clusterName: route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: route-dest/backend/0
+- clusterName: mirror-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.3.4.5
+            portValue: 0
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: mirror-route-dest/backend/0
+- clusterName: mirror-route-dest1
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.4.5.6
+            portValue: 0
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: mirror-route-dest1/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
new file mode 100644
index 000000000..f46cc50eb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
@@ -0,0 +1,17 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: mirror-route
+      route:
+        cluster: route-dest
+        requestMirrorPolicies:
+        - cluster: mirror-route-dest
+        - cluster: mirror-route-dest1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
new file mode 100644
index 000000000..614968177
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: valid-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: valid-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
new file mode 100644
index 000000000..4fdb0384f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: valid-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: valid-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
new file mode 100644
index 000000000..61face5a3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
@@ -0,0 +1,43 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: valid-route
+      route:
+        cluster: valid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: invalid-route
+      route:
+        cluster: invalid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
new file mode 100644
index 000000000..b435363be
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: redirect-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: redirect-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
new file mode 100644
index 000000000..7543b702f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: redirect-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: redirect-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
new file mode 100644
index 000000000..d2c46435e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-redirect.routes.yaml
@@ -0,0 +1,32 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: redirect-route-1
+      redirect:
+        hostRedirect: redirected.com
+        portRedirect: 8443
+        prefixRewrite: /redirected
+        responseCode: FOUND
+        schemeRedirect: https
+    - match:
+        pathSeparatedPrefix: /redirect
+      name: redirect-route-2
+      redirect:
+        regexRewrite:
+          pattern:
+            regex: ^/redirect\/*
+          substitution: /
+    - match:
+        pathSeparatedPrefix: /redirect
+      name: redirect-route-3
+      redirect:
+        regexRewrite:
+          pattern:
+            regex: ^/redirect/\/*
+          substitution: /
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
new file mode 100644
index 000000000..0f75e67e2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: regex-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: regex-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
new file mode 100644
index 000000000..b36ee4500
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: regex-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: regex-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
new file mode 100644
index 000000000..7bc7d162a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
@@ -0,0 +1,25 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: re_header
+          stringMatch:
+            safeRegex:
+              regex: .*
+        queryParameters:
+        - name: re_query
+          stringMatch:
+            safeRegex:
+              regex: .*
+        safeRegex:
+          regex: /v1/.*
+      name: regex-route
+      route:
+        cluster: regex-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
new file mode 100644
index 000000000..2adb8e01e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: request-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: request-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
new file mode 100644
index 000000000..846a89074
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: request-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: request-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
new file mode 100644
index 000000000..f91a70cb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
@@ -0,0 +1,36 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: request-header-route
+      requestHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      requestHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: request-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
new file mode 100644
index 000000000..b2241a118
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
@@ -0,0 +1,33 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
new file mode 100644
index 000000000..b09594aec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
@@ -0,0 +1,36 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToAdd:
+      - header:
+          key: some-header
+          value: some-value
+      - header:
+          key: some-header-2
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header3
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: some-header4
+          value: some-value
+      - appendAction: OVERWRITE_IF_EXISTS_OR_ADD
+        header:
+          key: empty-header
+        keepEmptyValue: true
+      responseHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
new file mode 100644
index 000000000..ca020e482
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: response-header-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: response-header-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
new file mode 100644
index 000000000..d21491f62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: response-header-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: response-header-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
new file mode 100644
index 000000000..58a4e2720
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
@@ -0,0 +1,17 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: response-header-route
+      responseHeadersToRemove:
+      - some-header5
+      - some-header6
+      route:
+        cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
new file mode 100644
index 000000000..d5a0bd989
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.routes.yaml
@@ -0,0 +1,22 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route-dest
+        regexRewrite:
+          pattern:
+            regex: ^/origin/\/*
+          substitution: /
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
new file mode 100644
index 000000000..3a2b7308d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
new file mode 100644
index 000000000..ca1ef21c9
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
new file mode 100644
index 000000000..f8b81712d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route
+        regexRewrite:
+          pattern:
+            regex: /.+
+          substitution: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
new file mode 100644
index 000000000..680a67404
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-host.routes.yaml
@@ -0,0 +1,21 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        appendXForwardedHost: true
+        cluster: rewrite-route-dest
+        hostRewriteLiteral: 3.3.3.3
+        prefixRewrite: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
new file mode 100644
index 000000000..027db39fb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: rewrite-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: rewrite-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
new file mode 100644
index 000000000..256dda090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: rewrite-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: rewrite-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
new file mode 100644
index 000000000..84bc70f04
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.routes.yaml
@@ -0,0 +1,19 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - gateway.envoyproxy.io
+    name: first-listener/gateway_envoyproxy_io
+    routes:
+    - match:
+        headers:
+        - name: :authority
+          stringMatch:
+            exact: gateway.envoyproxy.io
+        pathSeparatedPrefix: /origin
+      name: rewrite-route
+      route:
+        cluster: rewrite-route-dest
+        prefixRewrite: /rewrite
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
new file mode 100644
index 000000000..a89644e62
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.clusters.yaml
@@ -0,0 +1,51 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
new file mode 100644
index 000000000..42a346c40
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.endpoints.yaml
@@ -0,0 +1,36 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
new file mode 100644
index 000000000..23d2bf4b7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
@@ -0,0 +1,38 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        idleTimeout: 3600s
+        timeout: 5s
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        idleTimeout: 4000s
+        timeout: 4000s
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        idleTimeout: 0s
+        timeout: 0s
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
new file mode 100644
index 000000000..f5633bd15
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.endpoints.yaml
@@ -0,0 +1,42 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.1.1.1
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.2.2.2
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 40
+    locality:
+      region: first-route-dest/backend/1
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.3.3.3
+            portValue: 50003
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/2
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 4.4.4.4
+            portValue: 50004
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: first-route-dest/backend/3
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
new file mode 100644
index 000000000..235dea427
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
@@ -0,0 +1,20 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        upgradeConfigs:
+        - upgradeType: websocket
+        weightedClusters:
+          clusters:
+          - name: invalid-backend-cluster
+            weight: 1
+          - name: first-route-dest
+            weight: 1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
new file mode 100644
index 000000000..2c908f7ef
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.clusters.yaml
@@ -0,0 +1,13 @@
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route
+  name: first-route
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
new file mode 100644
index 000000000..9f0e050cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-stripped-host-port.listeners.yaml
@@ -0,0 +1,30 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        upgradeConfigs:
+        - upgradeType: websocket
+        useRemoteAddress: true
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
new file mode 100644
index 000000000..670a5464e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.clusters.yaml
@@ -0,0 +1,30 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContext:
+            trustedCa:
+              filename: /etc/ssl/certs/ca-certificates.crt
+        sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
new file mode 100644
index 000000000..3d0e81607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.endpoints.yaml
@@ -0,0 +1,16 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
new file mode 100644
index 000000000..0f95e32bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
new file mode 100644
index 000000000..bd4f9cfe7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
new file mode 100755
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tls-system-truststore.secrets.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
new file mode 100755
index 000000000..8a7225b4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.clusters.yaml
@@ -0,0 +1,94 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: bar.example.com
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: example.com
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    transportSocket:
+      name: envoy.transport_sockets.upstream_proxy_protocol
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+        config:
+          version: V2
+        transportSocket:
+          name: envoy.transport_sockets.tls
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+            commonTlsContext:
+              validationContextSdsSecretConfig:
+                name: policy-btls-2/policies-ca
+                sdsConfig:
+                  ads: {}
+                  resourceApiVersion: V3
+            sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
new file mode 100755
index 000000000..94a0deb06
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.endpoints.yaml
@@ -0,0 +1,56 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.12
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/1
+- clusterName: httproute/envoy-gateway/httproute-btls-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.12
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls-2/rule/0/tls/1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls-2/rule/0/backend/1
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
new file mode 100755
index 000000000..8e0e6200c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.listeners.yaml
@@ -0,0 +1,66 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls-2/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls-2/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
new file mode 100755
index 000000000..1d716e5c2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls-2/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls-2/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls-2/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
new file mode 100755
index 000000000..6e227be87
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle-multiple-certs.secrets.yaml
@@ -0,0 +1,12 @@
+- name: policy-btls/policies-ca2
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- name: policy-btls/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+- name: policy-btls-2/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
new file mode 100644
index 000000000..695386bb2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.clusters.yaml
@@ -0,0 +1,32 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/envoy-gateway/httproute-btls/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/envoy-gateway/httproute-btls/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocketMatches:
+  - match:
+      name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+        commonTlsContext:
+          validationContextSdsSecretConfig:
+            name: policy-btls/policies-ca
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        sni: example.com
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
new file mode 100644
index 000000000..3d0e81607
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.endpoints.yaml
@@ -0,0 +1,16 @@
+- clusterName: httproute/envoy-gateway/httproute-btls/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 10.244.0.11
+            portValue: 8080
+      loadBalancingWeight: 1
+      metadata:
+        filterMetadata:
+          envoy.transport_socket_match:
+            name: httproute/envoy-gateway/httproute-btls/rule/0/tls/0
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/envoy-gateway/httproute-btls/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
new file mode 100644
index 000000000..0f95e32bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-btls/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: envoy-gateway/gateway-btls/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
new file mode 100644
index 000000000..bd4f9cfe7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-btls/http
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-btls/http/*
+    routes:
+    - match:
+        path: /exact
+      name: httproute/envoy-gateway/httproute-btls/rule/0/match/0/*
+      route:
+        cluster: httproute/envoy-gateway/httproute-btls/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
new file mode 100644
index 000000000..be757009c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route-with-tlsbundle.secrets.yaml
@@ -0,0 +1,4 @@
+- name: policy-btls/policies-ca
+  validationContext:
+    trustedCa:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURKekNDQWcrZ0F3SUJBZ0lVQWw2VUtJdUttenRlODFjbGx6NVBmZE4ySWxJd0RRWUpLb1pJaHZjTkFRRUwKQlFBd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHQTFVRUNnd0dhM1ZpWldSaU1CNFhEVEl6TVRBdwpNakExTkRFMU4xb1hEVEkwTVRBd01UQTFOREUxTjFvd0l6RVFNQTRHQTFVRUF3d0hiWGxqYVdWdWRERVBNQTBHCkExVUVDZ3dHYTNWaVpXUmlNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXdTVGMKMXlqOEhXNjJueW5rRmJYbzRWWEt2MmpDMFBNN2RQVmt5ODdGd2VaY1RLTG9XUVZQUUUycDJrTERLNk9Fc3ptTQp5eXIreHhXdHlpdmVyZW1yV3FuS2tOVFloTGZZUGhnUWtjemliN2VVYWxtRmpVYmhXZEx2SGFrYkVnQ29kbjNiCmt6NTdtSW5YMlZwaURPS2c0a3lIZml1WFdwaUJxckN4MEtOTHB4bzNERVFjRmNzUVRlVEh6aDQ3NTJHVjA0UlUKVGkvR0VXeXpJc2w0Umc3dEd0QXdtY0lQZ1VOVWZZMlEzOTBGR3FkSDRhaG4rbXcvNmFGYlczMVc2M2Q5WUpWcQppb3lPVmNhTUlwTTVCL2M3UWM4U3VoQ0kxWUdoVXlnNGNSSExFdzVWdGlraW95RTNYMDRrbmEzalFBajU0WWJSCmJwRWhjMzVhcEtMQjIxSE9VUUlEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVeXZsMFZJNXZKVlN1WUZYdTdCNDgKNlBiTUVBb3dId1lEVlIwakJCZ3dGb0FVeXZsMFZJNXZKVlN1WUZYdTdCNDg2UGJNRUFvd0R3WURWUjBUQVFILwpCQVV3QXdFQi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUFNTHhyZ0ZWTXVOUnEyd0F3Y0J0N1NuTlI1Q2Z6CjJNdlhxNUVVbXVhd0lVaTlrYVlqd2RWaURSRUdTams3SlcxN3ZsNTc2SGpEa2RmUndpNEUyOFN5ZFJJblpmNkoKaThIWmNaN2NhSDZEeFIzMzVmZ0hWekxpNU5pVGNlL09qTkJRelEyTUpYVkRkOERCbUc1ZnlhdEppT0pRNGJXRQpBN0ZsUDBSZFAzQ08zR1dFME01aVhPQjJtMXFXa0UyZXlPNFVIdndUcU5RTGRyZEFYZ0RRbGJhbTllNEJHM0dnCmQvNnRoQWtXRGJ0L1FOVCtFSkhEQ3ZoRFJLaDFSdUdIeWcrWSsvbmViVFdXckZXc2t0UnJiT29IQ1ppQ3BYSTEKM2VYRTZudDBZa2d0RHhHMjJLcW5ocEFnOWdVU3MyaGxob3h5dmt6eUYwbXU2TmhQbHdBZ25xNysvUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
new file mode 100644
index 000000000..7030f6f4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http-route.routes.yaml
@@ -0,0 +1,25 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        - name: test
+          stringMatch:
+            suffix: end
+        prefix: /
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
new file mode 100644
index 000000000..1489e95f6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.clusters.yaml
@@ -0,0 +1,55 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          enableTrailers: true
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
new file mode 100644
index 000000000..28a57caf3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.5
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
new file mode 100644
index 000000000..b3b279d84
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
@@ -0,0 +1,79 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          enableTrailers: true
+          headerKeyFormat:
+            statefulFormatter:
+              name: preserve_case
+              typedConfig:
+                '@type': type.googleapis.com/envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: second-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
new file mode 100644
index 000000000..ff93cfff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
new file mode 100644
index 000000000..8c3dd7a54
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.clusters.yaml
@@ -0,0 +1,23 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          enableTrailers: true
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
new file mode 100644
index 000000000..06b72b5ac
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
@@ -0,0 +1,35 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          enableTrailers: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
new file mode 100644
index 000000000..2cb022cfa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.clusters.yaml
@@ -0,0 +1,24 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        httpProtocolOptions:
+          acceptHttp10: true
+          defaultHostForHttp10: foo.com
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
new file mode 100644
index 000000000..ebd95e6e6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.listeners.yaml
@@ -0,0 +1,36 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        httpProtocolOptions:
+          acceptHttp10: true
+          defaultHostForHttp10: foo.com
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http10.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
new file mode 100644
index 000000000..6086cfbb8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.clusters.yaml
@@ -0,0 +1,22 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
new file mode 100644
index 000000000..f88559717
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.listeners.yaml
@@ -0,0 +1,41 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.grpc_web
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_web.v3.GrpcWeb
+        - name: envoy.filters.http.grpc_stats
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.grpc_stats.v3.FilterConfig
+            emitFilterState: true
+            statsForAllMethods: true
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
new file mode 100644
index 000000000..a32852fcd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http2-route.routes.yaml
@@ -0,0 +1,22 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        path: foo/bar
+        queryParameters:
+        - name: debug
+          stringMatch:
+            exact: "yes"
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
new file mode 100644
index 000000000..9714612e3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
new file mode 100644
index 000000000..29bb6b4e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
new file mode 100644
index 000000000..277b2065a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.listeners.yaml
@@ -0,0 +1,99 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10443
+      protocol: UDP
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        codecType: HTTP3
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        http3ProtocolOptions: {}
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-1/tls
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.quic
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport
+        downstreamTlsContext:
+          commonTlsContext:
+            alpnProtocols:
+            - h2
+            - http/1.1
+            - h3
+            tlsCertificateSdsSecretConfigs:
+            - name: envoy-gateway-tls-secret-1
+              sdsConfig:
+                ads: {}
+                resourceApiVersion: V3
+  name: envoy-gateway/gateway-1/tls-quic
+  udpListenerConfig:
+    downstreamSocketConfig: {}
+    quicOptions: {}
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10443
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: envoy-gateway/gateway-1/tls
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: envoy-gateway-tls-secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: envoy-gateway/gateway-1/tls
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
new file mode 100644
index 000000000..f3e513cea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.routes.yaml
@@ -0,0 +1,19 @@
+- ignorePortInHostMatching: true
+  name: envoy-gateway/gateway-1/tls
+  virtualHosts:
+  - domains:
+    - '*'
+    name: envoy-gateway/gateway-1/tls/*
+    routes:
+    - match:
+        prefix: /
+      name: httproute/default/httproute-1/rule/0/match/0/*
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
new file mode 100644
index 000000000..d4d502ac0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/http3.secrets.yaml
@@ -0,0 +1,6 @@
+- name: envoy-gateway-tls-secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNxRENDQVpBQ0NRREVNZ1lZblFyQ29EQU5CZ2txaGtpRzl3MEJBUXNGQURBV01SUXdFZ1lEVlFRRERBdG0KYjI4dVltRnlMbU52YlRBZUZ3MHlNekF4TURVeE16UXpNalJhRncweU5EQXhNRFV4TXpRek1qUmFNQll4RkRBUwpCZ05WQkFNTUMyWnZieTVpWVhJdVkyOXRNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDCkFRRUFuZEh6d21wS2NUSUViamhGZ2RXd1RSTjc1Y3A4b3VsWnhMMUdydlI2SXc3ejdqaTBSNFcvTm85bkdmOU0KWVAyQ1JqaXN6NTFtd3hTeGVCcm9jTGVBK21reGkxK2lEdk5kQytyU0x4MTN6RUxTQ25xYnVzUHM3bUdmSlpxOAo5TGhlbmx5bzQzaDVjYTZINUxqTXd1L1JHVWlGMzFYck5yaVlGQlB2RTJyQitkd24vTkVrUTRoOFJxcXlwcmtuCkYvcWM5Sk1ZQVlGRld1VkNwa0lFbmRYMUN5dlFOT2FkZmN2cmd6dDV2SmwwT2kxQWdyaU5hWGJFUEdudWY3STQKcXBCSEdVWE5lMVdsOVdlVklxS1g0T2FFWERWQzZGQzdHOHptZWVMVzFBa1lFVm5pcFg2b1NCK0JjL1NIVlZOaApzQkxSbXRuc3pmTnRUMlFyZCttcGt4ODBaUUlEQVFBQk1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQ1VKOElDCkJveUVqT3V3enBHYVJoR044QjRqT1B6aHVDT0V0ZDM3UzAybHUwN09IenlCdmJzVEd6S3dCZ0x5bVdmR2tINEIKajdDTHNwOEZ6TkhLWnVhQmdwblo5SjZETE9Od2ZXZTJBWXA3TGRmT0tWQlVkTVhRaU9tN2pKOUhob0Ntdk1ONwpic2pjaFdKb013ckZmK3dkQUthdHowcUFQeWhMeWUvRnFtaVZ4a09SWmF3K1Q5bURaK0g0OXVBU2d1SnVOTXlRClY2RXlYNmd0Z1dxMzc2SHZhWE1TLzNoYW1Zb1ZXWEk1TXhpUE9ZeG5BQmtKQjRTQ2dJUmVqYkpmVmFRdG9RNGEKejAyaVVMZW5ESUllUU9Zb2JLY01CWGYxQjRQQVFtc2VocVZJYnpzUUNHaTU0VkRyczZiWmQvN0pzMXpDcHBncwpKaUQ1SXFNaktXRHdxN2FLCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
+    privateKey:
+      inlineBytes: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2UUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktjd2dnU2pBZ0VBQW9JQkFRQ2QwZlBDYWtweE1nUnUKT0VXQjFiQk5FM3ZseW55aTZWbkV2VWF1OUhvakR2UHVPTFJIaGI4MmoyY1ovMHhnL1lKR09LelBuV2JERkxGNApHdWh3dDRENmFUR0xYNklPODEwTDZ0SXZIWGZNUXRJS2VwdTZ3K3p1WVo4bG1yejB1RjZlWEtqamVIbHhyb2ZrCnVNekM3OUVaU0lYZlZlczJ1SmdVRSs4VGFzSDUzQ2Y4MFNSRGlIeEdxckttdVNjWCtwejBreGdCZ1VWYTVVS20KUWdTZDFmVUxLOUEwNXAxOXkrdURPM204bVhRNkxVQ0N1STFwZHNROGFlNS9zamlxa0VjWlJjMTdWYVgxWjVVaQpvcGZnNW9SY05VTG9VTHNiek9aNTR0YlVDUmdSV2VLbGZxaElINEZ6OUlkVlUyR3dFdEdhMmV6TjgyMVBaQ3QzCjZhbVRIelJsQWdNQkFBRUNnZ0VBWTFGTUlLNDVXTkVNUHJ6RTZUY3NNdVV2RkdhQVZ4bVk5NW5SMEtwajdvb3IKY21CVys2ZXN0TTQ4S1AwaitPbXd3VFpMY29Cd3VoWGN0V1Bob1lXcDhteWUxRUlEdjNyaHRHMDdocEQ1NGg2dgpCZzh3ejdFYStzMk9sT0N6UnlKNzBSY281YlhjWDNGaGJjdnFlRWJwaFFyQnpOSEtLMjZ4cmZqNWZIT3p6T1FGCmJHdUZ3SDVic3JGdFhlajJXM3c4eW90N0ZQSDV3S3RpdnhvSWU5RjMyOXNnOU9EQnZqWnpiaG1LVTArckFTK1kKRGVield2bFJyaEUrbXVmQTN6M0N0QXhDOFJpNzNscFNoTDRQQWlvcG1SUXlxZXRXMjYzOFFxcnM0R3hnNzhwbApJUXJXTmNBc2s3Slg5d3RZenV6UFBXSXRWTTFscFJiQVRhNTJqdFl2NVFLQmdRRE5tMTFtZTRYam1ZSFV2cStZCmFTUzdwK2UybXZEMHVaOU9JeFluQnBWMGkrckNlYnFFMkE1Rm5hcDQ5Yld4QTgwUElldlVkeUpCL2pUUkoxcVMKRUpXQkpMWm1LVkg2K1QwdWw1ZUtOcWxFTFZHU0dCSXNpeE9SUXpDZHBoMkx0UmtBMHVjSVUzY3hiUmVMZkZCRQpiSkdZWENCdlNGcWd0VDlvZTFldVpMVmFOd0tCZ1FERWdENzJENk81eGIweEQ1NDQ1M0RPMUJhZmd6aThCWDRTCk1SaVd2LzFUQ0w5N05sRWtoeXovNmtQd1owbXJRcE5CMzZFdkpKZFVteHdkU2MyWDhrOGcxMC85NVlLQkdWQWoKL3d0YVZYbE9WeEFvK0ZSelpZeFpyQ29uWWFSMHVwUzFybDRtenN4REhlZU9mUVZUTUgwUjdZN0pnbTA5dXQ4SwplanAvSXZBb1F3S0JnQjNaRWlRUWhvMVYrWjBTMlpiOG5KS0plMy9zMmxJTXFHM0ZkaS9RS3Q0eWViQWx6OGY5ClBZVXBzRmZEQTg5Z3grSU1nSm5sZVptdTk2ZnRXSjZmdmJSenllN216TG5zZU05TXZua1lHbGFGWmJRWnZubXMKN3ZoRmtzY3dHRlh4d21GMlBJZmU1Z3pNMDRBeVdjeTFIaVhLS2dNOXM3cGsxWUdyZGowZzdacmRBb0dCQUtLNApDR3MrbkRmMEZTMFJYOWFEWVJrRTdBNy9YUFhtSG5YMkRnU1h5N0Q4NTRPaWdTTWNoUmtPNTErbVNJejNQbllvCk41T1FXM2lHVVl1M1YvYmhnc0VSUzM1V2xmRk9BdDBzRUR5bjF5SVdXcDF5dG93d3BUNkVvUXVuZ2NYZjA5RjMKS1NROXowd3M4VmsvRWkvSFVXcU5LOWFXbU51cmFaT0ZqL2REK1ZkOUFvR0FMWFN3dEE3K043RDRkN0VEMURSRQpHTWdZNVd3OHFvdDZSdUNlNkpUY0FnU3B1MkhNU3JVY2dXclpiQnJZb09FUnVNQjFoMVJydk5ybU1qQlM0VW9FClgyZC8vbGhpOG1wL2VESWN3UDNRa2puanBJRFJWMFN1eWxrUkVaZURKZjVZb3R6eDdFdkJhbzFIbkQrWEg4eUIKVUtmWGJTaHZKVUdhRmgxT3Q1Y3JoM1k9Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
new file mode 100644
index 000000000..55cdd5c4c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The add operation requires a value
+      reason: Invalid
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
new file mode 100644
index 000000000..26d7c0af4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.envoypatchpolicies.yaml
@@ -0,0 +1,10 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: 'unable to find xds resource type.googleapis.com/envoy.config.listener.v3.Listener:
+        non-existant-listener'
+      reason: ResourceNotFound
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
new file mode 100644
index 000000000..fd7728081
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: The value field can not be set for the remove operation
+      reason: Invalid
+      status: "False"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
new file mode 100644
index 000000000..4043644d4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.envoypatchpolicies.yaml
@@ -0,0 +1,9 @@
+- name: first-policy
+  namespace: default
+  status:
+    conditions:
+    - lastTransitionTime: null
+      message: successfully applied patches.
+      reason: Programmed
+      status: "True"
+      type: Programmed
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
new file mode 100644
index 000000000..4a412b357
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
@@ -0,0 +1,18 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        headers:
+        - name: user
+          stringMatch:
+            exact: jason
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
new file mode 100644
index 000000000..d1c4b32fd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/jsonpatch.secrets.yaml
@@ -0,0 +1,16 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: a2V5LWRhdGE=
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: test_secret
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
new file mode 100644
index 000000000..729a0304a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
@@ -0,0 +1,60 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  listenerFilters:
+  - name: envoy.filters.listener.proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
new file mode 100644
index 000000000..a52251e32
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.clusters.yaml
@@ -0,0 +1,68 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
new file mode 100644
index 000000000..5b4fe89e5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: tls-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-route-dest/backend/0
+- clusterName: tcp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
new file mode 100644
index 000000000..d73eb9293
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
@@ -0,0 +1,137 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: second-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+  - description: socket option for keep alive probes
+    intValue: "7"
+    level: "6"
+    name: "6"
+  - description: socket option for keep alive idle time
+    intValue: "50"
+    level: "6"
+    name: "4"
+  - description: socket option for keep alive interval
+    intValue: "200"
+    level: "6"
+    name: "5"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10082
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-route-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: third-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10083
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-dest
+        statPrefix: tcp
+  name: fourth-listener
+  perConnectionBufferLimitBytes: 32768
+  socketOptions:
+  - description: socket option to enable tcp keep alive
+    intValue: "1"
+    level: "1"
+    name: "9"
+  - description: socket option for keep alive probes
+    intValue: "10"
+    level: "6"
+    name: "6"
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
new file mode 100644
index 000000000..ff93cfff3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
@@ -0,0 +1,28 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
new file mode 100644
index 000000000..fc755fed3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.clusters.yaml
@@ -0,0 +1,106 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: RANDOM
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: MAGLEV
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fifth-route-dest
+  lbPolicy: LEAST_REQUEST
+  leastRequestLbConfig:
+    slowStartConfig:
+      slowStartWindow: 60s
+  name: fifth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: sixth-route-dest
+  name: sixth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  roundRobinLbConfig:
+    slowStartConfig:
+      slowStartWindow: 300s
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
new file mode 100644
index 000000000..ee22b49d2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.endpoints.yaml
@@ -0,0 +1,72 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: fifth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fifth-route-dest/backend/0
+- clusterName: sixth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: sixth-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
new file mode 100644
index 000000000..49db59653
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/load-balancer.routes.yaml
@@ -0,0 +1,52 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        hashPolicy:
+        - connectionProperties:
+            sourceIp: true
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: fifth-route
+      route:
+        cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    - match:
+        prefix: /
+      name: sixth-route
+      route:
+        cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
new file mode 100644
index 000000000..41594a227
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
@@ -0,0 +1,20 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+    virtualClusters:
+    - headers:
+      - name: :authority
+        stringMatch:
+          prefix: '*'
+      name: '*'
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
new file mode 100644
index 000000000..7a0c93317
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.clusters.yaml
@@ -0,0 +1,45 @@
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: localhost_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: localhost
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality: {}
+  name: localhost_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
new file mode 100644
index 000000000..0d68b430c
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.endpoints.yaml
@@ -0,0 +1,11 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
new file mode 100644
index 000000000..f090a8d12
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.listeners.yaml
@@ -0,0 +1,67 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.jwt_authn
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication
+            providers:
+              first-route/example:
+                audiences:
+                - foo.com
+                issuer: https://www.example.com
+                payloadInMetadata: https://www.example.com
+                remoteJwks:
+                  asyncFetch: {}
+                  cacheDuration: 300s
+                  httpUri:
+                    cluster: localhost_443
+                    timeout: 5s
+                    uri: https://localhost/jwt/public-key/jwks.json
+                  retryPolicy: {}
+            requirementMap:
+              first-route:
+                providerName: first-route/example
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        upgradeConfigs:
+        - upgradeType: websocket
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: first-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
new file mode 100644
index 000000000..c73bec090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.routes.yaml
@@ -0,0 +1,16 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo/bar
+      name: first-route
+      route:
+        cluster: first-route-dest
+      typedPerFilterConfig:
+        envoy.filters.http.jwt_authn:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
+          requirementName: first-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
new file mode 100644
index 000000000..9155e5c88
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mixed-tls-jwt-authn.secrets.yaml
@@ -0,0 +1,6 @@
+- name: first-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
new file mode 100755
index 000000000..2b9b567cf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.clusters.yaml
@@ -0,0 +1,104 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-1/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-1/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-2/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-2/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  lbPolicy: LEAST_REQUEST
+  name: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: httproute/default/httproute-3/rule/0
+  lbPolicy: LEAST_REQUEST
+  name: httproute/default/httproute-3/rule/0
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_foo_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.foo.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_foo_com_443/backend/0
+  name: oauth_foo_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.foo.com
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
new file mode 100755
index 000000000..1f4fcb70d
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.endpoints.yaml
@@ -0,0 +1,48 @@
+- clusterName: httproute/default/httproute-1/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.1
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-1/rule/0/backend/0
+- clusterName: httproute/default/httproute-2/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.2
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-2/rule/0/backend/0
+- clusterName: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 7.7.7.7
+            portValue: 80
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend/backend/0
+- clusterName: httproute/default/httproute-3/rule/0
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 192.168.1.3
+            portValue: 8080
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: httproute/default/httproute-3/rule/0/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
new file mode 100755
index 000000000..910c6728e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
@@ -0,0 +1,156 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+      protocol: UDP
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        codecType: HTTP3
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        http3ProtocolOptions: {}
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: default/gateway-1/http-quic
+  udpListenerConfig:
+    downstreamSocketConfig: {}
+    quicOptions: {}
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
+            httpService:
+              authorizationResponse:
+                allowedUpstreamHeaders:
+                  patterns:
+                  - exact: header1
+                  - exact: header2
+              pathPrefix: /auth
+              serverUri:
+                cluster: securitypolicy/default/policy-for-http-route-2/envoy-gateway/http-backend
+                timeout: 10s
+                uri: http://http-backend.envoy-gateway:80/auth
+            transportApiVersion: V3
+        - disabled: true
+          name: envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.basic_auth.v3.BasicAuth
+            users:
+              inlineBytes: dXNlcjE6e1NIQX10RVNzQm1FL3lOWTNsYjZhMEw2dlZRRVpOcXc9CnVzZXIyOntTSEF9RUo5TFBGRFhzTjl5blNtYnh2anA3NUJtbHg4PQo=
+        - disabled: true
+          name: envoy.filters.http.oauth2_httproute/default/httproute-3/rule/0/match/0/www_bar_com
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.foo.com
+                cookieNames:
+                  bearerToken: BearerToken-5F93C2E4
+                  idToken: IdToken-5F93C2E4
+                  oauthExpires: OauthExpires-5F93C2E4
+                  oauthHmac: OauthHMAC-5F93C2E4
+                  refreshToken: RefreshToken-5F93C2E4
+                hmacSecret:
+                  name: httproute/default/httproute-3/rule/0/match/0/www_bar_com/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: httproute/default/httproute-3/rule/0/match/0/www_bar_com/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /foo/oauth2/callback
+              redirectUri: https://www.example.com/foo/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /foo/logout
+              tokenEndpoint:
+                cluster: oauth_foo_com_443
+                timeout: 10s
+                uri: https://oauth.foo.com/token
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: default/gateway-1/http
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: default/gateway-1/http
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
new file mode 100755
index 000000000..1a4ec4068
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
@@ -0,0 +1,54 @@
+- ignorePortInHostMatching: true
+  name: default/gateway-1/http
+  virtualHosts:
+  - domains:
+    - www.foo.com
+    name: default/gateway-1/http/www_foo_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /foo1
+      name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.basic_auth_httproute/default/httproute-1/rule/0/match/0/www_foo_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        pathSeparatedPrefix: /foo2
+      name: httproute/default/httproute-2/rule/0/match/0/www_foo_com
+      responseHeadersToAdd:
+      - append: true
+        header:
+          key: alt-svc
+          value: h3=":443"; ma=86400
+      route:
+        cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+  - domains:
+    - www.bar.com
+    name: default/gateway-2/http/www_bar_com
+    routes:
+    - match:
+        pathSeparatedPrefix: /bar
+      name: httproute/default/httproute-3/rule/0/match/0/www_bar_com
+      route:
+        cluster: httproute/default/httproute-3/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_httproute/default/httproute-3/rule/0/match/0/www_bar_com:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
new file mode 100644
index 000000000..ce7f4361a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.clusters.yaml
@@ -0,0 +1,102 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: third-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: third-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: fourth-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: fourth-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
new file mode 100644
index 000000000..ceed007af
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.endpoints.yaml
@@ -0,0 +1,72 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
+- clusterName: third-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: third-route-dest/backend/0
+- clusterName: fourth-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: fourth-route-dest/backend/0
+- clusterName: tcp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-dest/backend/0
+- clusterName: tls-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
new file mode 100644
index 000000000..170017bc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
@@ -0,0 +1,138 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: third-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: first-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  - filterChainMatch:
+      serverNames:
+      - foo.net
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: second-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: second-listener
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-dest
+        statPrefix: passthrough
+  - filterChainMatch:
+      serverNames:
+      - bar.net
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-route-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
new file mode 100644
index 000000000..c94d2c09f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
@@ -0,0 +1,53 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: second-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: second-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+- ignorePortInHostMatching: true
+  name: third-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: third-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: third-route
+      route:
+        cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - '*'
+    name: fourth-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: fourth-route
+      route:
+        cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
new file mode 100644
index 000000000..47ebba746
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port.secrets.yaml
@@ -0,0 +1,12 @@
+- name: first-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: second-listener
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
new file mode 100644
index 000000000..e0f57c2a6
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.clusters.yaml
@@ -0,0 +1,85 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-1-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-1-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-2-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-2-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-3-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-3-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-4-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-4-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
new file mode 100644
index 000000000..8d9b5f227
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.endpoints.yaml
@@ -0,0 +1,90 @@
+- clusterName: tcp-route-simple-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-dest/backend/0
+- clusterName: tcp-route-simple-1-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-1-dest/backend/0
+- clusterName: tcp-route-simple-2-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-2-dest/backend/0
+- clusterName: tcp-route-simple-3-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-3-dest/backend/0
+- clusterName: tcp-route-simple-4-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-4-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
new file mode 100644
index 000000000..33e4073d8
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.listeners.yaml
@@ -0,0 +1,38 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-1-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-2-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-3-dest
+        statPrefix: tcp
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-4-dest
+        statPrefix: tcp
+  name: tcp-route-simple
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-simple-tcp-route-same-port.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
new file mode 100644
index 000000000..80a48e25b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
@@ -0,0 +1,56 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          validationContextSdsSecretConfig:
+            name: ca-cert
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+        requireClientCertificate: true
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
new file mode 100644
index 000000000..052882baf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/mutual-tls.secrets.yaml
@@ -0,0 +1,16 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: ca-cert
+  validationContext:
+    trustedCa:
+      inlineBytes: Y2VydC1kYXRh
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
new file mode 100644
index 000000000..5309331d0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.clusters.yaml
@@ -0,0 +1,106 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: second-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: second-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_foo_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.foo.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_foo_com_443/backend/0
+  name: oauth_foo_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.foo.com
+  type: STRICT_DNS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: oauth_bar_com_443
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: oauth.bar.com
+              portValue: 443
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: oauth_bar_com_443/backend/0
+  name: oauth_bar_com_443
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  transportSocket:
+    name: envoy.transport_sockets.tls
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+      commonTlsContext:
+        validationContext:
+          trustedCa:
+            filename: /etc/ssl/certs/ca-certificates.crt
+      sni: oauth.bar.com
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
new file mode 100644
index 000000000..de95bf555
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.endpoints.yaml
@@ -0,0 +1,24 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
+- clusterName: second-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: second-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
new file mode 100644
index 000000000..4d4721c66
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.listeners.yaml
@@ -0,0 +1,115 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - disabled: true
+          name: envoy.filters.http.oauth2_first-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.foo.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.foo.com
+                cookieNames:
+                  bearerToken: BearerToken-5F93C2E4
+                  idToken: IdToken-5F93C2E4
+                  oauthExpires: OauthExpires-5F93C2E4
+                  oauthHmac: OauthHMAC-5F93C2E4
+                  refreshToken: RefreshToken-5F93C2E4
+                hmacSecret:
+                  name: first-route/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: first-route/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /foo/oauth2/callback
+              redirectUri: https://www.example.com/foo/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /foo/logout
+              tokenEndpoint:
+                cluster: oauth_foo_com_443
+                timeout: 10s
+                uri: https://oauth.foo.com/token
+        - disabled: true
+          name: envoy.filters.http.oauth2_second-route
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.oauth2.v3.OAuth2
+            config:
+              authScopes:
+              - openid
+              - email
+              - profile
+              authType: BASIC_AUTH
+              authorizationEndpoint: https://oauth.bar.com/oauth2/v2/auth
+              credentials:
+                clientId: client.oauth.bar.com
+                cookieNames:
+                  bearerToken: BearerToken-5f93c2e4
+                  idToken: IdToken-5f93c2e4
+                  oauthExpires: OauthExpires-5f93c2e4
+                  oauthHmac: OauthHMAC-5f93c2e4
+                  refreshToken: RefreshToken-5f93c2e4
+                hmacSecret:
+                  name: second-route/oauth2/hmac_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+                tokenSecret:
+                  name: second-route/oauth2/client_secret
+                  sdsConfig:
+                    ads: {}
+                    resourceApiVersion: V3
+              forwardBearerToken: true
+              redirectPathMatcher:
+                path:
+                  exact: /bar/oauth2/callback
+              redirectUri: https://www.example.com/bar/oauth2/callback
+              signoutPath:
+                path:
+                  exact: /bar/logout
+              tokenEndpoint:
+                cluster: oauth_bar_com_443
+                timeout: 10s
+                uri: https://oauth.bar.com/token
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
new file mode 100644
index 000000000..a093d6967
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/oidc.routes.yaml
@@ -0,0 +1,29 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        path: foo
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_first-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
+    - match:
+        path: bar
+      name: second-route
+      route:
+        cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
+      typedPerFilterConfig:
+        envoy.filters.http.oauth2_second-route:
+          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
+          config: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
new file mode 100644
index 000000000..02167bb10
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.listeners.yaml
@@ -0,0 +1,32 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/path-settings.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
new file mode 100644
index 000000000..6441952ea
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.clusters.yaml
@@ -0,0 +1,27 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  transportSocket:
+    name: envoy.transport_sockets.upstream_proxy_protocol
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport
+      config:
+        version: V2
+      transportSocket:
+        name: envoy.transport_sockets.raw_buffer
+        typedConfig:
+          '@type': type.googleapis.com/envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
new file mode 100644
index 000000000..f2cacab52
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
@@ -0,0 +1,53 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        retryPolicy:
+          hostSelectionRetryMaxAttempts: "5"
+          numRetries: 5
+          perTryTimeout: 0.250s
+          retriableStatusCodes:
+          - 429
+          - 503
+          retryBackOff:
+            baseInterval: 0.100s
+            maxInterval: 10s
+          retryHostPredicate:
+          - name: envoy.retry_host_predicates.previous_hosts
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
+          retryOn: reset,connect-failure,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - foo
+    name: first-listener/foo
+    routes:
+    - match:
+        prefix: /
+      name: second-route-defaults
+      route:
+        cluster: first-route-dest
+        retryPolicy:
+          hostSelectionRetryMaxAttempts: "5"
+          numRetries: 2
+          retriableStatusCodes:
+          - 503
+          retryHostPredicate:
+          - name: envoy.retry_host_predicates.previous_hosts
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate
+          retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
+  - domains:
+    - bar
+    name: first-listener/bar
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
new file mode 100644
index 000000000..03bb654b4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
@@ -0,0 +1,50 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
new file mode 100644
index 000000000..ad88ffe43
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/simple-tls.secrets.yaml
@@ -0,0 +1,12 @@
+- name: secret-1
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
+- name: secret-2
+  tlsCertificate:
+    certificateChain:
+      inlineBytes: Y2VydC1kYXRh
+    privateKey:
+      inlineBytes: a2V5LWRhdGE=
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
new file mode 100644
index 000000000..d4e9eb359
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
@@ -0,0 +1,56 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
new file mode 100644
index 000000000..382c2857a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-complex-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-complex-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
new file mode 100644
index 000000000..f1cd2f6a2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tcp-route-complex-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-complex-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
new file mode 100644
index 000000000..0c343d46e
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.listeners.yaml
@@ -0,0 +1,23 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+      - bar.com
+      - example.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-complex-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tcp-route-complex
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-complex.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
new file mode 100644
index 000000000..c845c6403
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-simple-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-simple-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
new file mode 100644
index 000000000..7eb06a08f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tcp-route-simple-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tcp-route-simple-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
new file mode 100644
index 000000000..7fb5696df
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.listeners.yaml
@@ -0,0 +1,14 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-simple-dest
+        statPrefix: tcp
+  name: tcp-route-simple
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-simple.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
new file mode 100644
index 000000000..af4d15a65
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-terminate-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-terminate-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
new file mode 100644
index 000000000..164abc9de
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tls-terminate-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-terminate-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
new file mode 100644
index 000000000..34bc646e4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.listeners.yaml
@@ -0,0 +1,27 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-terminate-dest
+        statPrefix: terminate
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - h2
+          - http/1.1
+          tlsCertificateSdsSecretConfigs:
+          - name: envoy-gateway-tls-secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+  name: tls-terminate
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-tls-terminate.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
new file mode 100644
index 000000000..849359c13
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tcp-route-weighted-backend-dest
+  lbPolicy: LEAST_REQUEST
+  name: tcp-route-weighted-backend-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
new file mode 100644
index 000000000..73db3a800
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.endpoints.yaml
@@ -0,0 +1,42 @@
+- clusterName: tcp-route-weighted-backend-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.1.1.1
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/0
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 2.2.2.2
+            portValue: 50002
+      loadBalancingWeight: 1
+    loadBalancingWeight: 40
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/1
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 3.3.3.3
+            portValue: 50003
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/2
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 4.4.4.4
+            portValue: 50004
+      loadBalancingWeight: 1
+    loadBalancingWeight: 20
+    locality:
+      region: tcp-route-weighted-backend-dest/backend/3
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
new file mode 100644
index 000000000..74cd0effc
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.listeners.yaml
@@ -0,0 +1,23 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+      - bar.com
+      - example.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tcp-route-weighted-backend-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tcp-route-weighted-backend
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tcp-route-weighted-backend.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
new file mode 100644
index 000000000..e2156cb6a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.clusters.yaml
@@ -0,0 +1,25 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 31s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      commonHttpProtocolOptions:
+        idleTimeout: 32s
+        maxConnectionDuration: 33s
+      explicitHttpConfig:
+        httpProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/timeout.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
new file mode 100644
index 000000000..f60942991
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.clusters.yaml
@@ -0,0 +1,44 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: tls-passthrough-foo-dest
+  lbPolicy: LEAST_REQUEST
+  name: tls-passthrough-foo-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: tls-passthrough-bar-dest
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: bar
+              portValue: 50000
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: tls-passthrough-bar-dest/backend/0
+  name: tls-passthrough-bar-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
new file mode 100644
index 000000000..ee66753c4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: tls-passthrough-foo-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: tls-passthrough-foo-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
new file mode 100644
index 000000000..a1c312fa0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.listeners.yaml
@@ -0,0 +1,42 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-passthrough-foo-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tls-passthrough-foo
+  perConnectionBufferLimitBytes: 32768
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10081
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - bar.com
+    filters:
+    - name: envoy.filters.network.tcp_proxy
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy
+        cluster: tls-passthrough-bar-dest
+        statPrefix: passthrough
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: tls-passthrough-bar
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-route-passthrough.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
new file mode 100644
index 000000000..d53a7a1b2
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
new file mode 100644
index 000000000..36bc8d1ec
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
@@ -0,0 +1,77 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  drainType: MODIFY_ONLY
+  filterChains:
+  - filterChainMatch:
+      serverNames:
+      - foo.com
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: https
+        useRemoteAddress: true
+    transportSocket:
+      name: envoy.transport_sockets.tls
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
+        commonTlsContext:
+          alpnProtocols:
+          - some-other-protocol
+          tlsCertificateSdsSecretConfigs:
+          - name: secret-1
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          - name: secret-2
+            sdsConfig:
+              ads: {}
+              resourceApiVersion: V3
+          tlsParams:
+            cipherSuites:
+            - ECDHE-ECDSA-AES128-GCM-SHA256
+            - ECDHE-RSA-AES128-GCM-SHA256
+            - ECDHE-ECDSA-AES256-GCM-SHA384
+            - ECDHE-RSA-AES256-GCM-SHA384
+            ecdhCurves:
+            - X25519
+            - P-256
+            signatureAlgorithms:
+            - ecdsa_secp256r1_sha256
+            - rsa_pss_rsae_sha256
+            - rsa_pkcs1_sha256
+            - ecdsa_secp384r1_sha384
+            - rsa_pss_rsae_sha384
+            - rsa_pkcs1_sha384
+            - rsa_pss_rsae_sha512
+            - rsa_pkcs1_sha512
+            - rsa_pkcs1_sha1
+            tlsMaximumProtocolVersion: TLSv1_2
+            tlsMinimumProtocolVersion: TLSv1_0
+  listenerFilters:
+  - name: envoy.filters.listener.tls_inspector
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
new file mode 100644
index 000000000..eea2936ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.clusters.yaml
@@ -0,0 +1,49 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: direct-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: direct-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  dnsRefreshRate: 30s
+  lbPolicy: LEAST_REQUEST
+  loadAssignment:
+    clusterName: tracing|otel-collector.monitoring.svc.cluster.local|4317
+    endpoints:
+    - lbEndpoints:
+      - endpoint:
+          address:
+            socketAddress:
+              address: otel-collector.monitoring.svc.cluster.local
+              portValue: 4317
+        loadBalancingWeight: 1
+      loadBalancingWeight: 1
+      locality:
+        region: tracing|otel-collector.monitoring.svc.cluster.local|4317/backend/0
+  name: tracing|otel-collector.monitoring.svc.cluster.local|4317
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  respectDnsTtl: true
+  type: STRICT_DNS
+  typedExtensionProtocolOptions:
+    envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
+      '@type': type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions
+      explicitHttpConfig:
+        http2ProtocolOptions: {}
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
new file mode 100644
index 000000000..20c80b3aa
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: direct-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: direct-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
new file mode 100644
index 000000000..d4737ef1f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.listeners.yaml
@@ -0,0 +1,62 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        tracing:
+          clientSampling:
+            value: 100
+          customTags:
+          - environment:
+              defaultValue: '-'
+              name: env1
+            tag: env1
+          - literal:
+              value: value1
+            tag: literal1
+          - requestHeader:
+              defaultValue: '-'
+              name: X-Request-Id
+            tag: req1
+          overallSampling:
+            value: 100
+          provider:
+            name: envoy.tracers.opentelemetry
+            typedConfig:
+              '@type': type.googleapis.com/envoy.config.trace.v3.OpenTelemetryConfig
+              grpcService:
+                envoyGrpc:
+                  authority: otel-collector.monitoring.svc.cluster.local
+                  clusterName: tracing|otel-collector.monitoring.svc.cluster.local|4317
+              serviceName: fake-name.fake-ns
+          randomSampling:
+            value: 90
+          spawnUpstreamSpan: true
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
new file mode 100644
index 000000000..d4a7fa5ae
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/tracing.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - directResponse:
+        body:
+          inlineString: 'Unknown custom filter type: UnsupportedType'
+        status: 500
+      match:
+        prefix: /
+      name: direct-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
new file mode 100644
index 000000000..0656b7c45
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.clusters.yaml
@@ -0,0 +1,17 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: udp-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: udp-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
new file mode 100644
index 000000000..2e3c84e67
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.endpoints.yaml
@@ -0,0 +1,18 @@
+- clusterName: udp-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    - endpoint:
+        address:
+          socketAddress:
+            address: 5.6.7.8
+            portValue: 50001
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: udp-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
new file mode 100644
index 000000000..317a7ddc4
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.listeners.yaml
@@ -0,0 +1,18 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+      protocol: UDP
+  listenerFilters:
+  - name: envoy.filters.udp_listener.udp_proxy
+    typedConfig:
+      '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig
+      matcher:
+        onNoMatch:
+          action:
+            name: route
+            typedConfig:
+              '@type': type.googleapis.com/envoy.extensions.filters.udp.udp_proxy.v3.Route
+              cluster: udp-route-dest
+      statPrefix: service
+  name: udp-route
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
new file mode 100644
index 000000000..fe51488c7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/udp-route.routes.yaml
@@ -0,0 +1 @@
+[]
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
new file mode 100644
index 000000000..6d5dffadf
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.clusters.yaml
@@ -0,0 +1,22 @@
+- circuitBreakers:
+    thresholds:
+    - maxRetries: 1024
+  commonLbConfig:
+    localityWeightedLbConfig: {}
+  connectTimeout: 10s
+  dnsLookupFamily: V4_ONLY
+  edsClusterConfig:
+    edsConfig:
+      ads: {}
+      resourceApiVersion: V3
+    serviceName: first-route-dest
+  lbPolicy: LEAST_REQUEST
+  name: first-route-dest
+  outlierDetection: {}
+  perConnectionBufferLimitBytes: 32768
+  type: EDS
+  upstreamConnectionOptions:
+    tcpKeepalive:
+      keepaliveInterval: 60
+      keepaliveProbes: 3
+      keepaliveTime: 1200
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
new file mode 100644
index 000000000..3b3f2d090
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.endpoints.yaml
@@ -0,0 +1,12 @@
+- clusterName: first-route-dest
+  endpoints:
+  - lbEndpoints:
+    - endpoint:
+        address:
+          socketAddress:
+            address: 1.2.3.4
+            portValue: 50000
+      loadBalancingWeight: 1
+    loadBalancingWeight: 1
+    locality:
+      region: first-route-dest/backend/0
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
new file mode 100644
index 000000000..ea50f4a05
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
@@ -0,0 +1,33 @@
+- address:
+    socketAddress:
+      address: 0.0.0.0
+      portValue: 10080
+  defaultFilterChain:
+    filters:
+    - name: envoy.filters.network.http_connection_manager
+      typedConfig:
+        '@type': type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
+        commonHttpProtocolOptions:
+          headersWithUnderscoresAction: REJECT_REQUEST
+        http2ProtocolOptions:
+          initialConnectionWindowSize: 1048576
+          initialStreamWindowSize: 65536
+          maxConcurrentStreams: 100
+        httpFilters:
+        - name: envoy.filters.http.router
+          typedConfig:
+            '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+            suppressEnvoyHeaders: true
+        mergeSlashes: true
+        normalizePath: true
+        rds:
+          configSource:
+            ads: {}
+            resourceApiVersion: V3
+          routeConfigName: first-listener
+        serverHeaderTransformation: PASS_THROUGH
+        statPrefix: http
+        useRemoteAddress: true
+  drainType: MODIFY_ONLY
+  name: first-listener
+  perConnectionBufferLimitBytes: 32768
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
new file mode 100644
index 000000000..0b5b4bee7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
@@ -0,0 +1,14 @@
+- ignorePortInHostMatching: true
+  name: first-listener
+  virtualHosts:
+  - domains:
+    - '*'
+    name: first-listener/*
+    routes:
+    - match:
+        prefix: /
+      name: first-route
+      route:
+        cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/adapter/internal/operator/gateway-api/translator/tracing.go b/adapter/internal/operator/gateway-api/translator/tracing.go
new file mode 100644
index 000000000..d4ff5b6bd
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/tracing.go
@@ -0,0 +1,160 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"sort"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	tracecfg "github.com/envoyproxy/go-control-plane/envoy/config/trace/v3"
+	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tracingtype "github.com/envoyproxy/go-control-plane/envoy/type/tracing/v3"
+	xdstype "github.com/envoyproxy/go-control-plane/envoy/type/v3"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+	"k8s.io/utils/ptr"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+)
+
+func buildHCMTracing(tracing *ir.Tracing) (*hcm.HttpConnectionManager_Tracing, error) {
+	if tracing == nil {
+		return nil, nil
+	}
+
+	oc := &tracecfg.OpenTelemetryConfig{
+		GrpcService: &corev3.GrpcService{
+			TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
+				EnvoyGrpc: &corev3.GrpcService_EnvoyGrpc{
+					ClusterName: buildClusterName("tracing", tracing.Provider.Host, uint32(tracing.Provider.Port)),
+					Authority:   tracing.Provider.Host,
+				},
+			},
+		},
+		ServiceName: tracing.ServiceName,
+	}
+
+	ocAny, err := protocov.ToAnyWithError(oc)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal OpenTelemetryConfig: %w", err)
+	}
+
+	tags := []*tracingtype.CustomTag{}
+	// TODO: consider add some default tags for better UX
+	for k, v := range tracing.CustomTags {
+		switch v.Type {
+		case egv1a1.CustomTagTypeLiteral:
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_Literal_{
+					Literal: &tracingtype.CustomTag_Literal{
+						Value: v.Literal.Value,
+					},
+				},
+			})
+		case egv1a1.CustomTagTypeEnvironment:
+			defaultVal := ""
+			if v.Environment.DefaultValue != nil {
+				defaultVal = *v.Environment.DefaultValue
+			}
+
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_Environment_{
+					Environment: &tracingtype.CustomTag_Environment{
+						Name:         v.Environment.Name,
+						DefaultValue: defaultVal,
+					},
+				},
+			})
+		case egv1a1.CustomTagTypeRequestHeader:
+			defaultVal := ""
+			if v.RequestHeader.DefaultValue != nil {
+				defaultVal = *v.RequestHeader.DefaultValue
+			}
+
+			tags = append(tags, &tracingtype.CustomTag{
+				Tag: k,
+				Type: &tracingtype.CustomTag_RequestHeader{
+					RequestHeader: &tracingtype.CustomTag_Header{
+						Name:         v.RequestHeader.Name,
+						DefaultValue: defaultVal,
+					},
+				},
+			})
+		default:
+			return nil, fmt.Errorf("unknown custom tag type: %s", v.Type)
+		}
+	}
+	// sort tags by tag name, make result consistent
+	sort.Slice(tags, func(i, j int) bool {
+		return tags[i].Tag < tags[j].Tag
+	})
+
+	return &hcm.HttpConnectionManager_Tracing{
+		ClientSampling: &xdstype.Percent{
+			Value: 100.0,
+		},
+		OverallSampling: &xdstype.Percent{
+			Value: 100.0,
+		},
+		RandomSampling: &xdstype.Percent{
+			Value: float64(*tracing.SamplingRate),
+		},
+		Provider: &tracecfg.Tracing_Http{
+			Name: "envoy.tracers.opentelemetry",
+			ConfigType: &tracecfg.Tracing_Http_TypedConfig{
+				TypedConfig: ocAny,
+			},
+		},
+		CustomTags:        tags,
+		SpawnUpstreamSpan: wrapperspb.Bool(true),
+	}, nil
+}
+
+func processClusterForTracing(tCtx *types.ResourceVersionTable, tracing *ir.Tracing) error {
+	if tracing == nil {
+		return nil
+	}
+
+	clusterName := buildClusterName("tracing", tracing.Provider.Host, uint32(tracing.Provider.Port))
+
+	ds := &ir.DestinationSetting{
+		Weight:    ptr.To[uint32](1),
+		Protocol:  ir.GRPC,
+		Endpoints: []*ir.DestinationEndpoint{ir.NewDestEndpoint(tracing.Provider.Host, uint32(tracing.Provider.Port))},
+	}
+	if err := addXdsCluster(tCtx, &xdsClusterArgs{
+		name:         clusterName,
+		settings:     []*ir.DestinationSetting{ds},
+		tSocket:      nil,
+		endpointType: EndpointTypeDNS,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/translator.go b/adapter/internal/operator/gateway-api/translator/translator.go
new file mode 100644
index 000000000..eae45eb50
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/translator.go
@@ -0,0 +1,744 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	matcherv3 "github.com/envoyproxy/go-control-plane/envoy/type/matcher/v3"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+var (
+	ErrXdsClusterExists = errors.New("xds cluster exists")
+	ErrXdsSecretExists  = errors.New("xds secret exists")
+)
+
+const AuthorityHeaderKey = ":authority"
+
+// Translator translates the xDS IR into xDS resources.
+type Translator struct {
+	// GlobalRateLimit holds the global rate limit settings
+	// required during xds translation.
+	GlobalRateLimit *GlobalRateLimitSettings
+
+	// ExtensionManager holds the config for interacting with extensions when generating xDS
+	// resources. Only required during xds translation.
+	// ExtensionManager *extensionTypes.Manager
+}
+
+type GlobalRateLimitSettings struct {
+	// ServiceURL is the URL of the global
+	// rate limit service.
+	ServiceURL string
+
+	// Timeout specifies the timeout period for the proxy to access the ratelimit server
+	// If not set, timeout is 20000000(20ms).
+	Timeout time.Duration
+
+	// FailClosed is a switch used to control the flow of traffic
+	// when the response from the ratelimit server cannot be obtained.
+	FailClosed bool
+}
+
+// Translate translates the XDS IR into xDS resources
+func (t *Translator) Translate(ir *ir.Xds) (*types.ResourceVersionTable, error) {
+	if ir == nil {
+		return nil, errors.New("ir is nil")
+	}
+
+	tCtx := new(types.ResourceVersionTable)
+
+	// xDS translation is done in a best-effort manner, so we collect all errors
+	// and return them at the end.
+	//
+	// Reasoning: The validation in the CRD validation and API Gateway API
+	// translator should already catch most errors, there are just few rare cases
+	// where xDS translation can fail, for example, failed to call an extension
+	// hook or failed to patch an EnvoyPatchPolicy. In those cases, we don't want
+	// to fail the entire xDS translation to panic users, but instead, we want
+	// to collect all errors and reflect them in the status of the CRDs.
+	var errs error
+	if err := t.processHTTPListenerXdsTranslation(
+		tCtx, ir.HTTP, ir.AccessLog, ir.Tracing, ir.Metrics); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processTCPListenerXdsTranslation(tCtx, ir.TCP, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processUDPListenerXdsTranslation(tCtx, ir.UDP, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	if err := processClusterForAccessLog(tCtx, ir.AccessLog); err != nil {
+		errs = errors.Join(errs, err)
+	}
+	if err := processClusterForTracing(tCtx, ir.Tracing); err != nil {
+		errs = errors.Join(errs, err)
+	}
+
+	// Check if an extension want to inject any clusters/secrets
+	// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op
+	// if err := processExtensionPostTranslationHook(tCtx, t.ExtensionManager); err != nil {
+	// 	errs = errors.Join(errs, err)
+	// }
+
+	return tCtx, errs
+}
+
+func (t *Translator) processHTTPListenerXdsTranslation(
+	tCtx *types.ResourceVersionTable,
+	httpListeners []*ir.HTTPListener,
+	accessLog *ir.AccessLog,
+	tracing *ir.Tracing,
+	metrics *ir.Metrics,
+) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+	for _, httpListener := range httpListeners {
+		addFilterChain := true
+		var xdsRouteCfg *routev3.RouteConfiguration
+
+		// Search for an existing listener, if it does not exist, create one.
+		xdsListener := findXdsListenerByHostPort(tCtx, httpListener.Address, httpListener.Port, corev3.SocketAddress_TCP)
+		var quicXDSListener *listenerv3.Listener
+		enabledHTTP3 := httpListener.HTTP3 != nil
+		if xdsListener == nil {
+			xdsListener = buildXdsTCPListener(httpListener.Name, httpListener.Address, httpListener.Port, httpListener.TCPKeepalive, accessLog)
+			if enabledHTTP3 {
+				quicXDSListener = buildXdsQuicListener(httpListener.Name, httpListener.Address, httpListener.Port, accessLog)
+				if err := tCtx.AddXdsResource(resourcev3.ListenerType, quicXDSListener); err != nil {
+					return err
+				}
+			}
+			if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+				// skip this listener if failed to add xds listener to the
+				// resource version table. Normally, this should not happen.
+				errs = errors.Join(errs, err)
+				continue
+			}
+		} else if httpListener.TLS == nil {
+			// Find the route config associated with this listener that
+			// maps to the default filter chain for http traffic
+			routeName := findXdsHTTPRouteConfigName(xdsListener)
+			if routeName != "" {
+				// If an existing listener exists, dont create a new filter chain
+				// for HTTP traffic, match on the Domains field within VirtualHosts
+				// within the same RouteConfiguration instead
+				addFilterChain = false
+				xdsRouteCfg = findXdsRouteConfig(tCtx, routeName)
+				if xdsRouteCfg == nil {
+					// skip this listener if failed to find xds route config
+					errs = errors.Join(errs, errors.New("unable to find xds route config"))
+					continue
+				}
+			}
+		}
+
+		if addFilterChain {
+			if err := t.addXdsHTTPFilterChain(xdsListener, httpListener, accessLog, tracing, false); err != nil {
+				return err
+			}
+			if enabledHTTP3 {
+				if err := t.addXdsHTTPFilterChain(quicXDSListener, httpListener, accessLog, tracing, true); err != nil {
+					return err
+				}
+			}
+		} else {
+			// When the DefaultFilterChain is shared by multiple Gateway HTTP
+			// Listeners, we need to add the HTTP filters associated with the
+			// HTTPListener to the HCM if they have not yet been added.
+			if err := t.addHTTPFiltersToHCM(xdsListener.DefaultFilterChain, httpListener); err != nil {
+				errs = errors.Join(errs, err)
+				continue
+			}
+			if enabledHTTP3 {
+				if err := t.addHTTPFiltersToHCM(quicXDSListener.DefaultFilterChain, httpListener); err != nil {
+					errs = errors.Join(errs, err)
+					continue
+				}
+			}
+		}
+
+		// Create a route config if we have not found one yet
+		if xdsRouteCfg == nil {
+			xdsRouteCfg = &routev3.RouteConfiguration{
+				IgnorePortInHostMatching: true,
+				Name:                     httpListener.Name,
+			}
+
+			if err := tCtx.AddXdsResource(resourcev3.RouteType, xdsRouteCfg); err != nil {
+				errs = errors.Join(errs, err)
+			}
+		}
+
+		// 1:1 between IR TLSListenerConfig and xDS Secret
+		if httpListener.TLS != nil {
+			for t := range httpListener.TLS.Certificates {
+				secret := buildXdsTLSCertSecret(httpListener.TLS.Certificates[t])
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+
+			if httpListener.TLS.CACertificate != nil {
+				caSecret := buildXdsTLSCaCertSecret(httpListener.TLS.CACertificate)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, caSecret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+		}
+
+		// store virtual hosts by domain
+		vHosts := map[string]*routev3.VirtualHost{}
+		// keep track of order by using a list as well as the map
+		var vHostsList []*routev3.VirtualHost
+
+		// Check if an extension is loaded that wants to modify xDS Routes after they have been generated
+		for _, httpRoute := range httpListener.Routes {
+			// 1:1 between IR HTTPRoute Hostname and xDS VirtualHost.
+			vHost := vHosts[httpRoute.Hostname]
+			if vHost == nil {
+				// Remove dots from the hostname before appending it to the virtualHost name
+				// since dots are special chars used in stats tag extraction in Envoy
+				underscoredHostname := strings.ReplaceAll(httpRoute.Hostname, ".", "_")
+				// Allocate virtual host for this httpRoute.
+				vHost = &routev3.VirtualHost{
+					Name:    fmt.Sprintf("%s/%s", httpListener.Name, underscoredHostname),
+					Domains: []string{httpRoute.Hostname},
+				}
+				if metrics != nil && metrics.EnableVirtualHostStats {
+					vHost.VirtualClusters = []*routev3.VirtualCluster{
+						{
+							Name: underscoredHostname,
+							Headers: []*routev3.HeaderMatcher{
+								{
+									Name: AuthorityHeaderKey,
+									HeaderMatchSpecifier: &routev3.HeaderMatcher_StringMatch{
+										StringMatch: &matcherv3.StringMatcher{
+											MatchPattern: &matcherv3.StringMatcher_Prefix{
+												Prefix: httpRoute.Hostname,
+											},
+										},
+									},
+								},
+							},
+						},
+					}
+				}
+				vHosts[httpRoute.Hostname] = vHost
+				vHostsList = append(vHostsList, vHost)
+			}
+
+			// 1:1 between IR HTTPRoute and xDS config.route.v3.Route
+			xdsRoute, err := buildXdsRoute(httpRoute)
+			if err != nil {
+				// skip this route if failed to build xds route
+				errs = errors.Join(errs, err)
+				continue
+			}
+
+			// Check if an extension want to modify the route we just generated
+			// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op.
+			// if err = processExtensionPostRouteHook(xdsRoute, vHost, httpRoute, t.ExtensionManager); err != nil {
+			// 	if err != nil {
+			// 		errs = errors.Join(errs, err)
+			// 	}
+			// }
+
+			if enabledHTTP3 {
+				http3AltSvcHeader := buildHTTP3AltSvcHeader(int(httpListener.HTTP3.QUICPort))
+				if xdsRoute.ResponseHeadersToAdd == nil {
+					xdsRoute.ResponseHeadersToAdd = make([]*corev3.HeaderValueOption, 0)
+				}
+				xdsRoute.ResponseHeadersToAdd = append(xdsRoute.ResponseHeadersToAdd, http3AltSvcHeader)
+			}
+			vHost.Routes = append(vHost.Routes, xdsRoute)
+
+			if httpRoute.Destination != nil {
+				if err = processXdsCluster(tCtx, httpRoute, httpListener.HTTP1); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+
+			if httpRoute.Mirrors != nil {
+				for _, mirrorDest := range httpRoute.Mirrors {
+					if err := addXdsCluster(tCtx, &xdsClusterArgs{
+						name:         mirrorDest.Name,
+						settings:     mirrorDest.Settings,
+						tSocket:      nil,
+						endpointType: EndpointTypeStatic,
+					}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+						errs = errors.Join(errs, err)
+					}
+				}
+			}
+		}
+
+		// for _, vHost := range vHostsList {
+		// 	// Check if an extension want to modify the Virtual Host we just generated
+		// 	// If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op.
+		// 	if err := processExtensionPostVHostHook(vHost, t.ExtensionManager); err != nil {
+		// 		errs = errors.Join(errs, err)
+		// 	}
+		// }
+		xdsRouteCfg.VirtualHosts = append(xdsRouteCfg.VirtualHosts, vHostsList...)
+
+		// Add all the other needed resources referenced by this filter to the
+		// resource version table.
+		if err := patchResources(tCtx, httpListener.Routes); err != nil {
+			return err
+		}
+
+		// RateLimit filter is handled separately because it relies on the global
+		// rate limit server configuration.
+		// Check if a ratelimit cluster exists, if not, add it, if it's needed.
+		// if err := t.createRateLimitServiceCluster(tCtx, httpListener); err != nil {
+		// 	errs = errors.Join(errs, err)
+		// }
+
+		// // Check if an extension want to modify the listener that was just configured/created
+		// // If no extension exists (or it doesn't subscribe to this hook) then this is a quick no-op
+		// if err := processExtensionPostListenerHook(tCtx, xdsListener, t.ExtensionManager); err != nil {
+		// 	errs = errors.Join(errs, err)
+		// }
+	}
+
+	return errs
+}
+
+func (t *Translator) addHTTPFiltersToHCM(filterChain *listenerv3.FilterChain, httpListener *ir.HTTPListener) error {
+	var (
+		hcm *hcmv3.HttpConnectionManager
+		err error
+	)
+
+	if hcm, err = findHCMinFilterChain(filterChain); err != nil {
+		return err // should not happen
+	}
+
+	// Add http filters to the HCM if they have not yet been added.
+	if err = t.patchHCMWithFilters(hcm, httpListener); err != nil {
+		return err
+	}
+
+	for i, filter := range filterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			var mgrAny *anypb.Any
+			if mgrAny, err = protocov.ToAnyWithError(hcm); err != nil {
+				return err
+			}
+
+			filterChain.Filters[i] = &listenerv3.Filter{
+				Name: wellknown.HTTPConnectionManager,
+				ConfigType: &listenerv3.Filter_TypedConfig{
+					TypedConfig: mgrAny,
+				},
+			}
+		}
+	}
+	return nil
+}
+
+func findHCMinFilterChain(filterChain *listenerv3.FilterChain) (*hcmv3.HttpConnectionManager, error) {
+	for _, filter := range filterChain.Filters {
+		if filter.Name == wellknown.HTTPConnectionManager {
+			hcm := &hcmv3.HttpConnectionManager{}
+			if err := anypb.UnmarshalTo(filter.GetTypedConfig(), hcm, proto.UnmarshalOptions{}); err != nil {
+				return nil, err
+			}
+			return hcm, nil
+		}
+	}
+	return nil, errors.New("http connection manager not found")
+}
+
+func buildHTTP3AltSvcHeader(port int) *corev3.HeaderValueOption {
+	return &corev3.HeaderValueOption{
+		Append: &wrapperspb.BoolValue{Value: true},
+		Header: &corev3.HeaderValue{
+			Key:   "alt-svc",
+			Value: strings.Join([]string{fmt.Sprintf(`%s=":%d"; ma=86400`, "h3", port)}, ", "),
+		},
+	}
+}
+
+func processTCPListenerXdsTranslation(tCtx *types.ResourceVersionTable, tcpListeners []*ir.TCPListener, accesslog *ir.AccessLog) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+	for _, tcpListener := range tcpListeners {
+		// Search for an existing listener, if it does not exist, create one.
+		xdsListener := findXdsListenerByHostPort(tCtx, tcpListener.Address, tcpListener.Port, corev3.SocketAddress_TCP)
+		if xdsListener == nil {
+			xdsListener = buildXdsTCPListener(tcpListener.Name, tcpListener.Address, tcpListener.Port, tcpListener.TCPKeepalive, accesslog)
+			if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+				// skip this listener if failed to add xds listener to the
+				errs = errors.Join(errs, err)
+				continue
+			}
+		}
+
+		if err := addXdsTCPFilterChain(xdsListener, tcpListener, tcpListener.Destination.Name, accesslog); err != nil {
+			errs = errors.Join(errs, err)
+		}
+
+		// 1:1 between IR TCPListener and xDS Cluster
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         tcpListener.Destination.Name,
+			settings:     tcpListener.Destination.Settings,
+			tSocket:      nil,
+			endpointType: buildEndpointType(tcpListener.Destination.Settings),
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+
+		if tcpListener.TLS != nil && tcpListener.TLS.Terminate != nil {
+			for _, s := range tcpListener.TLS.Terminate.Certificates {
+				secret := buildXdsTLSCertSecret(s)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+			if tcpListener.TLS.Terminate.CACertificate != nil {
+				caSecret := buildXdsTLSCaCertSecret(tcpListener.TLS.Terminate.CACertificate)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, caSecret); err != nil {
+					errs = errors.Join(errs, err)
+				}
+			}
+		}
+	}
+	return errs
+}
+
+func processUDPListenerXdsTranslation(tCtx *types.ResourceVersionTable, udpListeners []*ir.UDPListener, accesslog *ir.AccessLog) error {
+	// The XDS translation is done in a best-effort manner, so we collect all
+	// errors and return them at the end.
+	var errs error
+
+	for _, udpListener := range udpListeners {
+		// There won't be multiple UDP listeners on the same port since it's already been checked at the gateway api
+		// translator
+		xdsListener, err := buildXdsUDPListener(udpListener.Destination.Name, udpListener, accesslog)
+		if err != nil {
+			// skip this listener if failed to build xds listener
+			errs = errors.Join(errs, err)
+			continue
+		}
+		if err := tCtx.AddXdsResource(resourcev3.ListenerType, xdsListener); err != nil {
+			// skip this listener if failed to add xds listener to the resource version table
+			errs = errors.Join(errs, err)
+			continue
+		}
+
+		// 1:1 between IR UDPListener and xDS Cluster
+		if err := addXdsCluster(tCtx, &xdsClusterArgs{
+			name:         udpListener.Destination.Name,
+			settings:     udpListener.Destination.Settings,
+			tSocket:      nil,
+			endpointType: buildEndpointType(udpListener.Destination.Settings),
+		}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+			errs = errors.Join(errs, err)
+		}
+	}
+	return errs
+}
+
+// findXdsListenerByHostPort finds a xds listener with the same address, port and protocol, and returns nil if there is no match.
+func findXdsListenerByHostPort(tCtx *types.ResourceVersionTable, address string, port uint32,
+	protocol corev3.SocketAddress_Protocol) *listenerv3.Listener {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ListenerType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ListenerType] {
+		listener := r.(*listenerv3.Listener)
+		addr := listener.GetAddress()
+		if addr.GetSocketAddress().GetPortValue() == port && addr.GetSocketAddress().Address == address && addr.
+			GetSocketAddress().Protocol == protocol {
+			return listener
+		}
+	}
+
+	return nil
+}
+
+// findXdsListener finds a xds listener with the same name and returns nil if there is no match.
+func findXdsListener(tCtx *types.ResourceVersionTable, name string) *listenerv3.Listener {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ListenerType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ListenerType] {
+		listener := r.(*listenerv3.Listener)
+		if listener.Name == name {
+			return listener
+		}
+	}
+
+	return nil
+}
+
+// findXdsRouteConfig finds a xds route with the name and returns nil if there is no match.
+func findXdsRouteConfig(tCtx *types.ResourceVersionTable, name string) *routev3.RouteConfiguration {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.RouteType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.RouteType] {
+		route := r.(*routev3.RouteConfiguration)
+		if route.Name == name {
+			return route
+		}
+	}
+
+	return nil
+}
+
+// findXdsCluster finds a xds cluster with the same name, and returns nil if there is no match.
+func findXdsCluster(tCtx *types.ResourceVersionTable, name string) *clusterv3.Cluster {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.ClusterType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.ClusterType] {
+		cluster := r.(*clusterv3.Cluster)
+		if cluster.Name == name {
+			return cluster
+		}
+	}
+
+	return nil
+}
+
+// findXdsEndpoint finds a xds endpoint with the same cluster name, and returns nil if there is no match.
+func findXdsEndpoint(tCtx *types.ResourceVersionTable, name string) *endpointv3.ClusterLoadAssignment {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.EndpointType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.EndpointType] {
+		endpoint := r.(*endpointv3.ClusterLoadAssignment)
+		if endpoint.ClusterName == name {
+			return endpoint
+		}
+	}
+
+	return nil
+}
+
+// processXdsCluster processes a xds cluster by its endpoint address type.
+func processXdsCluster(tCtx *types.ResourceVersionTable, httpRoute *ir.HTTPRoute, http1Settings *ir.HTTP1Settings) error {
+	if err := addXdsCluster(tCtx, &xdsClusterArgs{
+		name:           httpRoute.Destination.Name,
+		settings:       httpRoute.Destination.Settings,
+		tSocket:        nil,
+		endpointType:   buildEndpointType(httpRoute.Destination.Settings),
+		loadBalancer:   httpRoute.LoadBalancer,
+		proxyProtocol:  httpRoute.ProxyProtocol,
+		circuitBreaker: httpRoute.CircuitBreaker,
+		healthCheck:    httpRoute.HealthCheck,
+		http1Settings:  http1Settings,
+		timeout:        httpRoute.Timeout,
+		tcpkeepalive:   httpRoute.TCPKeepalive,
+	}); err != nil && !errors.Is(err, ErrXdsClusterExists) {
+		return err
+	}
+
+	return nil
+}
+
+// processTLSSocket generates a xDS TransportSocket for a given TLS config.
+// It also adds the necessary secrets to the resource version table.
+func processTLSSocket(tlsConfig *ir.TLSUpstreamConfig, tCtx *types.ResourceVersionTable) (*corev3.TransportSocket, error) {
+	if tlsConfig == nil {
+		return nil, nil
+	}
+	// Create a secret for the CA certificate only if it's not using the system trust store
+	if !tlsConfig.UseSystemTrustStore {
+		CaSecret := buildXdsUpstreamTLSCASecret(tlsConfig)
+		if err := tCtx.AddXdsResource(resourcev3.SecretType, CaSecret); err != nil {
+			return nil, err
+		}
+	}
+
+	// for upstreamTLS , a fixed sni can be used. use auto_sni otherwise
+	// https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/sni#faq-how-to-setup-sni:~:text=For%20clusters%2C%20a,for%20trust%20anchor.
+	tlsSocket, err := buildXdsUpstreamTLSSocketWthCert(tlsConfig)
+	if err != nil {
+		return nil, err
+	}
+	return tlsSocket, nil
+}
+
+// findXdsSecret finds a xds secret with the same name, and returns nil if there is no match.
+func findXdsSecret(tCtx *types.ResourceVersionTable, name string) *tlsv3.Secret {
+	if tCtx == nil || tCtx.XdsResources == nil || tCtx.XdsResources[resourcev3.SecretType] == nil {
+		return nil
+	}
+
+	for _, r := range tCtx.XdsResources[resourcev3.SecretType] {
+		secret := r.(*tlsv3.Secret)
+		if secret.Name == name {
+			return secret
+		}
+	}
+
+	return nil
+}
+
+func addXdsSecret(tCtx *types.ResourceVersionTable, secret *tlsv3.Secret) error {
+	// Return early if cluster with the same name exists
+	if c := findXdsSecret(tCtx, secret.Name); c != nil {
+		return ErrXdsSecretExists
+	}
+
+	return tCtx.AddXdsResource(resourcev3.SecretType, secret)
+}
+
+func addXdsCluster(tCtx *types.ResourceVersionTable, args *xdsClusterArgs) error {
+	// Return early if cluster with the same name exists
+	if c := findXdsCluster(tCtx, args.name); c != nil {
+		return ErrXdsClusterExists
+	}
+
+	xdsCluster := buildXdsCluster(args)
+	xdsEndpoints := buildXdsClusterLoadAssignment(args.name, args.settings)
+	for _, ds := range args.settings {
+		if ds.TLS != nil {
+			// Create a secret for the CA certificate only if it's not using the system trust store
+			if !ds.TLS.UseSystemTrustStore {
+				secret := buildXdsUpstreamTLSCASecret(ds.TLS)
+				if err := tCtx.AddXdsResource(resourcev3.SecretType, secret); err != nil {
+					return err
+				}
+			}
+		}
+	}
+	// Use EDS for static endpoints
+	if args.endpointType == EndpointTypeStatic {
+		if err := tCtx.AddXdsResource(resourcev3.EndpointType, xdsEndpoints); err != nil {
+			return err
+		}
+	} else {
+		xdsCluster.LoadAssignment = xdsEndpoints
+	}
+	return tCtx.AddXdsResource(resourcev3.ClusterType, xdsCluster)
+}
+
+const (
+	DefaultEndpointType EndpointType = iota
+	Static
+	EDS
+)
+
+func buildXdsUpstreamTLSCASecret(tlsConfig *ir.TLSUpstreamConfig) *tlsv3.Secret {
+	// Build the tls secret
+	// It's just a sanity check, we shouldn't call this function if the system trust store is used
+	if tlsConfig.UseSystemTrustStore {
+		return nil
+	}
+	return &tlsv3.Secret{
+		Name: tlsConfig.CACertificate.Name,
+		Type: &tlsv3.Secret_ValidationContext{
+			ValidationContext: &tlsv3.CertificateValidationContext{
+				TrustedCa: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{InlineBytes: tlsConfig.CACertificate.Certificate},
+				},
+			},
+		},
+	}
+}
+
+func buildXdsUpstreamTLSSocketWthCert(tlsConfig *ir.TLSUpstreamConfig) (*corev3.TransportSocket, error) {
+
+	var tlsCtx *tlsv3.UpstreamTlsContext
+
+	if tlsConfig.UseSystemTrustStore {
+		tlsCtx = &tlsv3.UpstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				ValidationContextType: &tlsv3.CommonTlsContext_ValidationContext{
+					ValidationContext: &tlsv3.CertificateValidationContext{
+						TrustedCa: &corev3.DataSource{
+							Specifier: &corev3.DataSource_Filename{
+								// This is the default location for the system trust store
+								// on Debian derivatives like the envoy-proxy image being used by the infrastructure
+								// controller.
+								// See https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/security/ssl
+								// TODO: allow customizing this value via EnvoyGateway so that if a non-standard
+								// envoy image is being used, this can be modified to match
+								Filename: "/etc/ssl/certs/ca-certificates.crt",
+							},
+						},
+					},
+				},
+			},
+			Sni: tlsConfig.SNI,
+		}
+	} else {
+		tlsCtx = &tlsv3.UpstreamTlsContext{
+			CommonTlsContext: &tlsv3.CommonTlsContext{
+				TlsCertificateSdsSecretConfigs: nil,
+				ValidationContextType: &tlsv3.CommonTlsContext_ValidationContextSdsSecretConfig{
+					ValidationContextSdsSecretConfig: &tlsv3.SdsSecretConfig{
+						Name:      tlsConfig.CACertificate.Name,
+						SdsConfig: makeConfigSource(),
+					},
+				},
+			},
+			Sni: tlsConfig.SNI,
+		}
+	}
+
+	tlsCtxAny, err := anypb.New(tlsCtx)
+	if err != nil {
+		return nil, err
+	}
+
+	return &corev3.TransportSocket{
+		Name: wellknown.TransportSocketTLS,
+		ConfigType: &corev3.TransportSocket_TypedConfig{
+			TypedConfig: tlsCtxAny,
+		},
+	}, nil
+}
diff --git a/adapter/internal/operator/gateway-api/translator/translator_test.go b/adapter/internal/operator/gateway-api/translator/translator_test.go
new file mode 100644
index 000000000..2f47340b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/translator_test.go
@@ -0,0 +1,556 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"embed"
+	"flag"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/stretchr/testify/require"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/utils"
+	"github.com/wso2/apk/adapter/pkg/utils/file"
+	"sigs.k8s.io/yaml"
+)
+
+var (
+	//go:embed testdata/out/*
+	outFiles embed.FS
+	//go:embed testdata/in/*
+	inFiles embed.FS
+
+	overrideTestData = flag.Bool("override-testdata", false, "if override the test output data.")
+)
+
+func TestTranslateXds(t *testing.T) {
+	testCases := []struct {
+		name                      string
+		dnsDomain                 string
+		requireSecrets            bool
+		requireEnvoyPatchPolicies bool
+	}{
+		{
+			name: "empty",
+		},
+		{
+			name: "http-route",
+		},
+		{
+			name: "http-route-regex",
+		},
+		{
+			name: "http-route-redirect",
+		},
+		{
+			name: "http-route-mirror",
+		},
+		{
+			name: "http-route-multiple-mirrors",
+		},
+		{
+			name: "http-route-multiple-matches",
+		},
+		{
+			name: "http-route-direct-response",
+		},
+		{
+			name: "http-route-request-headers",
+		},
+		{
+			name: "http-route-response-add-headers",
+		},
+		{
+			name: "http-route-response-remove-headers",
+		},
+		{
+			name: "http-route-response-add-remove-headers",
+		},
+		{
+			name: "http-route-weighted-invalid-backend",
+		},
+		{
+			name: "http-route-dns-cluster",
+		},
+		{
+			name:           "http-route-with-tls-system-truststore",
+			requireSecrets: true,
+		},
+		{
+			name:           "http-route-with-tlsbundle",
+			requireSecrets: true,
+		},
+		{
+			name:           "http-route-with-tlsbundle-multiple-certs",
+			requireSecrets: true,
+		},
+		{
+			name:           "simple-tls",
+			requireSecrets: true,
+		},
+		{
+			name:           "mutual-tls",
+			requireSecrets: true,
+		},
+		{
+			name:           "http3",
+			requireSecrets: true,
+		},
+		{
+			name: "tls-route-passthrough",
+		},
+		{
+			name: "tcp-route-simple",
+		},
+		{
+			name: "tcp-route-complex",
+		},
+		{
+			name: "tcp-route-tls-terminate",
+		},
+		{
+			name: "multiple-simple-tcp-route-same-port",
+		},
+		{
+			name: "http-route-weighted-backend",
+		},
+		{
+			name: "tcp-route-weighted-backend",
+		},
+		{
+			name:           "multiple-listeners-same-port",
+			requireSecrets: true,
+		},
+		{
+			name: "udp-route",
+		},
+		{
+			name: "http2-route",
+		},
+		{
+			name: "http-route-rewrite-url-prefix",
+		},
+		{
+			name: "http-route-rewrite-root-path-url-prefix",
+		},
+		{
+			name: "http-route-rewrite-url-fullpath",
+		},
+		{
+			name: "http-route-rewrite-url-host",
+		},
+		{
+			name: "http-route-timeout",
+		},
+		{
+			name: "accesslog",
+		},
+		{
+			name: "tracing",
+		},
+		{
+			name: "metrics-virtual-host",
+		},
+		{
+			name:                      "jsonpatch-missing-resource",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-invalid-patch",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-add-op-without-value",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name:                      "jsonpatch-move-op-with-value",
+			requireEnvoyPatchPolicies: true,
+		},
+		{
+			name: "listener-tcp-keepalive",
+		},
+		{
+			name: "load-balancer",
+		},
+		{
+			name: "cors",
+		},
+		{
+			name: "oidc",
+		},
+		{
+			name: "http-route-partial-invalid",
+		},
+		{
+			name: "listener-proxy-protocol",
+		},
+		{
+			name: "proxy-protocol-upstream",
+		},
+		{
+			name: "basic-auth",
+		},
+		{
+			name: "health-check",
+		},
+		{
+			name: "circuit-breaker",
+		},
+		{
+			name: "suppress-envoy-headers",
+		},
+		{
+			name: "fault-injection",
+		},
+		{
+			name: "tls-with-ciphers-versions-alpn",
+		},
+		{
+			name: "path-settings",
+		},
+		{
+			name: "http1-trailers",
+		},
+		{
+			name: "http1-preserve-case",
+		},
+		{
+			name: "timeout",
+		},
+		{
+			name: "ext-auth",
+		},
+		{
+			name: "http10",
+		},
+		{
+			name: "upstream-tcpkeepalive",
+		},
+		{
+			name: "client-timeout",
+		},
+		{
+			name: "retry-partial-invalid",
+		},
+		{
+			name: "multiple-listeners-same-port-with-different-filters",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			dnsDomain := tc.dnsDomain
+			if dnsDomain == "" {
+				dnsDomain = "cluster.local"
+			}
+			ir := requireXdsIRFromInputTestData(t, "xds-ir", tc.name+".yaml")
+			tr := &Translator{
+				// GlobalRateLimit: &GlobalRateLimitSettings{
+				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", dnsDomain),
+				// },
+			}
+
+			tCtx, err := tr.Translate(ir)
+			if !strings.HasSuffix(tc.name, "partial-invalid") {
+				require.NoError(t, err)
+			}
+
+			listeners := tCtx.XdsResources[resourcev3.ListenerType]
+			routes := tCtx.XdsResources[resourcev3.RouteType]
+			clusters := tCtx.XdsResources[resourcev3.ClusterType]
+			endpoints := tCtx.XdsResources[resourcev3.EndpointType]
+			if *overrideTestData {
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, listeners), filepath.Join("testdata", "out", "xds-ir", tc.name+".listeners.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, routes), filepath.Join("testdata", "out", "xds-ir", tc.name+".routes.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, clusters), filepath.Join("testdata", "out", "xds-ir", tc.name+".clusters.yaml")))
+				require.NoError(t, file.Write(requireResourcesToYAMLString(t, endpoints), filepath.Join("testdata", "out", "xds-ir", tc.name+".endpoints.yaml")))
+			}
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".listeners.yaml"), requireResourcesToYAMLString(t, listeners))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".routes.yaml"), requireResourcesToYAMLString(t, routes))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".clusters.yaml"), requireResourcesToYAMLString(t, clusters))
+			require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".endpoints.yaml"), requireResourcesToYAMLString(t, endpoints))
+			if tc.requireSecrets {
+				secrets := tCtx.XdsResources[resourcev3.SecretType]
+				if *overrideTestData {
+					require.NoError(t, file.Write(requireResourcesToYAMLString(t, secrets), filepath.Join("testdata", "out", "xds-ir", tc.name+".secrets.yaml")))
+				}
+				require.Equal(t, requireTestDataOutFile(t, "xds-ir", tc.name+".secrets.yaml"), requireResourcesToYAMLString(t, secrets))
+			}
+		})
+	}
+}
+
+func TestTranslateXdsNegative(t *testing.T) {
+	testCases := []struct {
+		name           string
+		dnsDomain      string
+		requireSecrets bool
+	}{
+		{
+			name: "http-route-invalid",
+		},
+		{
+			name: "tcp-route-invalid",
+		},
+		{
+			name: "tcp-route-invalid-endpoint",
+		},
+		{
+			name: "udp-route-invalid",
+		},
+		{
+			name: "jsonpatch-invalid",
+		},
+		{
+			name: "accesslog-invalid",
+		},
+		{
+			name: "tracing-invalid",
+		},
+		{
+			name: "jsonpatch-invalid-listener",
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			dnsDomain := tc.dnsDomain
+			if dnsDomain == "" {
+				dnsDomain = "cluster.local"
+			}
+			ir := requireXdsIRFromInputTestData(t, "xds-ir", tc.name+".yaml")
+			tr := &Translator{
+				// GlobalRateLimit: &GlobalRateLimitSettings{
+				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", dnsDomain),
+				// },
+			}
+
+			_, err := tr.Translate(ir)
+			require.Error(t, err)
+			if tc.name != "jsonpatch-invalid" {
+				require.Contains(t, err.Error(), "validation failed for xds resource")
+			}
+		})
+	}
+}
+
+// func TestTranslateRateLimitConfig(t *testing.T) {
+// 	testCases := []struct {
+// 		name string
+// 	}{
+// 		{
+// 			name: "empty-header-matches",
+// 		},
+// 		{
+// 			name: "distinct-match",
+// 		},
+// 		{
+// 			name: "distinct-remote-address-match",
+// 		},
+// 		{
+// 			name: "value-match",
+// 		},
+// 		{
+// 			name: "multiple-matches",
+// 		},
+// 		{
+// 			name: "multiple-rules",
+// 		},
+// 		{
+// 			name: "multiple-routes",
+// 		},
+// 		{
+// 			name: "masked-remote-address-match",
+// 		},
+// 		{
+// 			name: "multiple-masked-remote-address-match-with-same-cidr",
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			in := requireXdsIRListenerFromInputTestData(t, "ratelimit-config", tc.name+".yaml")
+// 			out := BuildRateLimitServiceConfig(in)
+// 			if *overrideTestData {
+// 				require.NoError(t, file.Write(requireYamlRootToYAMLString(t, out), filepath.Join("testdata", "out", "ratelimit-config", tc.name+".yaml")))
+// 			}
+// 			require.Equal(t, requireTestDataOutFile(t, "ratelimit-config", tc.name+".yaml"), requireYamlRootToYAMLString(t, out))
+// 		})
+// 	}
+// }
+
+// func TestTranslateXdsWithExtension(t *testing.T) {
+// 	testCases := []struct {
+// 		name           string
+// 		requireSecrets bool
+// 		err            string
+// 	}{
+// 		// Require secrets for all the tests since the extension for testing always injects one
+// 		{
+// 			name:           "empty",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route-extension-filter",
+// 			requireSecrets: true,
+// 			err:            "",
+// 		},
+// 		{
+// 			name:           "http-route-extension-route-error",
+// 			requireSecrets: true,
+// 			err:            "route hook resource error",
+// 		},
+// 		{
+// 			name:           "http-route-extension-virtualhost-error",
+// 			requireSecrets: true,
+// 			err:            "extension post xds virtual host hook error",
+// 		},
+// 		{
+// 			name:           "http-route-extension-listener-error",
+// 			requireSecrets: true,
+// 			err:            "extension post xds listener hook error",
+// 		},
+// 	}
+
+// 	for _, tc := range testCases {
+// 		tc := tc
+// 		t.Run(tc.name, func(t *testing.T) {
+// 			// Testdata for the extension tests is similar to the ir test dat
+// 			// New directory is just to keep them separate and easy to understand
+// 			ir := requireXdsIRFromInputTestData(t, "extension-xds-ir", tc.name+".yaml")
+// 			tr := &Translator{
+// 				// GlobalRateLimit: &GlobalRateLimitSettings{
+// 				// 	ServiceURL: ratelimit.GetServiceURL("envoy-gateway-system", "cluster.local"),
+// 				// },
+// 			}
+// 			// ext := v1alpha1.ExtensionManager{
+// 			// 	Resources: []v1alpha1.GroupVersionKind{
+// 			// 		{
+// 			// 			Group:   "foo.example.io",
+// 			// 			Version: "v1alpha1",
+// 			// 			Kind:    "examplefilter",
+// 			// 		},
+// 			// 	},
+// 			// 	Hooks: &v1alpha1.ExtensionHooks{
+// 			// 		XDSTranslator: &v1alpha1.XDSTranslatorHooks{
+// 			// 			Post: []v1alpha1.XDSTranslatorHook{
+// 			// 				v1alpha1.XDSRoute,
+// 			// 				v1alpha1.XDSVirtualHost,
+// 			// 				v1alpha1.XDSHTTPListener,
+// 			// 				v1alpha1.XDSTranslation,
+// 			// 			},
+// 			// 		},
+// 			// 	},
+// 			// }
+// 			// extMgr := testutils.NewManager(ext)
+// 			// tr.ExtensionManager = &extMgr
+
+// 			tCtx, err := tr.Translate(ir)
+
+// 			if tc.err != "" {
+// 				require.EqualError(t, err, tc.err)
+// 			} else {
+// 				require.NoError(t, err)
+// 				listeners := tCtx.XdsResources[resourcev3.ListenerType]
+// 				routes := tCtx.XdsResources[resourcev3.RouteType]
+// 				clusters := tCtx.XdsResources[resourcev3.ClusterType]
+// 				endpoints := tCtx.XdsResources[resourcev3.EndpointType]
+// 				if *overrideTestData {
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, listeners), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".listeners.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, routes), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".routes.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, clusters), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".clusters.yaml")))
+// 					require.NoError(t, file.Write(requireResourcesToYAMLString(t, endpoints), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".endpoints.yaml")))
+// 				}
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".listeners.yaml"), requireResourcesToYAMLString(t, listeners))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".routes.yaml"), requireResourcesToYAMLString(t, routes))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".clusters.yaml"), requireResourcesToYAMLString(t, clusters))
+// 				require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".endpoints.yaml"), requireResourcesToYAMLString(t, endpoints))
+// 				if tc.requireSecrets {
+// 					secrets := tCtx.XdsResources[resourcev3.SecretType]
+// 					if *overrideTestData {
+// 						require.NoError(t, file.Write(requireResourcesToYAMLString(t, secrets), filepath.Join("testdata", "out", "extension-xds-ir", tc.name+".secrets.yaml")))
+// 					}
+// 					require.Equal(t, requireTestDataOutFile(t, "extension-xds-ir", tc.name+".secrets.yaml"), requireResourcesToYAMLString(t, secrets))
+// 				}
+// 			}
+// 		})
+// 	}
+// }
+
+func requireXdsIRFromInputTestData(t *testing.T, name ...string) *ir.Xds {
+	t.Helper()
+	elems := append([]string{"testdata", "in"}, name...)
+	content, err := inFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	ir := &ir.Xds{}
+	err = yaml.Unmarshal(content, ir)
+	require.NoError(t, err)
+	return ir
+}
+
+func requireXdsIRListenerFromInputTestData(t *testing.T, name ...string) *ir.HTTPListener {
+	t.Helper()
+	elems := append([]string{"testdata", "in"}, name...)
+	content, err := inFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	listener := &ir.HTTPListener{}
+	err = yaml.Unmarshal(content, listener)
+	require.NoError(t, err)
+	return listener
+}
+
+func requireTestDataOutFile(t *testing.T, name ...string) string {
+	t.Helper()
+	elems := append([]string{"testdata", "out"}, name...)
+	content, err := outFiles.ReadFile(filepath.Join(elems...))
+	require.NoError(t, err)
+	return string(content)
+}
+
+// func requireYamlRootToYAMLString(t *testing.T, pbRoot *ratelimitv3.RateLimitConfig) string {
+// 	str, err := GetRateLimitServiceConfigStr(pbRoot)
+// 	require.NoError(t, err)
+// 	return str
+// }
+
+func requireResourcesToYAMLString(t *testing.T, resources []types.Resource) string {
+	jsonBytes, err := utils.MarshalResourcesToJSON(resources)
+	require.NoError(t, err)
+	data, err := yaml.JSONToYAML(jsonBytes)
+	require.NoError(t, err)
+	return string(data)
+}
diff --git a/adapter/internal/operator/gateway-api/translator/utils.go b/adapter/internal/operator/gateway-api/translator/utils.go
new file mode 100644
index 000000000..90f1d3882
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/translator/utils.go
@@ -0,0 +1,135 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package translator
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"net/url"
+	"strconv"
+	"strings"
+
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	defaultHTTPSPort                uint64 = 443
+	defaultHTTPPort                 uint64 = 80
+	defaultExtServiceRequestTimeout        = 10 // 10 seconds
+)
+
+// urlCluster is a cluster that is created from a URL.
+type urlCluster struct {
+	name         string
+	hostname     string
+	port         uint32
+	endpointType EndpointType
+	tls          bool
+}
+
+// url2Cluster returns a urlCluster from the provided url.
+func url2Cluster(strURL string) (*urlCluster, error) {
+	epType := EndpointTypeDNS
+
+	// The URL should have already been validated in the gateway API translator.
+	u, err := url.Parse(strURL)
+	if err != nil {
+		return nil, err
+	}
+
+	var port uint64
+	if u.Scheme == "https" {
+		port = defaultHTTPSPort
+	} else {
+		port = defaultHTTPPort
+	}
+
+	if u.Port() != "" {
+		port, err = strconv.ParseUint(u.Port(), 10, 32)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	name := clusterName(u.Hostname(), uint32(port))
+
+	if ip, err := netip.ParseAddr(u.Hostname()); err == nil {
+		if ip.Unmap().Is4() {
+			epType = EndpointTypeStatic
+		}
+	}
+
+	return &urlCluster{
+		name:         name,
+		hostname:     u.Hostname(),
+		port:         uint32(port),
+		endpointType: epType,
+		tls:          u.Scheme == "https",
+	}, nil
+}
+
+func clusterName(host string, port uint32) string {
+	return fmt.Sprintf("%s_%d", strings.ReplaceAll(host, ".", "_"), port)
+}
+
+// enableFilterOnRoute enables a filterType on the provided route.
+func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HTTPRoute) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
+
+	filterName := perRouteFilterName(filterType, irRoute.Name)
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[filterName]; ok {
+		// This should not happen since this is the only place where the filter
+		// config is added in a route.
+		return fmt.Errorf("route already contains filter config: %s, %+v",
+			filterType, route)
+	}
+
+	// Enable the corresponding filter for this route.
+	routeCfgAny, err := anypb.New(&routev3.FilterConfig{
+		Config: &anypb.Any{},
+	})
+	if err != nil {
+		return err
+	}
+
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+
+	route.TypedPerFilterConfig[filterName] = routeCfgAny
+
+	return nil
+}
+
+func perRouteFilterName(filterType, routeName string) string {
+	return fmt.Sprintf("%s_%s", filterType, routeName)
+}
diff --git a/adapter/internal/operator/gateway-api/types/tls_types.go b/adapter/internal/operator/gateway-api/types/tls_types.go
new file mode 100644
index 000000000..cc891cab3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/types/tls_types.go
@@ -0,0 +1,145 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && self.minVersion == '1.3' ? !has(self.ciphers) : true", message="setting ciphers has no effect if the minimum possible TLS version is 1.3"
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && has(self.maxVersion) ? {\"Auto\":0,\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4}[self.minVersion] <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : true", message="minVersion must be smaller or equal to maxVersion"
+type TLSSettings struct {
+
+	// Min specifies the minimal TLS protocol version to allow.
+	// The default is TLS 1.2 if this is not specified.
+	//
+	// +optional
+	MinVersion *TLSVersion `json:"minVersion,omitempty"`
+
+	// Max specifies the maximal TLS protocol version to allow
+	// The default is TLS 1.3 if this is not specified.
+	//
+	// +optional
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty"`
+
+	// Ciphers specifies the set of cipher suites supported when
+	// negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
+	// In non-FIPS Envoy Proxy builds the default cipher list is:
+	// - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
+	// - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	// In builds using BoringSSL FIPS the default cipher list is:
+	// - ECDHE-ECDSA-AES128-GCM-SHA256
+	// - ECDHE-RSA-AES128-GCM-SHA256
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	//
+	// +optional
+	Ciphers []string `json:"ciphers,omitempty"`
+
+	// ECDHCurves specifies the set of supported ECDH curves.
+	// In non-FIPS Envoy Proxy builds the default curves are:
+	// - X25519
+	// - P-256
+	// In builds using BoringSSL FIPS the default curve is:
+	// - P-256
+	//
+	// +optional
+	ECDHCurves []string `json:"ecdhCurves,omitempty"`
+
+	// SignatureAlgorithms specifies which signature algorithms the listener should
+	// support.
+	//
+	// +optional
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty"`
+
+	// ALPNProtocols supplies the list of ALPN protocols that should be
+	// exposed by the listener. By default h2 and http/1.1 are enabled.
+	// Supported values are:
+	// - http/1.0
+	// - http/1.1
+	// - h2
+	//
+	// +optional
+	ALPNProtocols []ALPNProtocol `json:"alpnProtocols,omitempty"`
+
+	// ClientValidation specifies the configuration to validate the client
+	// initiating the TLS connection to the Gateway listener.
+	// +optional
+	ClientValidation *ClientValidationContext `json:"clientValidation,omitempty"`
+}
+
+// ALPNProtocol specifies the protocol to be negotiated using ALPN
+// +kubebuilder:validation:Enum=http/1.0;http/1.1;h2
+type ALPNProtocol string
+
+// When adding ALPN constants, they must be values that are defined
+// in the IANA registry for ALPN identification sequences
+// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+const (
+	// HTTPProtocolVersion1_0 specifies that HTTP/1.0 should be negotiable with ALPN
+	HTTPProtocolVersion1_0 ALPNProtocol = "http/1.0"
+	// HTTPProtocolVersion1_1 specifies that HTTP/1.1 should be negotiable with ALPN
+	HTTPProtocolVersion1_1 ALPNProtocol = "http/1.1"
+	// HTTPProtocolVersion2 specifies that HTTP/2 should be negotiable with ALPN
+	HTTPProtocolVersion2 ALPNProtocol = "h2"
+)
+
+// TLSVersion specifies the TLS version
+// +kubebuilder:validation:Enum=Auto;"1.0";"1.1";"1.2";"1.3"
+type TLSVersion string
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto TLSVersion = "Auto"
+	// TLS1.0 specifies TLS version 1.0
+	TLSv10 TLSVersion = "1.0"
+	// TLS1.1 specifies TLS version 1.1
+	TLSv11 TLSVersion = "1.1"
+	// TLSv1.2 specifies TLS version 1.2
+	TLSv12 TLSVersion = "1.2"
+	// TLSv1.3 specifies TLS version 1.3
+	TLSv13 TLSVersion = "1.3"
+)
+
+// ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection
+// to the Gateway.
+// By default, no client specific configuration is validated.
+type ClientValidationContext struct {
+	// CACertificateRefs contains one or more references to
+	// Kubernetes objects that contain TLS certificates of
+	// the Certificate Authorities that can be used
+	// as a trust anchor to validate the certificates presented by the client.
+	//
+	// A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
+	// with the CA certificate in a key named `ca.crt` is currently supported.
+	//
+	// References to a resource in different namespace are invalid UNLESS there
+	// is a ReferenceGrant in the target namespace that allows the certificate
+	// to be attached.
+	//
+	// +kubebuilder:validation:MaxItems=8
+	// +optional
+	CACertificateRefs []gwapiv1.SecretObjectReference `json:"caCertificateRefs,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go b/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
new file mode 100644
index 000000000..0e72150a5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/accesslogging_types.go
@@ -0,0 +1,136 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLog struct {
+	// Disable disables access logging for managed proxies if set to true.
+	Disable bool `json:"disable,omitempty"`
+	// Settings defines accesslog settings for managed proxies.
+	// If unspecified, will send default format to stdout.
+	// +optional
+	Settings []ProxyAccessLogSetting `json:"settings,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogSetting struct {
+	// Format defines the format of accesslog.
+	Format ProxyAccessLogFormat `json:"format"`
+	// Sinks defines the sinks of accesslog.
+	// +kubebuilder:validation:MinItems=1
+	Sinks []ProxyAccessLogSink `json:"sinks"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogFormatType string
+
+const (
+	// ProxyAccessLogFormatTypeText defines the text accesslog format.
+	ProxyAccessLogFormatTypeText ProxyAccessLogFormatType = "Text"
+	// ProxyAccessLogFormatTypeJSON defines the JSON accesslog format.
+	ProxyAccessLogFormatTypeJSON ProxyAccessLogFormatType = "JSON"
+	// TODO: support format type "mix" in the future.
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyAccessLogFormat defines the format of accesslog.
+// By default accesslogs are written to standard output.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'Text' ? has(self.text) : !has(self.text)",message="If AccessLogFormat type is Text, text field needs to be set."
+// +kubebuilder:validation:XValidation:rule="self.type == 'JSON' ? has(self.json) : !has(self.json)",message="If AccessLogFormat type is JSON, json field needs to be set."
+type ProxyAccessLogFormat struct {
+	// Type defines the type of accesslog format.
+	// +kubebuilder:validation:Enum=Text;JSON
+	// +unionDiscriminator
+	Type ProxyAccessLogFormatType `json:"type,omitempty"`
+	// Text defines the text accesslog format, following Envoy accesslog formatting,
+	// It's required when the format type is "Text".
+	// Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators) may be used in the format.
+	// The [format string documentation](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#config-access-log-format-strings) provides more information.
+	// +optional
+	Text *string `json:"text,omitempty"`
+	// JSON is additional attributes that describe the specific event occurrence.
+	// Structured format for the envoy access logs. Envoy [command operators](https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage#command-operators)
+	// can be used as values for fields within the Struct.
+	// It's required when the format type is "JSON".
+	// +optional
+	JSON map[string]string `json:"json,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyAccessLogSinkType string
+
+const (
+	// ProxyAccessLogSinkTypeFile defines the file accesslog sink.
+	ProxyAccessLogSinkTypeFile ProxyAccessLogSinkType = "File"
+	// ProxyAccessLogSinkTypeOpenTelemetry defines the OpenTelemetry accesslog sink.
+	// When the provider is Kubernetes, EnvoyGateway always sends `k8s.namespace.name`
+	// and `k8s.pod.name` as additional attributes.
+	ProxyAccessLogSinkTypeOpenTelemetry ProxyAccessLogSinkType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyAccessLogSink defines the sink of accesslog.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'File' ? has(self.file) : !has(self.file)",message="If AccessLogSink type is File, file field needs to be set."
+// +kubebuilder:validation:XValidation:rule="self.type == 'OpenTelemetry' ? has(self.openTelemetry) : !has(self.openTelemetry)",message="If AccessLogSink type is OpenTelemetry, openTelemetry field needs to be set."
+type ProxyAccessLogSink struct {
+	// Type defines the type of accesslog sink.
+	// +kubebuilder:validation:Enum=File;OpenTelemetry
+	// +unionDiscriminator
+	Type ProxyAccessLogSinkType `json:"type,omitempty"`
+	// File defines the file accesslog sink.
+	// +optional
+	File *FileEnvoyProxyAccessLog `json:"file,omitempty"`
+	// OpenTelemetry defines the OpenTelemetry accesslog sink.
+	// +optional
+	OpenTelemetry *OpenTelemetryEnvoyProxyAccessLog `json:"openTelemetry,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type FileEnvoyProxyAccessLog struct {
+	// Path defines the file path used to expose envoy access log(e.g. /dev/stdout).
+	// +kubebuilder:validation:MinLength=1
+	Path string `json:"path,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// TODO: consider reuse ExtensionService?
+type OpenTelemetryEnvoyProxyAccessLog struct {
+	// Host define the extension service hostname.
+	Host string `json:"host"`
+	// Port defines the port the extension service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+	// Resources is a set of labels that describe the source of a log entry, including envoy node info.
+	// It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).
+	// +optional
+	Resources map[string]string `json:"resources,omitempty"`
+
+	// TODO: support more OpenTelemetry accesslog options(e.g. TLS, auth etc.) in the future.
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
new file mode 100644
index 000000000..666f39b99
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
@@ -0,0 +1,150 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"fmt"
+	"sort"
+	"strings"
+
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	v1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/utils/ptr"
+)
+
+// DefaultEnvoyProxyProvider returns a new EnvoyProxyProvider with default settings.
+func DefaultEnvoyProxyProvider() *EnvoyProxyProvider {
+	return &EnvoyProxyProvider{
+		Type: ProviderTypeKubernetes,
+	}
+}
+
+// GetEnvoyProxyProvider returns the EnvoyProxyProvider of EnvoyProxy or a default EnvoyProxyProvider
+// if unspecified.
+func (e *EnvoyProxy) GetEnvoyProxyProvider() *EnvoyProxyProvider {
+	if e.Spec.Provider != nil {
+		return e.Spec.Provider
+	}
+	e.Spec.Provider = DefaultEnvoyProxyProvider()
+
+	return e.Spec.Provider
+}
+
+// DefaultEnvoyProxyKubeProvider returns a new EnvoyProxyKubernetesProvider with default settings.
+func DefaultEnvoyProxyKubeProvider() *EnvoyProxyKubernetesProvider {
+	return &EnvoyProxyKubernetesProvider{
+		EnvoyDeployment: DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage),
+		EnvoyService:    DefaultKubernetesService(),
+	}
+}
+
+func DefaultEnvoyProxyHpaMetrics() []autoscalingv2.MetricSpec {
+	return []autoscalingv2.MetricSpec{
+		{
+			Resource: &autoscalingv2.ResourceMetricSource{
+				Name: v1.ResourceCPU,
+				Target: autoscalingv2.MetricTarget{
+					Type:               autoscalingv2.UtilizationMetricType,
+					AverageUtilization: ptr.To[int32](80),
+				},
+			},
+			Type: autoscalingv2.ResourceMetricSourceType,
+		},
+	}
+}
+
+// GetEnvoyProxyKubeProvider returns the EnvoyProxyKubernetesProvider of EnvoyProxyProvider or
+// a default EnvoyProxyKubernetesProvider if unspecified. If EnvoyProxyProvider is not of
+// type "Kubernetes", a nil EnvoyProxyKubernetesProvider is returned.
+func (r *EnvoyProxyProvider) GetEnvoyProxyKubeProvider() *EnvoyProxyKubernetesProvider {
+	if r.Type != ProviderTypeKubernetes {
+		return nil
+	}
+
+	if r.Kubernetes == nil {
+		r.Kubernetes = DefaultEnvoyProxyKubeProvider()
+		return r.Kubernetes
+	}
+
+	if r.Kubernetes.EnvoyDeployment == nil {
+		r.Kubernetes.EnvoyDeployment = DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+	}
+
+	r.Kubernetes.EnvoyDeployment.defaultKubernetesDeploymentSpec(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+
+	if r.Kubernetes.EnvoyService == nil {
+		r.Kubernetes.EnvoyService = DefaultKubernetesService()
+	}
+
+	if r.Kubernetes.EnvoyService.Type == nil {
+		r.Kubernetes.EnvoyService.Type = GetKubernetesServiceType(ServiceTypeLoadBalancer)
+	}
+
+	if r.Kubernetes.EnvoyHpa != nil {
+		r.Kubernetes.EnvoyHpa.setDefault()
+	}
+
+	return r.Kubernetes
+}
+
+// DefaultEnvoyProxyLoggingLevel returns envoy proxy  v1alpha1.LogComponentGatewayDefault log level.
+// If unspecified, defaults to "warn". When specified, all other logging components are ignored.
+func (logging *ProxyLogging) DefaultEnvoyProxyLoggingLevel() LogLevel {
+	if logging.Level[LogComponentDefault] != "" {
+		return logging.Level[LogComponentDefault]
+	}
+
+	return LogLevelWarn
+}
+
+// GetEnvoyProxyComponentLevel returns envoy proxy component log level args.
+// xref: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#cmdoption-component-log-level
+func (logging *ProxyLogging) GetEnvoyProxyComponentLevel() string {
+	var args []string
+
+	for component, level := range logging.Level {
+		if component == LogComponentDefault {
+			// Skip default component
+			continue
+		}
+
+		if level != "" {
+			args = append(args, fmt.Sprintf("%s:%s", component, level))
+		}
+	}
+
+	sort.Strings(args)
+
+	return strings.Join(args, ",")
+}
+
+// DefaultShutdownManagerContainerResourceRequirements returns a new ResourceRequirements with default settings.
+func DefaultShutdownManagerContainerResourceRequirements() *v1.ResourceRequirements {
+	return &v1.ResourceRequirements{
+		Requests: v1.ResourceList{
+			v1.ResourceCPU:    resource.MustParse(DefaultShutdownManagerCPUResourceRequests),
+			v1.ResourceMemory: resource.MustParse(DefaultShutdownManagerMemoryResourceRequests),
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
new file mode 100644
index 000000000..a448b782a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_metric_types.go
@@ -0,0 +1,88 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+type MetricSinkType string
+
+const (
+	MetricSinkTypeOpenTelemetry MetricSinkType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+type ProxyMetrics struct {
+	// Prometheus defines the configuration for Admin endpoint `/stats/prometheus`.
+	Prometheus *ProxyPrometheusProvider `json:"prometheus,omitempty"`
+	// Sinks defines the metric sinks where metrics are sent to.
+	Sinks []ProxyMetricSink `json:"sinks,omitempty"`
+	// Matches defines configuration for selecting specific metrics instead of generating all metrics stats
+	// that are enabled by default. This helps reduce CPU and memory overhead in Envoy, but eliminating some stats
+	// may after critical functionality. Here are the stats that we strongly recommend not disabling:
+	// `cluster_manager.warming_clusters`, `cluster.<cluster_name>.membership_total`,`cluster.<cluster_name>.membership_healthy`,
+	// `cluster.<cluster_name>.membership_degraded`，reference  https://github.com/envoyproxy/envoy/issues/9856,
+	// https://github.com/envoyproxy/envoy/issues/14610
+	//
+	Matches []StringMatch `json:"matches,omitempty"`
+
+	// EnableVirtualHostStats enables envoy stat metrics for virtual hosts.
+	EnableVirtualHostStats bool `json:"enableVirtualHostStats,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyMetricSink defines the sink of metrics.
+// Default metrics sink is OpenTelemetry.
+// +union
+//
+// +kubebuilder:validation:XValidation:rule="self.type == 'OpenTelemetry' ? has(self.openTelemetry) : !has(self.openTelemetry)",message="If MetricSink type is OpenTelemetry, openTelemetry field needs to be set."
+type ProxyMetricSink struct {
+	// Type defines the metric sink type.
+	// EG currently only supports OpenTelemetry.
+	// +kubebuilder:validation:Enum=OpenTelemetry
+	// +kubebuilder:default=OpenTelemetry
+	// +unionDiscriminator
+	Type MetricSinkType `json:"type"`
+	// OpenTelemetry defines the configuration for OpenTelemetry sink.
+	// It's required if the sink type is OpenTelemetry.
+	// +optional
+	OpenTelemetry *ProxyOpenTelemetrySink `json:"openTelemetry,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyOpenTelemetrySink struct {
+	// Host define the service hostname.
+	Host string `json:"host"`
+	// Port defines the port the service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=65535
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+
+	// TODO: add support for customizing OpenTelemetry sink in https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/stat_sinks/open_telemetry/v3/open_telemetry.proto#envoy-v3-api-msg-extensions-stat-sinks-open-telemetry-v3-sinkconfig
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyPrometheusProvider struct {
+	// Disable the Prometheus endpoint.
+	Disable bool `json:"disable,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
new file mode 100644
index 000000000..b0b36db1a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
@@ -0,0 +1,278 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	// KindEnvoyProxy is the name of the EnvoyProxy kind.
+	KindEnvoyProxy = "EnvoyProxy"
+)
+
+// +kubebuilder:object:root=true
+// +kubebuilder:resource:categories=envoy-gateway,shortName=eproxy
+// +kubebuilder:subresource:status
+
+// EnvoyProxy is the schema for the envoyproxies API.
+type EnvoyProxy struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+
+	// EnvoyProxySpec defines the desired state of EnvoyProxy.
+	Spec EnvoyProxySpec `json:"spec,omitempty"`
+	// EnvoyProxyStatus defines the actual state of EnvoyProxy.
+	Status EnvoyProxyStatus `json:"status,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxySpec defines the desired state of EnvoyProxy.
+type EnvoyProxySpec struct {
+	// Provider defines the desired resource provider and provider-specific configuration.
+	// If unspecified, the "Kubernetes" resource provider is used with default configuration
+	// parameters.
+	//
+	// +optional
+	Provider *EnvoyProxyProvider `json:"provider,omitempty"`
+
+	// Logging defines logging parameters for managed proxies.
+	// +kubebuilder:default={level: {default: warn}}
+	Logging ProxyLogging `json:"logging,omitempty"`
+
+	// Telemetry defines telemetry parameters for managed proxies.
+	//
+	// +optional
+	Telemetry *ProxyTelemetry `json:"telemetry,omitempty"`
+
+	// Bootstrap defines the Envoy Bootstrap as a YAML string.
+	// Visit https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-msg-config-bootstrap-v3-bootstrap
+	// to learn more about the syntax.
+	// If set, this is the Bootstrap configuration used for the managed Envoy Proxy fleet instead of the default Bootstrap configuration
+	// set by Envoy Gateway.
+	// Some fields within the Bootstrap that are required to communicate with the xDS Server (Envoy Gateway) and receive xDS resources
+	// from it are not configurable and will result in the `EnvoyProxy` resource being rejected.
+	// Backward compatibility across minor versions is not guaranteed.
+	// We strongly recommend using `egctl x translate` to generate a `EnvoyProxy` resource with the `Bootstrap` field set to the default
+	// Bootstrap configuration used. You can edit this configuration, and rerun `egctl x translate` to ensure there are no validation errors.
+	//
+	// +optional
+	Bootstrap *ProxyBootstrap `json:"bootstrap,omitempty"`
+
+	// Concurrency defines the number of worker threads to run. If unset, it defaults to
+	// the number of cpuset threads on the platform.
+	//
+	// +optional
+	Concurrency *int32 `json:"concurrency,omitempty"`
+
+	// ExtraArgs defines additional command line options that are provided to Envoy.
+	// More info: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#command-line-options
+	// Note: some command line options are used internally(e.g. --log-level) so they cannot be provided here.
+	//
+	// +optional
+	ExtraArgs []string `json:"extraArgs,omitempty"`
+
+	// MergeGateways defines if Gateway resources should be merged onto the same Envoy Proxy Infrastructure.
+	// Setting this field to true would merge all Gateway Listeners under the parent Gateway Class.
+	// This means that the port, protocol and hostname tuple must be unique for every listener.
+	// If a duplicate listener is detected, the newer listener (based on timestamp) will be rejected and its status will be updated with a "Accepted=False" condition.
+	//
+	// +optional
+	MergeGateways *bool `json:"mergeGateways,omitempty"`
+
+	// Shutdown defines configuration for graceful envoy shutdown process.
+	//
+	// +optional
+	Shutdown *ShutdownConfig `json:"shutdown,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ProxyTelemetry struct {
+	// AccessLogs defines accesslog parameters for managed proxies.
+	// If unspecified, will send default format to stdout.
+	// +optional
+	AccessLog *ProxyAccessLog `json:"accessLog,omitempty"`
+	// Tracing defines tracing configuration for managed proxies.
+	// If unspecified, will not send tracing data.
+	// +optional
+	Tracing *ProxyTracing `json:"tracing,omitempty"`
+
+	// Metrics defines metrics configuration for managed proxies.
+	Metrics *ProxyMetrics `json:"metrics,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyProvider defines the desired state of a resource provider.
+// +union
+type EnvoyProxyProvider struct {
+	// Type is the type of resource provider to use. A resource provider provides
+	// infrastructure resources for running the data plane, e.g. Envoy proxy, and
+	// optional auxiliary control planes. Supported types are "Kubernetes".
+	//
+	// +unionDiscriminator
+	Type ProviderType `json:"type"`
+	// Kubernetes defines the desired state of the Kubernetes resource provider.
+	// Kubernetes provides infrastructure resources for running the data plane,
+	// e.g. Envoy proxy. If unspecified and type is "Kubernetes", default settings
+	// for managed Kubernetes resources are applied.
+	//
+	// +optional
+	Kubernetes *EnvoyProxyKubernetesProvider `json:"kubernetes,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ShutdownConfig defines configuration for graceful envoy shutdown process.
+type ShutdownConfig struct {
+	// DrainTimeout defines the graceful drain timeout. This should be less than the pod's terminationGracePeriodSeconds.
+	// If unspecified, defaults to 600 seconds.
+	//
+	// +optional
+	DrainTimeout *metav1.Duration `json:"drainTimeout,omitempty"`
+	// MinDrainDuration defines the minimum drain duration allowing time for endpoint deprogramming to complete.
+	// If unspecified, defaults to 5 seconds.
+	//
+	// +optional
+	MinDrainDuration *metav1.Duration `json:"minDrainDuration,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyKubernetesProvider defines configuration for the Kubernetes resource
+// provider.
+type EnvoyProxyKubernetesProvider struct {
+	// EnvoyDeployment defines the desired state of the Envoy deployment resource.
+	// If unspecified, default settings for the managed Envoy deployment resource
+	// are applied.
+	//
+	// +optional
+	EnvoyDeployment *KubernetesDeploymentSpec `json:"envoyDeployment,omitempty"`
+
+	// EnvoyService defines the desired state of the Envoy service resource.
+	// If unspecified, default settings for the managed Envoy service resource
+	// are applied.
+	//
+	// +optional
+	EnvoyService *KubernetesServiceSpec `json:"envoyService,omitempty"`
+
+	// EnvoyHpa defines the Horizontal Pod Autoscaler settings for Envoy Proxy Deployment.
+	// Once the HPA is being set, Replicas field from EnvoyDeployment will be ignored.
+	//
+	// +optional
+	EnvoyHpa *KubernetesHorizontalPodAutoscalerSpec `json:"envoyHpa,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyLogging defines logging parameters for managed proxies.
+type ProxyLogging struct {
+	// Level is a map of logging level per component, where the component is the key
+	// and the log level is the value. If unspecified, defaults to "default: warn".
+	//
+	// +kubebuilder:default={default: warn}
+	Level map[ProxyLogComponent]LogLevel `json:"level,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ProxyLogComponent defines a component that supports a configured logging level.
+// +kubebuilder:validation:Enum=system;upstream;http;connection;admin;client;filter;main;router;runtime
+type ProxyLogComponent string
+
+const (
+	// LogComponentDefault defines the default logging component.
+	// See more details: https://www.envoyproxy.io/docs/envoy/latest/operations/cli#cmdoption-l
+	LogComponentDefault ProxyLogComponent = "default"
+
+	// LogComponentUpstream defines the "upstream" logging component.
+	LogComponentUpstream ProxyLogComponent = "upstream"
+
+	// LogComponentHTTP defines the "http" logging component.
+	LogComponentHTTP ProxyLogComponent = "http"
+
+	// LogComponentConnection defines the "connection" logging component.
+	LogComponentConnection ProxyLogComponent = "connection"
+
+	// LogComponentAdmin defines the "admin" logging component.
+	LogComponentAdmin ProxyLogComponent = "admin"
+
+	// LogComponentClient defines the "client" logging component.
+	LogComponentClient ProxyLogComponent = "client"
+
+	// LogComponentFilter defines the "filter" logging component.
+	LogComponentFilter ProxyLogComponent = "filter"
+
+	// LogComponentMain defines the "main" logging component.
+	LogComponentMain ProxyLogComponent = "main"
+
+	// LogComponentRouter defines the "router" logging component.
+	LogComponentRouter ProxyLogComponent = "router"
+
+	// LogComponentRuntime defines the "runtime" logging component.
+	LogComponentRuntime ProxyLogComponent = "runtime"
+)
+
+// +k8s:deepcopy-gen=true
+// ProxyBootstrap defines Envoy Bootstrap configuration.
+type ProxyBootstrap struct {
+	// Type is the type of the bootstrap configuration, it should be either Replace or Merge.
+	// If unspecified, it defaults to Replace.
+	// +optional
+	// +kubebuilder:default=Replace
+	Type *BootstrapType `json:"type"`
+
+	// Value is a YAML string of the bootstrap.
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// BootstrapType defines the types of bootstrap supported by Envoy Gateway.
+// +kubebuilder:validation:Enum=Merge;Replace
+type BootstrapType string
+
+const (
+	// Merge merges the provided bootstrap with the default one. The provided bootstrap can add or override a value
+	// within a map, or add a new value to a list.
+	// Please note that the provided bootstrap can't override a value within a list.
+	BootstrapTypeMerge BootstrapType = "Merge"
+
+	// Replace replaces the default bootstrap with the provided one.
+	BootstrapTypeReplace BootstrapType = "Replace"
+)
+
+// +k8s:deepcopy-gen=true
+// EnvoyProxyStatus defines the observed state of EnvoyProxy. This type is not implemented
+// until https://github.com/envoyproxy/gateway/issues/1007 is fixed.
+type EnvoyProxyStatus struct {
+	// INSERT ADDITIONAL STATUS FIELDS - define observed state of cluster.
+	// Important: Run "make" to regenerate code after modifying this file.
+}
+
+// +kubebuilder:object:root=true
+
+// EnvoyProxyList contains a list of EnvoyProxy
+type EnvoyProxyList struct {
+	metav1.TypeMeta `json:",inline"`
+	metav1.ListMeta `json:"metadata,omitempty"`
+	Items           []EnvoyProxy `json:"items"`
+}
+
+func init() {
+	SchemeBuilder.Register(&EnvoyProxy{}, &EnvoyProxyList{})
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go b/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
new file mode 100644
index 000000000..ea5c3d8b0
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/groupversion_info.go
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+const GroupName = "dp.wso2.com"
+
+var (
+
+	// GroupVersion is group version used to register these objects
+	GroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
+
+	// AddToScheme adds the types in this group-version to the given scheme.
+	AddToScheme = SchemeBuilder.AddToScheme
+)
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go b/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
new file mode 100644
index 000000000..c261eecc7
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/keepalive_types.go
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +k8s:deepcopy-gen=true
+// TCPKeepalive define the TCP Keepalive configuration.
+type TCPKeepalive struct {
+	// The total number of unacknowledged probes to send before deciding
+	// the connection is dead.
+	// Defaults to 9.
+	//
+	// +optional
+	Probes *uint32 `json:"probes,omitempty"`
+	// The duration a connection needs to be idle before keep-alive
+	// probes start being sent.
+	// The duration format is
+	// Defaults to `7200s`.
+	//
+	// +optional
+	IdleTime *gwapiv1.Duration `json:"idleTime,omitempty"`
+	// The duration between keep-alive probes.
+	// Defaults to `75s`.
+	//
+	// +optional
+	Interval *gwapiv1.Duration `json:"interval,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go b/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
new file mode 100644
index 000000000..48554a5df
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/kubernetes_helpers.go
@@ -0,0 +1,216 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	"encoding/json"
+	"fmt"
+
+	jsonpatch "github.com/evanphx/json-patch"
+	appv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"
+	"k8s.io/apimachinery/pkg/util/strategicpatch"
+	"k8s.io/utils/ptr"
+)
+
+// DefaultKubernetesDeploymentStrategy returns the default deployment strategy settings.
+func DefaultKubernetesDeploymentStrategy() *appv1.DeploymentStrategy {
+	return &appv1.DeploymentStrategy{
+		Type: appv1.RollingUpdateDeploymentStrategyType,
+	}
+}
+
+// DefaultKubernetesContainerImage returns the default envoyproxy image.
+func DefaultKubernetesContainerImage(image string) *string {
+	return ptr.To(image)
+}
+
+// DefaultKubernetesDeployment returns a new KubernetesDeploymentSpec with default settings.
+func DefaultKubernetesDeployment(envoyProxyImage string, enforcerImage string) *KubernetesDeploymentSpec {
+	return &KubernetesDeploymentSpec{
+		Strategy:            DefaultKubernetesDeploymentStrategy(),
+		Pod:                 DefaultKubernetesPod(),
+		EnvoyProxyContainer: DefaultKubernetesContainer(envoyProxyImage),
+		EnforcerContainer:   DefaultKubernetesContainer(enforcerImage),
+	}
+}
+
+// DefaultKubernetesPod returns a new KubernetesPodSpec with default settings.
+func DefaultKubernetesPod() *KubernetesPodSpec {
+	return &KubernetesPodSpec{}
+}
+
+// DefaultKubernetesContainer returns a new KubernetesContainerSpec with default settings.
+func DefaultKubernetesContainer(image string) *KubernetesContainerSpec {
+	return &KubernetesContainerSpec{
+		Resources: DefaultResourceRequirements(),
+		Image:     DefaultKubernetesContainerImage(image),
+	}
+}
+
+// DefaultResourceRequirements returns a new ResourceRequirements with default settings.
+func DefaultResourceRequirements() *corev1.ResourceRequirements {
+	return &corev1.ResourceRequirements{
+		Requests: corev1.ResourceList{
+			corev1.ResourceCPU:    resource.MustParse(DefaultDeploymentCPUResourceRequests),
+			corev1.ResourceMemory: resource.MustParse(DefaultDeploymentMemoryResourceRequests),
+		},
+	}
+}
+
+// DefaultKubernetesService returns a new KubernetesServiceSpec with default settings.
+func DefaultKubernetesService() *KubernetesServiceSpec {
+	return &KubernetesServiceSpec{
+		Type:                  DefaultKubernetesServiceType(),
+		ExternalTrafficPolicy: DefaultKubernetesServiceExternalTrafficPolicy(),
+	}
+}
+
+// DefaultKubernetesServiceType returns a new KubernetesServiceType with default settings.
+func DefaultKubernetesServiceType() *ServiceType {
+	return GetKubernetesServiceType(ServiceTypeLoadBalancer)
+}
+
+// GetKubernetesServiceType returns the KubernetesServiceType pointer.
+func GetKubernetesServiceType(serviceType ServiceType) *ServiceType {
+	return &serviceType
+}
+
+func DefaultKubernetesServiceExternalTrafficPolicy() *ServiceExternalTrafficPolicy {
+	return GetKubernetesServiceExternalTrafficPolicy(ServiceExternalTrafficPolicyLocal)
+}
+
+func GetKubernetesServiceExternalTrafficPolicy(serviceExternalTrafficPolicy ServiceExternalTrafficPolicy) *ServiceExternalTrafficPolicy {
+	return &serviceExternalTrafficPolicy
+}
+
+// defaultKubernetesDeploymentSpec fill a default KubernetesDeploymentSpec if unspecified.
+func (deployment *KubernetesDeploymentSpec) defaultKubernetesDeploymentSpec(envoyProxyImage, enforcerImage string) {
+	if deployment.Strategy == nil {
+		deployment.Strategy = DefaultKubernetesDeploymentStrategy()
+	}
+
+	if deployment.Pod == nil {
+		deployment.Pod = DefaultKubernetesPod()
+	}
+
+	if deployment.EnvoyProxyContainer == nil {
+		deployment.EnvoyProxyContainer = DefaultKubernetesContainer(envoyProxyImage)
+	}
+
+	if deployment.EnvoyProxyContainer.Resources == nil {
+		deployment.EnvoyProxyContainer.Resources = DefaultResourceRequirements()
+	}
+
+	if deployment.EnvoyProxyContainer.Image == nil {
+		deployment.EnvoyProxyContainer.Image = ptr.To(envoyProxyImage)
+	}
+
+	if deployment.EnforcerContainer == nil {
+		deployment.EnforcerContainer = DefaultKubernetesContainer(enforcerImage)
+	}
+
+	if deployment.EnforcerContainer.Resources == nil {
+		deployment.EnforcerContainer.Resources = DefaultResourceRequirements()
+	}
+}
+
+// setDefault fill a default HorizontalPodAutoscalerSpec if unspecified
+func (hpa *KubernetesHorizontalPodAutoscalerSpec) setDefault() {
+	if len(hpa.Metrics) == 0 {
+		hpa.Metrics = DefaultEnvoyProxyHpaMetrics()
+	}
+}
+
+// ApplyMergePatch applies a merge patch to a deployment based on the merge type
+func (deployment *KubernetesDeploymentSpec) ApplyMergePatch(old *appv1.Deployment) (*appv1.Deployment, error) {
+	if deployment.Patch == nil {
+		return old, nil
+	}
+
+	var patchedJSON []byte
+	var err error
+
+	// Serialize the current deployment to JSON
+	originalJSON, err := json.Marshal(old)
+	if err != nil {
+		return nil, fmt.Errorf("error marshaling original deployment: %w", err)
+	}
+
+	switch {
+	case deployment.Patch.Type == nil || *deployment.Patch.Type == StrategicMerge:
+		patchedJSON, err = strategicpatch.StrategicMergePatch(originalJSON, deployment.Patch.Value.Raw, appv1.Deployment{})
+	case *deployment.Patch.Type == JSONMerge:
+		patchedJSON, err = jsonpatch.MergePatch(originalJSON, deployment.Patch.Value.Raw)
+	default:
+		return nil, fmt.Errorf("unsupported merge type: %s", *deployment.Patch.Type)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("error applying merge patch: %w", err)
+	}
+
+	// Deserialize the patched JSON into a new deployment object
+	var patchedDeployment appv1.Deployment
+	if err := json.Unmarshal(patchedJSON, &patchedDeployment); err != nil {
+		return nil, fmt.Errorf("error unmarshaling patched deployment: %w", err)
+	}
+
+	return &patchedDeployment, nil
+}
+
+// ApplyMergePatch applies a merge patch to a service based on the merge type
+func (service *KubernetesServiceSpec) ApplyMergePatch(old *corev1.Service) (*corev1.Service, error) {
+	if service.Patch == nil {
+		return old, nil
+	}
+
+	var patchedJSON []byte
+	var err error
+
+	// Serialize the current deployment to JSON
+	originalJSON, err := json.Marshal(old)
+	if err != nil {
+		return nil, fmt.Errorf("error marshaling original deployment: %w", err)
+	}
+
+	switch {
+	case service.Patch.Type == nil || *service.Patch.Type == StrategicMerge:
+		patchedJSON, err = strategicpatch.StrategicMergePatch(originalJSON, service.Patch.Value.Raw, corev1.Service{})
+	case *service.Patch.Type == JSONMerge:
+		patchedJSON, err = jsonpatch.MergePatch(originalJSON, service.Patch.Value.Raw)
+	default:
+		return nil, fmt.Errorf("unsupported merge type: %s", *service.Patch.Type)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("error applying merge patch: %w", err)
+	}
+
+	// Deserialize the patched JSON into a new service object
+	var patchedService corev1.Service
+	if err := json.Unmarshal(patchedJSON, &patchedService); err != nil {
+		return nil, fmt.Errorf("error unmarshaling patched service: %w", err)
+	}
+
+	return &patchedService, nil
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go b/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
new file mode 100644
index 000000000..2db40aad3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/retry_types.go
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+// Retry defines the retry strategy to be applied.
+type Retry struct {
+	// NumRetries is the number of retries to be attempted. Defaults to 2.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=2
+	NumRetries *int32 `json:"numRetries,omitempty"`
+
+	// RetryOn specifies the retry trigger condition.
+	//
+	// If not specified, the default is to retry on connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes(503).
+	// +optional
+	RetryOn *RetryOn `json:"retryOn,omitempty"`
+
+	// PerRetry is the retry policy to be applied per retry attempt.
+	//
+	// +optional
+	PerRetry *PerRetryPolicy `json:"perRetry,omitempty"`
+}
+
+type RetryOn struct {
+	// Triggers specifies the retry trigger condition(Http/Grpc).
+	//
+	// +optional
+	Triggers []TriggerEnum `json:"triggers,omitempty"`
+
+	// HttpStatusCodes specifies the http status codes to be retried.
+	// The retriable-status-codes trigger must also be configured for these status codes to trigger a retry.
+	//
+	// +optional
+	HTTPStatusCodes []HTTPStatus `json:"httpStatusCodes,omitempty"`
+}
+
+// TriggerEnum specifies the conditions that trigger retries.
+// +kubebuilder:validation:Enum={"5xx","gateway-error","reset","connect-failure","retriable-4xx","refused-stream","retriable-status-codes","cancelled","deadline-exceeded","internal","resource-exhausted","unavailable"}
+type TriggerEnum string
+
+const (
+	// HTTP events.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-on
+
+	// The upstream server responds with any 5xx response code, or does not respond at all (disconnect/reset/read timeout).
+	// Includes connect-failure and refused-stream.
+	Error5XX TriggerEnum = "5xx"
+	// The response is a gateway error (502,503 or 504).
+	GatewayError TriggerEnum = "gateway-error"
+	// The upstream server does not respond at all (disconnect/reset/read timeout.)
+	Reset TriggerEnum = "reset"
+	// Connection failure to the upstream server (connect timeout, etc.). (Included in *5xx*)
+	ConnectFailure TriggerEnum = "connect-failure"
+	// The upstream server responds with a retriable 4xx response code.
+	// Currently, the only response code in this category is 409.
+	Retriable4XX TriggerEnum = "retriable-4xx"
+	// The upstream server resets the stream with a REFUSED_STREAM error code.
+	RefusedStream TriggerEnum = "refused-stream"
+	// The upstream server responds with any response code matching one defined in the RetriableStatusCodes.
+	RetriableStatusCodes TriggerEnum = "retriable-status-codes"
+
+	// GRPC events, currently only supported for gRPC status codes in response headers.
+	// For additional details, see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#x-envoy-retry-grpc-on
+
+	// The gRPC status code in the response headers is “cancelled”.
+	Cancelled TriggerEnum = "cancelled"
+	// The gRPC status code in the response headers is “deadline-exceeded”.
+	DeadlineExceeded TriggerEnum = "deadline-exceeded"
+	// The gRPC status code in the response headers is “internal”.
+	Internal TriggerEnum = "internal"
+	// The gRPC status code in the response headers is “resource-exhausted”.
+	ResourceExhausted TriggerEnum = "resource-exhausted"
+	// The gRPC status code in the response headers is “unavailable”.
+	Unavailable TriggerEnum = "unavailable"
+)
+
+type PerRetryPolicy struct {
+	// Timeout is the timeout per retry attempt.
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	Timeout *metav1.Duration `json:"timeout,omitempty"`
+	// Backoff is the backoff policy to be applied per retry attempt. gateway uses a fully jittered exponential
+	// back-off algorithm for retries. For additional details,
+	// see https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/router_filter#config-http-filters-router-x-envoy-max-retries
+	//
+	// +optional
+	BackOff *BackOffPolicy `json:"backOff,omitempty"`
+}
+
+type BackOffPolicy struct {
+	// BaseInterval is the base interval between retries.
+	//
+	// +kubebuilder:validation:Format=duration
+	BaseInterval *metav1.Duration `json:"baseInterval,omitempty"`
+	// MaxInterval is the maximum interval between retries. This parameter is optional, but must be greater than or equal to the base_interval if set.
+	// The default is 10 times the base_interval
+	//
+	// +optional
+	// +kubebuilder:validation:Format=duration
+	MaxInterval *metav1.Duration `json:"maxInterval,omitempty"`
+	// we can add rate limited based backoff config here if we want to.
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
new file mode 100644
index 000000000..b3ccdb284
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
@@ -0,0 +1,447 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	appv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
+)
+
+const (
+	// DefaultDeploymentReplicas is the default number of deployment replicas.
+	DefaultDeploymentReplicas = 1
+	// DefaultDeploymentCPUResourceRequests for deployment cpu resource
+	DefaultDeploymentCPUResourceRequests = "100m"
+	// DefaultDeploymentMemoryResourceRequests for deployment memory resource
+	DefaultDeploymentMemoryResourceRequests = "512Mi"
+	// DefaultEnvoyProxyImage is the default image used by envoyproxy
+	DefaultEnvoyProxyImage = "envoyproxy/envoy:distroless-v1.29.3"
+	// DefaultEnforcerImage default image used by enforcer
+	DefaultEnforcerImage = "wso2/apk-enforcer:1.1.0"
+	// DefaultShutdownManagerCPUResourceRequests for shutdown manager cpu resource
+	DefaultShutdownManagerCPUResourceRequests = "10m"
+	// DefaultShutdownManagerMemoryResourceRequests for shutdown manager memory resource
+	DefaultShutdownManagerMemoryResourceRequests = "32Mi"
+	// DefaultShutdownManagerImage is the default image used for the shutdown manager.
+	DefaultShutdownManagerImage = "envoyproxy/gateway-dev:latest"
+	// DefaultRateLimitImage is the default image used by ratelimit.
+	DefaultRateLimitImage = "envoyproxy/ratelimit:19f2079f"
+	// HTTPProtocol is the common-used http protocol.
+	HTTPProtocol = "http"
+	// GRPCProtocol is the common-used grpc protocol.
+	GRPCProtocol = "grpc"
+)
+
+// GroupVersionKind unambiguously identifies a Kind.
+// It can be converted to k8s.io/apimachinery/pkg/runtime/schema.GroupVersionKind
+type GroupVersionKind struct {
+	Group   string `json:"group"`
+	Version string `json:"version"`
+	Kind    string `json:"kind"`
+}
+
+// ProviderType defines the types of providers supported by Envoy Gateway.
+//
+// +kubebuilder:validation:Enum=Kubernetes
+type ProviderType string
+
+const (
+	// ProviderTypeKubernetes defines the "Kubernetes" provider.
+	ProviderTypeKubernetes ProviderType = "Kubernetes"
+
+	// ProviderTypeFile defines the "File" provider. This type is not implemented
+	// until https://github.com/envoyproxy/gateway/issues/1001 is fixed.
+	ProviderTypeFile ProviderType = "File"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesDeploymentSpec defines the desired state of the Kubernetes deployment resource.
+type KubernetesDeploymentSpec struct {
+	// Patch defines how to perform the patch operation to deployment
+	//
+	// +optional
+	Patch *KubernetesPatchSpec `json:"patch,omitempty"`
+
+	// Replicas is the number of desired pods. Defaults to 1.
+	//
+	// +optional
+	Replicas *int32 `json:"replicas,omitempty"`
+
+	// The deployment strategy to use to replace existing pods with new ones.
+	// +optional
+	Strategy *appv1.DeploymentStrategy `json:"strategy,omitempty"`
+
+	// Pod defines the desired specification of pod.
+	//
+	// +optional
+	Pod *KubernetesPodSpec `json:"pod,omitempty"`
+
+	// EnvoyProxyContainer defines the desired specification of main container.
+	//
+	// +optional
+	EnvoyProxyContainer *KubernetesContainerSpec `json:"envoyProxyContainer,omitempty"`
+
+	// EnforcerContainer defines the desired specification of main container.
+	//
+	// +optional
+	EnforcerContainer *KubernetesContainerSpec `json:"enforcerContainer,omitempty"`
+
+	// List of initialization containers belonging to the pod.
+	// More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
+	//
+	// +optional
+	InitContainers []corev1.Container `json:"initContainers,omitempty"`
+
+	// TODO: Expose config as use cases are better understood, e.g. labels.
+}
+
+// +k8s:deepcopy-gen=true
+// KubernetesPodSpec defines the desired state of the Kubernetes pod resource.
+type KubernetesPodSpec struct {
+	// Annotations are the annotations that should be appended to the pods.
+	// By default, no pod annotations are appended.
+	//
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Labels are the additional labels that should be tagged to the pods.
+	// By default, no additional pod labels are tagged.
+	//
+	// +optional
+	Labels map[string]string `json:"labels,omitempty"`
+
+	// SecurityContext holds pod-level security attributes and common container settings.
+	// Optional: Defaults to empty.  See type description for default values of each field.
+	//
+	// +optional
+	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
+
+	// If specified, the pod's scheduling constraints.
+	// +optional
+	Affinity *corev1.Affinity `json:"affinity,omitempty"`
+
+	// If specified, the pod's tolerations.
+	// +optional
+	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
+
+	// Volumes that can be mounted by containers belonging to the pod.
+	// More info: https://kubernetes.io/docs/concepts/storage/volumes
+	//
+	// +optional
+	Volumes []corev1.Volume `json:"volumes,omitempty"`
+
+	// ImagePullSecrets is an optional list of references to secrets
+	// in the same namespace to use for pulling any of the images used by this PodSpec.
+	// If specified, these secrets will be passed to individual puller implementations for them to use.
+	// More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
+	//
+	// +optional
+	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
+
+	// NodeSelector is a selector which must be true for the pod to fit on a node.
+	// Selector which must match a node's labels for the pod to be scheduled on that node.
+	// More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
+	//
+	// +optional
+	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
+
+	// TopologySpreadConstraints describes how a group of pods ought to spread across topology
+	// domains. Scheduler will schedule pods in a way which abides by the constraints.
+	// All topologySpreadConstraints are ANDed.
+	//
+	// +optional
+	TopologySpreadConstraints []corev1.TopologySpreadConstraint `json:"topologySpreadConstraints,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// KubernetesContainerSpec defines the desired state of the Kubernetes container resource.
+type KubernetesContainerSpec struct {
+	// List of environment variables to set in the container.
+	//
+	// +optional
+	Env []corev1.EnvVar `json:"env,omitempty"`
+
+	// Resources required by this container.
+	// More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+	//
+	// +optional
+	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
+
+	// SecurityContext defines the security options the container should be run with.
+	// If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext.
+	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
+	//
+	// +optional
+	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
+
+	// Image specifies the EnvoyProxy container image to be used, instead of the default image.
+	//
+	// +optional
+	Image *string `json:"image,omitempty"`
+
+	// VolumeMounts are volumes to mount into the container's filesystem.
+	// Cannot be updated.
+	//
+	// +optional
+	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ServiceType string describes ingress methods for a service
+// +enum
+// +kubebuilder:validation:Enum=ClusterIP;LoadBalancer;NodePort
+type ServiceType string
+
+const (
+	// ServiceTypeClusterIP means a service will only be accessible inside the
+	// cluster, via the cluster IP.
+	ServiceTypeClusterIP ServiceType = "ClusterIP"
+
+	// ServiceTypeLoadBalancer means a service will be exposed via an
+	// external load balancer (if the cloud provider supports it).
+	ServiceTypeLoadBalancer ServiceType = "LoadBalancer"
+
+	// ServiceTypeNodePort means a service will be exposed on each Kubernetes Node
+	// at a static Port, common across all Nodes.
+	ServiceTypeNodePort ServiceType = "NodePort"
+)
+
+// +k8s:deepcopy-gen=true
+// ServiceExternalTrafficPolicy describes how nodes distribute service traffic they
+// receive on one of the Service's "externally-facing" addresses (NodePorts, ExternalIPs,
+// and LoadBalancer IPs.
+// +enum
+// +kubebuilder:validation:Enum=Local;Cluster
+type ServiceExternalTrafficPolicy string
+
+const (
+	// ServiceExternalTrafficPolicyCluster routes traffic to all endpoints.
+	ServiceExternalTrafficPolicyCluster ServiceExternalTrafficPolicy = "Cluster"
+
+	// ServiceExternalTrafficPolicyLocal preserves the source IP of the traffic by
+	// routing only to endpoints on the same node as the traffic was received on
+	// (dropping the traffic if there are no local endpoints).
+	ServiceExternalTrafficPolicyLocal ServiceExternalTrafficPolicy = "Local"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesServiceSpec defines the desired state of the Kubernetes service resource.
+// +kubebuilder:validation:XValidation:message="allocateLoadBalancerNodePorts can only be set for LoadBalancer type",rule="!has(self.allocateLoadBalancerNodePorts) || self.type == 'LoadBalancer'"
+// +kubebuilder:validation:XValidation:message="loadBalancerIP can only be set for LoadBalancer type",rule="!has(self.loadBalancerIP) || self.type == 'LoadBalancer'"
+type KubernetesServiceSpec struct {
+	// Annotations that should be appended to the service.
+	// By default, no annotations are appended.
+	//
+	// +optional
+	Annotations map[string]string `json:"annotations,omitempty"`
+
+	// Type determines how the Service is exposed. Defaults to LoadBalancer.
+	// Valid options are ClusterIP, LoadBalancer and NodePort.
+	// "LoadBalancer" means a service will be exposed via an external load balancer (if the cloud provider supports it).
+	// "ClusterIP" means a service will only be accessible inside the cluster, via the cluster IP.
+	// "NodePort" means a service will be exposed on a static Port on all Nodes of the cluster.
+	// +kubebuilder:default:="LoadBalancer"
+	// +optional
+	Type *ServiceType `json:"type,omitempty"`
+
+	// LoadBalancerClass, when specified, allows for choosing the LoadBalancer provider
+	// implementation if more than one are available or is otherwise expected to be specified
+	// +optional
+	LoadBalancerClass *string `json:"loadBalancerClass,omitempty"`
+
+	// AllocateLoadBalancerNodePorts defines if NodePorts will be automatically allocated for
+	// services with type LoadBalancer. Default is "true". It may be set to "false" if the cluster
+	// load-balancer does not rely on NodePorts. If the caller requests specific NodePorts (by specifying a
+	// value), those requests will be respected, regardless of this field. This field may only be set for
+	// services with type LoadBalancer and will be cleared if the type is changed to any other type.
+	// +optional
+	AllocateLoadBalancerNodePorts *bool `json:"allocateLoadBalancerNodePorts,omitempty"`
+
+	// LoadBalancerIP defines the IP Address of the underlying load balancer service. This field
+	// may be ignored if the load balancer provider does not support this feature.
+	// This field has been deprecated in Kubernetes, but it is still used for setting the IP Address in some cloud
+	// providers such as GCP.
+	//
+	// +kubebuilder:validation:XValidation:message="loadBalancerIP must be a valid IPv4 address",rule="self.matches(r\"^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$\")"
+	// +optional
+	LoadBalancerIP *string `json:"loadBalancerIP,omitempty"`
+
+	// ExternalTrafficPolicy determines the externalTrafficPolicy for the Envoy Service. Valid options
+	// are Local and Cluster. Default is "Local". "Local" means traffic will only go to pods on the node
+	// receiving the traffic. "Cluster" means connections are loadbalanced to all pods in the cluster.
+	// +kubebuilder:default:="Local"
+	// +optional
+	ExternalTrafficPolicy *ServiceExternalTrafficPolicy `json:"externalTrafficPolicy,omitempty"`
+
+	// Patch defines how to perform the patch operation to the service
+	//
+	// +optional
+	Patch *KubernetesPatchSpec `json:"patch,omitempty"`
+	// TODO: Expose config as use cases are better understood, e.g. labels.
+}
+
+// +k8s:deepcopy-gen=true
+// LogLevel defines a log level for Envoy Gateway and EnvoyProxy system logs.
+// +kubebuilder:validation:Enum=debug;info;error;warn
+type LogLevel string
+
+const (
+	// LogLevelDebug defines the "debug" logging level.
+	LogLevelDebug LogLevel = "debug"
+
+	// LogLevelInfo defines the "Info" logging level.
+	LogLevelInfo LogLevel = "info"
+
+	// LogLevelWarn defines the "Warn" logging level.
+	LogLevelWarn LogLevel = "warn"
+
+	// LogLevelError defines the "Error" logging level.
+	LogLevelError LogLevel = "error"
+)
+
+// +k8s:deepcopy-gen=true
+// XDSTranslatorHook defines the types of hooks that an Envoy Gateway extension may support
+// for the xds-translator
+//
+// +kubebuilder:validation:Enum=VirtualHost;Route;HTTPListener;Translation
+type XDSTranslatorHook string
+
+const (
+	XDSVirtualHost  XDSTranslatorHook = "VirtualHost"
+	XDSRoute        XDSTranslatorHook = "Route"
+	XDSHTTPListener XDSTranslatorHook = "HTTPListener"
+	XDSTranslation  XDSTranslatorHook = "Translation"
+)
+
+// +k8s:deepcopy-gen=true
+// StringMatch defines how to match any strings.
+// This is a general purpose match condition that can be used by other EG APIs
+// that need to match against a string.
+type StringMatch struct {
+	// Type specifies how to match against a string.
+	//
+	// +optional
+	// +kubebuilder:default=Exact
+	Type *StringMatchType `json:"type,omitempty"`
+
+	// Value specifies the string value that the match must have.
+	//
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=1024
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// StringMatchType specifies the semantics of how a string value should be compared.
+// Valid MatchType values are "Exact", "Prefix", "Suffix", "RegularExpression".
+//
+// +kubebuilder:validation:Enum=Exact;Prefix;Suffix;RegularExpression
+type StringMatchType string
+
+const (
+	// StringMatchExact :the input string must match exactly the match value.
+	StringMatchExact StringMatchType = "Exact"
+
+	// StringMatchPrefix :the input string must start with the match value.
+	StringMatchPrefix StringMatchType = "Prefix"
+
+	// StringMatchSuffix :the input string must end with the match value.
+	StringMatchSuffix StringMatchType = "Suffix"
+
+	// StringMatchRegularExpression :The input string must match the regular expression
+	// specified in the match value.
+	// The regex string must adhere to the syntax documented in
+	// https://github.com/google/re2/wiki/Syntax.
+	StringMatchRegularExpression StringMatchType = "RegularExpression"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesHorizontalPodAutoscalerSpec defines Kubernetes Horizontal Pod Autoscaler settings of Envoy Proxy Deployment.
+// When HPA is enabled, it is recommended that the value in `KubernetesDeploymentSpec.replicas` be removed, otherwise
+// Envoy Gateway will revert back to this value every time reconciliation occurs.
+// See k8s.io.autoscaling.v2.HorizontalPodAutoScalerSpec.
+//
+// +kubebuilder:validation:XValidation:message="maxReplicas cannot be less than minReplicas",rule="!has(self.minReplicas) || self.maxReplicas >= self.minReplicas"
+type KubernetesHorizontalPodAutoscalerSpec struct {
+	// minReplicas is the lower limit for the number of replicas to which the autoscaler
+	// can scale down. It defaults to 1 replica.
+	//
+	// +kubebuilder:validation:XValidation:message="minReplicas must be greater than 0",rule="self > 0"
+	// +optional
+	MinReplicas *int32 `json:"minReplicas,omitempty"`
+
+	// maxReplicas is the upper limit for the number of replicas to which the autoscaler can scale up.
+	// It cannot be less that minReplicas.
+	//
+	// +kubebuilder:validation:XValidation:message="maxReplicas must be greater than 0",rule="self > 0"
+	MaxReplicas *int32 `json:"maxReplicas"`
+
+	// metrics contains the specifications for which to use to calculate the
+	// desired replica count (the maximum replica count across all metrics will
+	// be used).
+	// If left empty, it defaults to being based on CPU utilization with average on 80% usage.
+	//
+	// +optional
+	Metrics []autoscalingv2.MetricSpec `json:"metrics,omitempty"`
+
+	// behavior configures the scaling behavior of the target
+	// in both Up and Down directions (scaleUp and scaleDown fields respectively).
+	// If not set, the default HPAScalingRules for scale up and scale down are used.
+	// See k8s.io.autoscaling.v2.HorizontalPodAutoScalerBehavior.
+	//
+	// +optional
+	Behavior *autoscalingv2.HorizontalPodAutoscalerBehavior `json:"behavior,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// HTTPStatus defines the http status code.
+// +kubebuilder:validation:Minimum=100
+// +kubebuilder:validation:Maximum=600
+// +kubebuilder:validation:ExclusiveMaximum=true
+type HTTPStatus int
+
+// +k8s:deepcopy-gen=true
+// MergeType defines the type of merge operation
+type MergeType string
+
+const (
+	// StrategicMerge indicates a strategic merge patch type
+	StrategicMerge MergeType = "StrategicMerge"
+	// JSONMerge indicates a JSON merge patch type
+	JSONMerge MergeType = "JSONMerge"
+)
+
+// +k8s:deepcopy-gen=true
+// KubernetesPatchSpec defines how to perform the patch operation
+type KubernetesPatchSpec struct {
+	// Type is the type of merge operation to perform
+	//
+	// By default, StrategicMerge is used as the patch type.
+	// +optional
+	Type *MergeType `json:"type,omitempty"`
+
+	// Object contains the raw configuration for merged object
+	Value apiextensionsv1.JSON `json:"value"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go b/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
new file mode 100644
index 000000000..d772a0660
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/timeout_types.go
@@ -0,0 +1,80 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+
+// +k8s:deepcopy-gen=true
+// Timeout defines configuration for timeouts related to connections.
+type Timeout struct {
+	// Timeout settings for TCP.
+	//
+	// +optional
+	TCP *TCPTimeout `json:"tcp,omitempty"`
+
+	// Timeout settings for HTTP.
+	//
+	// +optional
+	HTTP *HTTPTimeout `json:"http,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type TCPTimeout struct {
+	// The timeout for network connection establishment, including TCP and TLS handshakes.
+	// Default: 10 seconds.
+	//
+	// +optional
+	ConnectTimeout *gwapiv1.Duration `json:"connectTimeout,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPTimeout struct {
+	// The idle timeout for an HTTP connection. Idle time is defined as a period in which there are no active requests in the connection.
+	// Default: 1 hour.
+	//
+	// +optional
+	ConnectionIdleTimeout *gwapiv1.Duration `json:"connectionIdleTimeout,omitempty"`
+
+	// The maximum duration of an HTTP connection.
+	// Default: unlimited.
+	//
+	// +optional
+	MaxConnectionDuration *gwapiv1.Duration `json:"maxConnectionDuration,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type ClientTimeout struct {
+	// Timeout settings for HTTP.
+	//
+	// +optional
+	HTTP *HTTPClientTimeout `json:"http,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type HTTPClientTimeout struct {
+	// The duration envoy waits for the complete request reception. This timer starts upon request
+	// initiation and stops when either the last byte of the request is sent upstream or when the response begins.
+	//
+	// +optional
+	RequestReceivedTimeout *gwapiv1.Duration `json:"requestReceivedTimeout,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go b/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
new file mode 100644
index 000000000..0f1a8accb
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/tls_types.go
@@ -0,0 +1,149 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// +k8s:deepcopy-gen=true
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && self.minVersion == '1.3' ? !has(self.ciphers) : true", message="setting ciphers has no effect if the minimum possible TLS version is 1.3"
+// +kubebuilder:validation:XValidation:rule="has(self.minVersion) && has(self.maxVersion) ? {\"Auto\":0,\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4}[self.minVersion] <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : !has(self.minVersion) && has(self.maxVersion) ? 3 <= {\"1.0\":1,\"1.1\":2,\"1.2\":3,\"1.3\":4,\"Auto\":5}[self.maxVersion] : true", message="minVersion must be smaller or equal to maxVersion"
+type TLSSettings struct {
+
+	// Min specifies the minimal TLS protocol version to allow.
+	// The default is TLS 1.2 if this is not specified.
+	//
+	// +optional
+	MinVersion *TLSVersion `json:"minVersion,omitempty"`
+
+	// Max specifies the maximal TLS protocol version to allow
+	// The default is TLS 1.3 if this is not specified.
+	//
+	// +optional
+	MaxVersion *TLSVersion `json:"maxVersion,omitempty"`
+
+	// Ciphers specifies the set of cipher suites supported when
+	// negotiating TLS 1.0 - 1.2. This setting has no effect for TLS 1.3.
+	// In non-FIPS Envoy Proxy builds the default cipher list is:
+	// - [ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]
+	// - [ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	// In builds using BoringSSL FIPS the default cipher list is:
+	// - ECDHE-ECDSA-AES128-GCM-SHA256
+	// - ECDHE-RSA-AES128-GCM-SHA256
+	// - ECDHE-ECDSA-AES256-GCM-SHA384
+	// - ECDHE-RSA-AES256-GCM-SHA384
+	//
+	// +optional
+	Ciphers []string `json:"ciphers,omitempty"`
+
+	// ECDHCurves specifies the set of supported ECDH curves.
+	// In non-FIPS Envoy Proxy builds the default curves are:
+	// - X25519
+	// - P-256
+	// In builds using BoringSSL FIPS the default curve is:
+	// - P-256
+	//
+	// +optional
+	ECDHCurves []string `json:"ecdhCurves,omitempty"`
+
+	// SignatureAlgorithms specifies which signature algorithms the listener should
+	// support.
+	//
+	// +optional
+	SignatureAlgorithms []string `json:"signatureAlgorithms,omitempty"`
+
+	// ALPNProtocols supplies the list of ALPN protocols that should be
+	// exposed by the listener. By default h2 and http/1.1 are enabled.
+	// Supported values are:
+	// - http/1.0
+	// - http/1.1
+	// - h2
+	//
+	// +optional
+	ALPNProtocols []ALPNProtocol `json:"alpnProtocols,omitempty"`
+
+	// ClientValidation specifies the configuration to validate the client
+	// initiating the TLS connection to the Gateway listener.
+	// +optional
+	ClientValidation *ClientValidationContext `json:"clientValidation,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// ALPNProtocol specifies the protocol to be negotiated using ALPN
+// +kubebuilder:validation:Enum=http/1.0;http/1.1;h2
+type ALPNProtocol string
+
+// When adding ALPN constants, they must be values that are defined
+// in the IANA registry for ALPN identification sequences
+// https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml#alpn-protocol-ids
+const (
+	// HTTPProtocolVersion1_0 specifies that HTTP/1.0 should be negotiable with ALPN
+	HTTPProtocolVersion1_0 ALPNProtocol = "http/1.0"
+	// HTTPProtocolVersion1_1 specifies that HTTP/1.1 should be negotiable with ALPN
+	HTTPProtocolVersion1_1 ALPNProtocol = "http/1.1"
+	// HTTPProtocolVersion2 specifies that HTTP/2 should be negotiable with ALPN
+	HTTPProtocolVersion2 ALPNProtocol = "h2"
+)
+
+// +k8s:deepcopy-gen=true
+// TLSVersion specifies the TLS version
+// +kubebuilder:validation:Enum=Auto;"1.0";"1.1";"1.2";"1.3"
+type TLSVersion string
+
+const (
+	// TLSAuto allows Envoy to choose the optimal TLS Version
+	TLSAuto TLSVersion = "Auto"
+	// TLS1.0 specifies TLS version 1.0
+	TLSv10 TLSVersion = "1.0"
+	// TLS1.1 specifies TLS version 1.1
+	TLSv11 TLSVersion = "1.1"
+	// TLSv1.2 specifies TLS version 1.2
+	TLSv12 TLSVersion = "1.2"
+	// TLSv1.3 specifies TLS version 1.3
+	TLSv13 TLSVersion = "1.3"
+)
+
+// +k8s:deepcopy-gen=true
+// ClientValidationContext holds configuration that can be used to validate the client initiating the TLS connection
+// to the Gateway.
+// By default, no client specific configuration is validated.
+type ClientValidationContext struct {
+	// CACertificateRefs contains one or more references to
+	// Kubernetes objects that contain TLS certificates of
+	// the Certificate Authorities that can be used
+	// as a trust anchor to validate the certificates presented by the client.
+	//
+	// A single reference to a Kubernetes ConfigMap or a Kubernetes Secret,
+	// with the CA certificate in a key named `ca.crt` is currently supported.
+	//
+	// References to a resource in different namespace are invalid UNLESS there
+	// is a ReferenceGrant in the target namespace that allows the certificate
+	// to be attached.
+	//
+	// +kubebuilder:validation:MaxItems=8
+	// +optional
+	CACertificateRefs []gwapiv1.SecretObjectReference `json:"caCertificateRefs,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go b/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
new file mode 100644
index 000000000..311cd482b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/tracing_types.go
@@ -0,0 +1,125 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package v1alpha1
+
+// +k8s:deepcopy-gen=true
+type ProxyTracing struct {
+	// SamplingRate controls the rate at which traffic will be
+	// selected for tracing if no prior sampling decision has been made.
+	// Defaults to 100, valid values [0-100]. 100 indicates 100% sampling.
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:validation:Maximum=100
+	// +kubebuilder:default=100
+	// +optional
+	SamplingRate *uint32 `json:"samplingRate,omitempty"`
+	// CustomTags defines the custom tags to add to each span.
+	// If provider is kubernetes, pod name and namespace are added by default.
+	CustomTags map[string]CustomTag `json:"customTags,omitempty"`
+	// Provider defines the tracing provider.
+	// Only OpenTelemetry is supported currently.
+	Provider TracingProvider `json:"provider"`
+}
+
+// +k8s:deepcopy-gen=true
+type TracingProviderType string
+
+const (
+	TracingProviderTypeOpenTelemetry TracingProviderType = "OpenTelemetry"
+)
+
+// +k8s:deepcopy-gen=true
+type TracingProvider struct {
+	// Type defines the tracing provider type.
+	// EG currently only supports OpenTelemetry.
+	// +kubebuilder:validation:Enum=OpenTelemetry
+	// +kubebuilder:default=OpenTelemetry
+	Type TracingProviderType `json:"type"`
+	// Host define the provider service hostname.
+	Host string `json:"host"`
+	// Port defines the port the provider service is exposed on.
+	//
+	// +optional
+	// +kubebuilder:validation:Minimum=0
+	// +kubebuilder:default=4317
+	Port int32 `json:"port,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+type CustomTagType string
+
+const (
+	// CustomTagTypeLiteral adds hard-coded value to each span.
+	CustomTagTypeLiteral CustomTagType = "Literal"
+	// CustomTagTypeEnvironment adds value from environment variable to each span.
+	CustomTagTypeEnvironment CustomTagType = "Environment"
+	// CustomTagTypeRequestHeader adds value from request header to each span.
+	CustomTagTypeRequestHeader CustomTagType = "RequestHeader"
+)
+
+// +k8s:deepcopy-gen=true
+type CustomTag struct {
+	// Type defines the type of custom tag.
+	// +kubebuilder:validation:Enum=Literal;Environment;RequestHeader
+	// +unionDiscriminator
+	// +kubebuilder:default=Literal
+	Type CustomTagType `json:"type"`
+	// Literal adds hard-coded value to each span.
+	// It's required when the type is "Literal".
+	Literal *LiteralCustomTag `json:"literal,omitempty"`
+	// Environment adds value from environment variable to each span.
+	// It's required when the type is "Environment".
+	Environment *EnvironmentCustomTag `json:"environment,omitempty"`
+	// RequestHeader adds value from request header to each span.
+	// It's required when the type is "RequestHeader".
+	RequestHeader *RequestHeaderCustomTag `json:"requestHeader,omitempty"`
+
+	// TODO: add support for Metadata tags in the future.
+	// EG currently doesn't support metadata for route or cluster.
+}
+
+// +k8s:deepcopy-gen=true
+// LiteralCustomTag adds hard-coded value to each span.
+type LiteralCustomTag struct {
+	// Value defines the hard-coded value to add to each span.
+	Value string `json:"value"`
+}
+
+// +k8s:deepcopy-gen=true
+// EnvironmentCustomTag adds value from environment variable to each span.
+type EnvironmentCustomTag struct {
+	// Name defines the name of the environment variable which to extract the value from.
+	Name string `json:"name"`
+	// DefaultValue defines the default value to use if the environment variable is not set.
+	// +optional
+	DefaultValue *string `json:"defaultValue,omitempty"`
+}
+
+// +k8s:deepcopy-gen=true
+// RequestHeaderCustomTag adds value from request header to each span.
+type RequestHeaderCustomTag struct {
+	// Name defines the name of the request header which to extract the value from.
+	Name string `json:"name"`
+	// DefaultValue defines the default value to use if the request header is not set.
+	// +optional
+	DefaultValue *string `json:"defaultValue,omitempty"`
+}
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
new file mode 100644
index 000000000..0e34624ce
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/v1alpha1/zz_generated.deepcopy.go
@@ -0,0 +1,1159 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha1
+
+import (
+	appsv1 "k8s.io/api/apps/v1"
+	"k8s.io/api/autoscaling/v2"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	apisv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientTimeout) DeepCopyInto(out *ClientTimeout) {
+	*out = *in
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPClientTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientTimeout.
+func (in *ClientTimeout) DeepCopy() *ClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ClientValidationContext) DeepCopyInto(out *ClientValidationContext) {
+	*out = *in
+	if in.CACertificateRefs != nil {
+		in, out := &in.CACertificateRefs, &out.CACertificateRefs
+		*out = make([]apisv1.SecretObjectReference, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientValidationContext.
+func (in *ClientValidationContext) DeepCopy() *ClientValidationContext {
+	if in == nil {
+		return nil
+	}
+	out := new(ClientValidationContext)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *CustomTag) DeepCopyInto(out *CustomTag) {
+	*out = *in
+	if in.Literal != nil {
+		in, out := &in.Literal, &out.Literal
+		*out = new(LiteralCustomTag)
+		**out = **in
+	}
+	if in.Environment != nil {
+		in, out := &in.Environment, &out.Environment
+		*out = new(EnvironmentCustomTag)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.RequestHeader != nil {
+		in, out := &in.RequestHeader, &out.RequestHeader
+		*out = new(RequestHeaderCustomTag)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CustomTag.
+func (in *CustomTag) DeepCopy() *CustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(CustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvironmentCustomTag) DeepCopyInto(out *EnvironmentCustomTag) {
+	*out = *in
+	if in.DefaultValue != nil {
+		in, out := &in.DefaultValue, &out.DefaultValue
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvironmentCustomTag.
+func (in *EnvironmentCustomTag) DeepCopy() *EnvironmentCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvironmentCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxy) DeepCopyInto(out *EnvoyProxy) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	out.Status = in.Status
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxy.
+func (in *EnvoyProxy) DeepCopy() *EnvoyProxy {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EnvoyProxy) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyKubernetesProvider) DeepCopyInto(out *EnvoyProxyKubernetesProvider) {
+	*out = *in
+	if in.EnvoyDeployment != nil {
+		in, out := &in.EnvoyDeployment, &out.EnvoyDeployment
+		*out = new(KubernetesDeploymentSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyService != nil {
+		in, out := &in.EnvoyService, &out.EnvoyService
+		*out = new(KubernetesServiceSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyHpa != nil {
+		in, out := &in.EnvoyHpa, &out.EnvoyHpa
+		*out = new(KubernetesHorizontalPodAutoscalerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyKubernetesProvider.
+func (in *EnvoyProxyKubernetesProvider) DeepCopy() *EnvoyProxyKubernetesProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyKubernetesProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyList) DeepCopyInto(out *EnvoyProxyList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]EnvoyProxy, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyList.
+func (in *EnvoyProxyList) DeepCopy() *EnvoyProxyList {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *EnvoyProxyList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyProvider) DeepCopyInto(out *EnvoyProxyProvider) {
+	*out = *in
+	if in.Kubernetes != nil {
+		in, out := &in.Kubernetes, &out.Kubernetes
+		*out = new(EnvoyProxyKubernetesProvider)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyProvider.
+func (in *EnvoyProxyProvider) DeepCopy() *EnvoyProxyProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxySpec) DeepCopyInto(out *EnvoyProxySpec) {
+	*out = *in
+	if in.Provider != nil {
+		in, out := &in.Provider, &out.Provider
+		*out = new(EnvoyProxyProvider)
+		(*in).DeepCopyInto(*out)
+	}
+	in.Logging.DeepCopyInto(&out.Logging)
+	if in.Telemetry != nil {
+		in, out := &in.Telemetry, &out.Telemetry
+		*out = new(ProxyTelemetry)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Bootstrap != nil {
+		in, out := &in.Bootstrap, &out.Bootstrap
+		*out = new(ProxyBootstrap)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Concurrency != nil {
+		in, out := &in.Concurrency, &out.Concurrency
+		*out = new(int32)
+		**out = **in
+	}
+	if in.ExtraArgs != nil {
+		in, out := &in.ExtraArgs, &out.ExtraArgs
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.MergeGateways != nil {
+		in, out := &in.MergeGateways, &out.MergeGateways
+		*out = new(bool)
+		**out = **in
+	}
+	if in.Shutdown != nil {
+		in, out := &in.Shutdown, &out.Shutdown
+		*out = new(ShutdownConfig)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxySpec.
+func (in *EnvoyProxySpec) DeepCopy() *EnvoyProxySpec {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxySpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *EnvoyProxyStatus) DeepCopyInto(out *EnvoyProxyStatus) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EnvoyProxyStatus.
+func (in *EnvoyProxyStatus) DeepCopy() *EnvoyProxyStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(EnvoyProxyStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *FileEnvoyProxyAccessLog) DeepCopyInto(out *FileEnvoyProxyAccessLog) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new FileEnvoyProxyAccessLog.
+func (in *FileEnvoyProxyAccessLog) DeepCopy() *FileEnvoyProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(FileEnvoyProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPClientTimeout) DeepCopyInto(out *HTTPClientTimeout) {
+	*out = *in
+	if in.RequestReceivedTimeout != nil {
+		in, out := &in.RequestReceivedTimeout, &out.RequestReceivedTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPClientTimeout.
+func (in *HTTPClientTimeout) DeepCopy() *HTTPClientTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPClientTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *HTTPTimeout) DeepCopyInto(out *HTTPTimeout) {
+	*out = *in
+	if in.ConnectionIdleTimeout != nil {
+		in, out := &in.ConnectionIdleTimeout, &out.ConnectionIdleTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+	if in.MaxConnectionDuration != nil {
+		in, out := &in.MaxConnectionDuration, &out.MaxConnectionDuration
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new HTTPTimeout.
+func (in *HTTPTimeout) DeepCopy() *HTTPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(HTTPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesContainerSpec) DeepCopyInto(out *KubernetesContainerSpec) {
+	*out = *in
+	if in.Env != nil {
+		in, out := &in.Env, &out.Env
+		*out = make([]corev1.EnvVar, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = new(corev1.ResourceRequirements)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.SecurityContext != nil {
+		in, out := &in.SecurityContext, &out.SecurityContext
+		*out = new(corev1.SecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Image != nil {
+		in, out := &in.Image, &out.Image
+		*out = new(string)
+		**out = **in
+	}
+	if in.VolumeMounts != nil {
+		in, out := &in.VolumeMounts, &out.VolumeMounts
+		*out = make([]corev1.VolumeMount, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesContainerSpec.
+func (in *KubernetesContainerSpec) DeepCopy() *KubernetesContainerSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesContainerSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesDeploymentSpec) DeepCopyInto(out *KubernetesDeploymentSpec) {
+	*out = *in
+	if in.Patch != nil {
+		in, out := &in.Patch, &out.Patch
+		*out = new(KubernetesPatchSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Replicas != nil {
+		in, out := &in.Replicas, &out.Replicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Strategy != nil {
+		in, out := &in.Strategy, &out.Strategy
+		*out = new(appsv1.DeploymentStrategy)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Pod != nil {
+		in, out := &in.Pod, &out.Pod
+		*out = new(KubernetesPodSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnvoyProxyContainer != nil {
+		in, out := &in.EnvoyProxyContainer, &out.EnvoyProxyContainer
+		*out = new(KubernetesContainerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.EnforcerContainer != nil {
+		in, out := &in.EnforcerContainer, &out.EnforcerContainer
+		*out = new(KubernetesContainerSpec)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.InitContainers != nil {
+		in, out := &in.InitContainers, &out.InitContainers
+		*out = make([]corev1.Container, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesDeploymentSpec.
+func (in *KubernetesDeploymentSpec) DeepCopy() *KubernetesDeploymentSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesDeploymentSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesHorizontalPodAutoscalerSpec) DeepCopyInto(out *KubernetesHorizontalPodAutoscalerSpec) {
+	*out = *in
+	if in.MinReplicas != nil {
+		in, out := &in.MinReplicas, &out.MinReplicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.MaxReplicas != nil {
+		in, out := &in.MaxReplicas, &out.MaxReplicas
+		*out = new(int32)
+		**out = **in
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = make([]v2.MetricSpec, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Behavior != nil {
+		in, out := &in.Behavior, &out.Behavior
+		*out = new(v2.HorizontalPodAutoscalerBehavior)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesHorizontalPodAutoscalerSpec.
+func (in *KubernetesHorizontalPodAutoscalerSpec) DeepCopy() *KubernetesHorizontalPodAutoscalerSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesHorizontalPodAutoscalerSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesPatchSpec) DeepCopyInto(out *KubernetesPatchSpec) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(MergeType)
+		**out = **in
+	}
+	in.Value.DeepCopyInto(&out.Value)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesPatchSpec.
+func (in *KubernetesPatchSpec) DeepCopy() *KubernetesPatchSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesPatchSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesPodSpec) DeepCopyInto(out *KubernetesPodSpec) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Labels != nil {
+		in, out := &in.Labels, &out.Labels
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.SecurityContext != nil {
+		in, out := &in.SecurityContext, &out.SecurityContext
+		*out = new(corev1.PodSecurityContext)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Affinity != nil {
+		in, out := &in.Affinity, &out.Affinity
+		*out = new(corev1.Affinity)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tolerations != nil {
+		in, out := &in.Tolerations, &out.Tolerations
+		*out = make([]corev1.Toleration, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Volumes != nil {
+		in, out := &in.Volumes, &out.Volumes
+		*out = make([]corev1.Volume, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.ImagePullSecrets != nil {
+		in, out := &in.ImagePullSecrets, &out.ImagePullSecrets
+		*out = make([]corev1.LocalObjectReference, len(*in))
+		copy(*out, *in)
+	}
+	if in.NodeSelector != nil {
+		in, out := &in.NodeSelector, &out.NodeSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.TopologySpreadConstraints != nil {
+		in, out := &in.TopologySpreadConstraints, &out.TopologySpreadConstraints
+		*out = make([]corev1.TopologySpreadConstraint, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesPodSpec.
+func (in *KubernetesPodSpec) DeepCopy() *KubernetesPodSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesPodSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *KubernetesServiceSpec) DeepCopyInto(out *KubernetesServiceSpec) {
+	*out = *in
+	if in.Annotations != nil {
+		in, out := &in.Annotations, &out.Annotations
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(ServiceType)
+		**out = **in
+	}
+	if in.LoadBalancerClass != nil {
+		in, out := &in.LoadBalancerClass, &out.LoadBalancerClass
+		*out = new(string)
+		**out = **in
+	}
+	if in.AllocateLoadBalancerNodePorts != nil {
+		in, out := &in.AllocateLoadBalancerNodePorts, &out.AllocateLoadBalancerNodePorts
+		*out = new(bool)
+		**out = **in
+	}
+	if in.LoadBalancerIP != nil {
+		in, out := &in.LoadBalancerIP, &out.LoadBalancerIP
+		*out = new(string)
+		**out = **in
+	}
+	if in.ExternalTrafficPolicy != nil {
+		in, out := &in.ExternalTrafficPolicy, &out.ExternalTrafficPolicy
+		*out = new(ServiceExternalTrafficPolicy)
+		**out = **in
+	}
+	if in.Patch != nil {
+		in, out := &in.Patch, &out.Patch
+		*out = new(KubernetesPatchSpec)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KubernetesServiceSpec.
+func (in *KubernetesServiceSpec) DeepCopy() *KubernetesServiceSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(KubernetesServiceSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *LiteralCustomTag) DeepCopyInto(out *LiteralCustomTag) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LiteralCustomTag.
+func (in *LiteralCustomTag) DeepCopy() *LiteralCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(LiteralCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *OpenTelemetryEnvoyProxyAccessLog) DeepCopyInto(out *OpenTelemetryEnvoyProxyAccessLog) {
+	*out = *in
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new OpenTelemetryEnvoyProxyAccessLog.
+func (in *OpenTelemetryEnvoyProxyAccessLog) DeepCopy() *OpenTelemetryEnvoyProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(OpenTelemetryEnvoyProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLog) DeepCopyInto(out *ProxyAccessLog) {
+	*out = *in
+	if in.Settings != nil {
+		in, out := &in.Settings, &out.Settings
+		*out = make([]ProxyAccessLogSetting, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLog.
+func (in *ProxyAccessLog) DeepCopy() *ProxyAccessLog {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLog)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogFormat) DeepCopyInto(out *ProxyAccessLogFormat) {
+	*out = *in
+	if in.Text != nil {
+		in, out := &in.Text, &out.Text
+		*out = new(string)
+		**out = **in
+	}
+	if in.JSON != nil {
+		in, out := &in.JSON, &out.JSON
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogFormat.
+func (in *ProxyAccessLogFormat) DeepCopy() *ProxyAccessLogFormat {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogFormat)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogSetting) DeepCopyInto(out *ProxyAccessLogSetting) {
+	*out = *in
+	in.Format.DeepCopyInto(&out.Format)
+	if in.Sinks != nil {
+		in, out := &in.Sinks, &out.Sinks
+		*out = make([]ProxyAccessLogSink, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogSetting.
+func (in *ProxyAccessLogSetting) DeepCopy() *ProxyAccessLogSetting {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogSetting)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyAccessLogSink) DeepCopyInto(out *ProxyAccessLogSink) {
+	*out = *in
+	if in.File != nil {
+		in, out := &in.File, &out.File
+		*out = new(FileEnvoyProxyAccessLog)
+		**out = **in
+	}
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = new(OpenTelemetryEnvoyProxyAccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyAccessLogSink.
+func (in *ProxyAccessLogSink) DeepCopy() *ProxyAccessLogSink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyAccessLogSink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyBootstrap) DeepCopyInto(out *ProxyBootstrap) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(BootstrapType)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyBootstrap.
+func (in *ProxyBootstrap) DeepCopy() *ProxyBootstrap {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyBootstrap)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyLogging) DeepCopyInto(out *ProxyLogging) {
+	*out = *in
+	if in.Level != nil {
+		in, out := &in.Level, &out.Level
+		*out = make(map[ProxyLogComponent]LogLevel, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyLogging.
+func (in *ProxyLogging) DeepCopy() *ProxyLogging {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyLogging)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyMetricSink) DeepCopyInto(out *ProxyMetricSink) {
+	*out = *in
+	if in.OpenTelemetry != nil {
+		in, out := &in.OpenTelemetry, &out.OpenTelemetry
+		*out = new(ProxyOpenTelemetrySink)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyMetricSink.
+func (in *ProxyMetricSink) DeepCopy() *ProxyMetricSink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyMetricSink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyMetrics) DeepCopyInto(out *ProxyMetrics) {
+	*out = *in
+	if in.Prometheus != nil {
+		in, out := &in.Prometheus, &out.Prometheus
+		*out = new(ProxyPrometheusProvider)
+		**out = **in
+	}
+	if in.Sinks != nil {
+		in, out := &in.Sinks, &out.Sinks
+		*out = make([]ProxyMetricSink, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.Matches != nil {
+		in, out := &in.Matches, &out.Matches
+		*out = make([]StringMatch, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyMetrics.
+func (in *ProxyMetrics) DeepCopy() *ProxyMetrics {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyMetrics)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyOpenTelemetrySink) DeepCopyInto(out *ProxyOpenTelemetrySink) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyOpenTelemetrySink.
+func (in *ProxyOpenTelemetrySink) DeepCopy() *ProxyOpenTelemetrySink {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyOpenTelemetrySink)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyPrometheusProvider) DeepCopyInto(out *ProxyPrometheusProvider) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyPrometheusProvider.
+func (in *ProxyPrometheusProvider) DeepCopy() *ProxyPrometheusProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyPrometheusProvider)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyTelemetry) DeepCopyInto(out *ProxyTelemetry) {
+	*out = *in
+	if in.AccessLog != nil {
+		in, out := &in.AccessLog, &out.AccessLog
+		*out = new(ProxyAccessLog)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Tracing != nil {
+		in, out := &in.Tracing, &out.Tracing
+		*out = new(ProxyTracing)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Metrics != nil {
+		in, out := &in.Metrics, &out.Metrics
+		*out = new(ProxyMetrics)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyTelemetry.
+func (in *ProxyTelemetry) DeepCopy() *ProxyTelemetry {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyTelemetry)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ProxyTracing) DeepCopyInto(out *ProxyTracing) {
+	*out = *in
+	if in.SamplingRate != nil {
+		in, out := &in.SamplingRate, &out.SamplingRate
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.CustomTags != nil {
+		in, out := &in.CustomTags, &out.CustomTags
+		*out = make(map[string]CustomTag, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	out.Provider = in.Provider
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProxyTracing.
+func (in *ProxyTracing) DeepCopy() *ProxyTracing {
+	if in == nil {
+		return nil
+	}
+	out := new(ProxyTracing)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *RequestHeaderCustomTag) DeepCopyInto(out *RequestHeaderCustomTag) {
+	*out = *in
+	if in.DefaultValue != nil {
+		in, out := &in.DefaultValue, &out.DefaultValue
+		*out = new(string)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RequestHeaderCustomTag.
+func (in *RequestHeaderCustomTag) DeepCopy() *RequestHeaderCustomTag {
+	if in == nil {
+		return nil
+	}
+	out := new(RequestHeaderCustomTag)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ShutdownConfig) DeepCopyInto(out *ShutdownConfig) {
+	*out = *in
+	if in.DrainTimeout != nil {
+		in, out := &in.DrainTimeout, &out.DrainTimeout
+		*out = new(v1.Duration)
+		**out = **in
+	}
+	if in.MinDrainDuration != nil {
+		in, out := &in.MinDrainDuration, &out.MinDrainDuration
+		*out = new(v1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ShutdownConfig.
+func (in *ShutdownConfig) DeepCopy() *ShutdownConfig {
+	if in == nil {
+		return nil
+	}
+	out := new(ShutdownConfig)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *StringMatch) DeepCopyInto(out *StringMatch) {
+	*out = *in
+	if in.Type != nil {
+		in, out := &in.Type, &out.Type
+		*out = new(StringMatchType)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new StringMatch.
+func (in *StringMatch) DeepCopy() *StringMatch {
+	if in == nil {
+		return nil
+	}
+	out := new(StringMatch)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPKeepalive) DeepCopyInto(out *TCPKeepalive) {
+	*out = *in
+	if in.Probes != nil {
+		in, out := &in.Probes, &out.Probes
+		*out = new(uint32)
+		**out = **in
+	}
+	if in.IdleTime != nil {
+		in, out := &in.IdleTime, &out.IdleTime
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+	if in.Interval != nil {
+		in, out := &in.Interval, &out.Interval
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPKeepalive.
+func (in *TCPKeepalive) DeepCopy() *TCPKeepalive {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPKeepalive)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TCPTimeout) DeepCopyInto(out *TCPTimeout) {
+	*out = *in
+	if in.ConnectTimeout != nil {
+		in, out := &in.ConnectTimeout, &out.ConnectTimeout
+		*out = new(apisv1.Duration)
+		**out = **in
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TCPTimeout.
+func (in *TCPTimeout) DeepCopy() *TCPTimeout {
+	if in == nil {
+		return nil
+	}
+	out := new(TCPTimeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TLSSettings) DeepCopyInto(out *TLSSettings) {
+	*out = *in
+	if in.MinVersion != nil {
+		in, out := &in.MinVersion, &out.MinVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.MaxVersion != nil {
+		in, out := &in.MaxVersion, &out.MaxVersion
+		*out = new(TLSVersion)
+		**out = **in
+	}
+	if in.Ciphers != nil {
+		in, out := &in.Ciphers, &out.Ciphers
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ECDHCurves != nil {
+		in, out := &in.ECDHCurves, &out.ECDHCurves
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.SignatureAlgorithms != nil {
+		in, out := &in.SignatureAlgorithms, &out.SignatureAlgorithms
+		*out = make([]string, len(*in))
+		copy(*out, *in)
+	}
+	if in.ALPNProtocols != nil {
+		in, out := &in.ALPNProtocols, &out.ALPNProtocols
+		*out = make([]ALPNProtocol, len(*in))
+		copy(*out, *in)
+	}
+	if in.ClientValidation != nil {
+		in, out := &in.ClientValidation, &out.ClientValidation
+		*out = new(ClientValidationContext)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLSSettings.
+func (in *TLSSettings) DeepCopy() *TLSSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(TLSSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Timeout) DeepCopyInto(out *Timeout) {
+	*out = *in
+	if in.TCP != nil {
+		in, out := &in.TCP, &out.TCP
+		*out = new(TCPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.HTTP != nil {
+		in, out := &in.HTTP, &out.HTTP
+		*out = new(HTTPTimeout)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Timeout.
+func (in *Timeout) DeepCopy() *Timeout {
+	if in == nil {
+		return nil
+	}
+	out := new(Timeout)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *TracingProvider) DeepCopyInto(out *TracingProvider) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TracingProvider.
+func (in *TracingProvider) DeepCopy() *TracingProvider {
+	if in == nil {
+		return nil
+	}
+	out := new(TracingProvider)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/gateway-api/validate.go b/adapter/internal/operator/gateway-api/validate.go
new file mode 100644
index 000000000..56f13a2c5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/validate.go
@@ -0,0 +1,916 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"errors"
+	"fmt"
+	"net/netip"
+	"strings"
+
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/sets"
+	"k8s.io/apimachinery/pkg/util/validation"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	gwapiv1a2 "sigs.k8s.io/gateway-api/apis/v1alpha2"
+	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, parentRef *RouteParentContext, route RouteContext,
+	resources *Resources, backendNamespace string, routeKind gwapiv1.Kind) bool {
+	if !t.validateBackendRefFilters(backendRefContext, parentRef, route, routeKind) {
+		return false
+	}
+	backendRef := GetBackendRef(backendRefContext)
+
+	if !t.validateBackendRefGroup(backendRef, parentRef, route) {
+		return false
+	}
+	if !t.validateBackendRefKind(backendRef, parentRef, route) {
+		return false
+	}
+	if !t.validateBackendNamespace(backendRef, parentRef, route, resources, routeKind) {
+		return false
+	}
+	if !t.validateBackendPort(backendRef, parentRef, route) {
+		return false
+	}
+	protocol := v1.ProtocolTCP
+	if routeKind == KindUDPRoute {
+		protocol = v1.ProtocolUDP
+	}
+	backendRefKind := KindDerefOr(backendRef.Kind, KindService)
+	switch backendRefKind {
+	case KindService:
+		if !t.validateBackendService(backendRef, parentRef, resources, backendNamespace, route, protocol) {
+			return false
+		}
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Group != nil && *backendRef.Group != "" && *backendRef.Group != GroupMultiClusterService {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonInvalidKind,
+			fmt.Sprintf("Group is invalid, only the core API group (specified by omitting the group field or setting it to an empty string) and %s are supported", GroupMultiClusterService),
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefKind(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Kind != nil && *backendRef.Kind != KindService && *backendRef.Kind != KindServiceImport {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonInvalidKind,
+			"Kind is invalid, only Service and MCS ServiceImport are supported",
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateBackendRefFilters(backendRef BackendRefContext, parentRef *RouteParentContext, route RouteContext, routeKind gwapiv1.Kind) bool {
+	var filtersLen int
+	switch routeKind {
+	case KindHTTPRoute:
+		filters := GetFilters(backendRef).([]gwapiv1.HTTPRouteFilter)
+		filtersLen = len(filters)
+	case KindGRPCRoute:
+		filters := GetFilters(backendRef).([]gwapiv1a2.GRPCRouteFilter)
+		filtersLen = len(filters)
+	default:
+		return true
+	}
+
+	if filtersLen > 0 {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"UnsupportedRefValue",
+			"The filters field within BackendRef is not supported",
+		)
+		return false
+	}
+
+	return true
+}
+
+func (t *Translator) validateBackendNamespace(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext,
+	resources *Resources, routeKind gwapiv1.Kind) bool {
+	if backendRef.Namespace != nil && string(*backendRef.Namespace) != "" && string(*backendRef.Namespace) != route.GetNamespace() {
+		if !t.validateCrossNamespaceRef(
+			crossNamespaceFrom{
+				group:     gwapiv1.GroupName,
+				kind:      string(routeKind),
+				namespace: route.GetNamespace(),
+			},
+			crossNamespaceTo{
+				group:     GroupDerefOr(backendRef.Group, ""),
+				kind:      KindDerefOr(backendRef.Kind, KindService),
+				namespace: string(*backendRef.Namespace),
+				name:      string(backendRef.Name),
+			},
+			resources.ReferenceGrants,
+		) {
+			parentRef.SetCondition(route,
+				gwapiv1.RouteConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.RouteReasonRefNotPermitted,
+				fmt.Sprintf("Backend ref to %s %s/%s not permitted by any ReferenceGrant.", KindDerefOr(backendRef.Kind, KindService), *backendRef.Namespace, backendRef.Name),
+			)
+			return false
+		}
+	}
+	return true
+}
+
+func (t *Translator) validateBackendPort(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Port == nil {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"PortNotSpecified",
+			"A valid port number corresponding to a port on the Service must be specified",
+		)
+		return false
+	}
+	return true
+}
+func (t *Translator) validateBackendService(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, resources *Resources,
+	serviceNamespace string, route RouteContext, protocol v1.Protocol) bool {
+	service := resources.GetService(serviceNamespace, string(backendRef.Name))
+	if service == nil {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.RouteReasonBackendNotFound,
+			fmt.Sprintf("Service %s/%s not found", NamespaceDerefOr(backendRef.Namespace, route.GetNamespace()),
+				string(backendRef.Name)),
+		)
+		return false
+	}
+	var portFound bool
+	for _, port := range service.Spec.Ports {
+		portProtocol := port.Protocol
+		if port.Protocol == "" { // Default protocol is TCP
+			portProtocol = v1.ProtocolTCP
+		}
+		if port.Port == int32(*backendRef.Port) && portProtocol == protocol {
+			portFound = true
+			break
+		}
+	}
+
+	if !portFound {
+		parentRef.SetCondition(route,
+			gwapiv1.RouteConditionResolvedRefs,
+			metav1.ConditionFalse,
+			"PortNotFound",
+			fmt.Sprintf(string(protocol)+" Port %d not found on service %s/%s", *backendRef.Port, serviceNamespace,
+				string(backendRef.Name)),
+		)
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateListenerConditions(listener *ListenerContext) (isReady bool) {
+	lConditions := listener.GetConditions()
+	if len(lConditions) == 0 {
+		listener.SetCondition(gwapiv1.ListenerConditionProgrammed, metav1.ConditionTrue, gwapiv1.ListenerReasonProgrammed,
+			"Sending translated listener configuration to the data plane")
+		listener.SetCondition(gwapiv1.ListenerConditionAccepted, metav1.ConditionTrue, gwapiv1.ListenerReasonAccepted,
+			"Listener has been successfully translated")
+		listener.SetCondition(gwapiv1.ListenerConditionResolvedRefs, metav1.ConditionTrue, gwapiv1.ListenerReasonResolvedRefs,
+			"Listener references have been resolved")
+		return true
+	}
+
+	// Any condition on the listener apart from Programmed=true indicates an error.
+	if !(lConditions[0].Type == string(gwapiv1.ListenerConditionProgrammed) && lConditions[0].Status == metav1.ConditionTrue) {
+		hasProgrammedCond := false
+		hasRefsCond := false
+		for _, existing := range lConditions {
+			if existing.Type == string(gwapiv1.ListenerConditionProgrammed) {
+				hasProgrammedCond = true
+			}
+			if existing.Type == string(gwapiv1.ListenerConditionResolvedRefs) {
+				hasRefsCond = true
+			}
+		}
+		// set "Programmed: false" if it's not set already.
+		if !hasProgrammedCond {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				"Listener is invalid, see other Conditions for details.",
+			)
+		}
+		// set "ResolvedRefs: true" if it's not set already.
+		if !hasRefsCond {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionTrue,
+				gwapiv1.ListenerReasonResolvedRefs,
+				"Listener references have been resolved",
+			)
+		}
+		// skip computing IR
+		return false
+	}
+	return true
+}
+
+func (t *Translator) validateAllowedNamespaces(listener *ListenerContext) {
+	if listener.AllowedRoutes != nil &&
+		listener.AllowedRoutes.Namespaces != nil &&
+		listener.AllowedRoutes.Namespaces.From != nil &&
+		*listener.AllowedRoutes.Namespaces.From == gwapiv1.NamespacesFromSelector {
+		if listener.AllowedRoutes.Namespaces.Selector == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				"The allowedRoutes.namespaces.selector field must be specified when allowedRoutes.namespaces.from is set to \"Selector\".",
+			)
+		} else {
+			selector, err := metav1.LabelSelectorAsSelector(listener.AllowedRoutes.Namespaces.Selector)
+			if err != nil {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					fmt.Sprintf("The allowedRoutes.namespaces.selector could not be parsed: %v.", err),
+				)
+			}
+
+			listener.namespaceSelector = selector
+		}
+	}
+}
+
+func (t *Translator) validateTerminateModeAndGetTLSSecrets(listener *ListenerContext, resources *Resources) []*v1.Secret {
+	if len(listener.TLS.CertificateRefs) == 0 {
+		listener.SetCondition(
+			gwapiv1.ListenerConditionProgrammed,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalid,
+			"Listener must have at least 1 TLS certificate ref",
+		)
+		return nil
+	}
+
+	secrets := make([]*v1.Secret, 0)
+	for _, certificateRef := range listener.TLS.CertificateRefs {
+		// TODO zhaohuabing: reuse validateSecretRef
+		if certificateRef.Group != nil && string(*certificateRef.Group) != "" {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				"Listener's TLS certificate ref group must be unspecified/empty.",
+			)
+			break
+		}
+
+		if certificateRef.Kind != nil && string(*certificateRef.Kind) != KindSecret {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Listener's TLS certificate ref kind must be %s.", KindSecret),
+			)
+			break
+		}
+
+		secretNamespace := listener.gateway.Namespace
+
+		if certificateRef.Namespace != nil && string(*certificateRef.Namespace) != "" && string(*certificateRef.Namespace) != listener.gateway.Namespace {
+			if !t.validateCrossNamespaceRef(
+				crossNamespaceFrom{
+					group:     gwapiv1.GroupName,
+					kind:      KindGateway,
+					namespace: listener.gateway.Namespace,
+				},
+				crossNamespaceTo{
+					group:     "",
+					kind:      KindSecret,
+					namespace: string(*certificateRef.Namespace),
+					name:      string(certificateRef.Name),
+				},
+				resources.ReferenceGrants,
+			) {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionResolvedRefs,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonRefNotPermitted,
+					fmt.Sprintf("Certificate ref to secret %s/%s not permitted by any ReferenceGrant.", *certificateRef.Namespace, certificateRef.Name),
+				)
+				break
+			}
+
+			secretNamespace = string(*certificateRef.Namespace)
+		}
+
+		secret := resources.GetSecret(secretNamespace, string(certificateRef.Name))
+		if secret == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s does not exist.", listener.gateway.Namespace, certificateRef.Name),
+			)
+			break
+		}
+
+		if secret.Type != v1.SecretTypeTLS {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s must be of type %s.", listener.gateway.Namespace, certificateRef.Name, v1.SecretTypeTLS),
+			)
+			break
+		}
+
+		if len(secret.Data[v1.TLSCertKey]) == 0 || len(secret.Data[v1.TLSPrivateKeyKey]) == 0 {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidCertificateRef,
+				fmt.Sprintf("Secret %s/%s must contain %s and %s.", listener.gateway.Namespace, certificateRef.Name, v1.TLSCertKey, v1.TLSPrivateKeyKey),
+			)
+			break
+		}
+
+		secrets = append(secrets, secret)
+	}
+
+	err := validateTLSSecretsData(secrets, listener.Hostname)
+	if err != nil {
+		listener.SetCondition(
+			gwapiv1.ListenerConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalidCertificateRef,
+			fmt.Sprintf("Secret %s.", err.Error()),
+		)
+	}
+
+	return secrets
+}
+
+func (t *Translator) validateTLSConfiguration(listener *ListenerContext, resources *Resources) {
+	switch listener.Protocol {
+	case gwapiv1.HTTPProtocolType, gwapiv1.UDPProtocolType, gwapiv1.TCPProtocolType:
+		if listener.TLS != nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must not have TLS set when protocol is %s.", listener.Protocol),
+			)
+		}
+	case gwapiv1.HTTPSProtocolType:
+		if listener.TLS == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must have TLS set when protocol is %s.", listener.Protocol),
+			)
+			break
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode != gwapiv1.TLSModeTerminate {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				"UnsupportedTLSMode",
+				fmt.Sprintf("TLS %s mode is not supported, TLS mode must be Terminate.", *listener.TLS.Mode),
+			)
+			break
+		}
+
+		secrets := t.validateTerminateModeAndGetTLSSecrets(listener, resources)
+		listener.SetTLSSecrets(secrets)
+
+	case gwapiv1.TLSProtocolType:
+		if listener.TLS == nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must have TLS set when protocol is %s.", listener.Protocol),
+			)
+			break
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode == gwapiv1.TLSModePassthrough {
+			if len(listener.TLS.CertificateRefs) > 0 {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					"Listener must not have TLS certificate refs set for TLS mode Passthrough.",
+				)
+				break
+			}
+		}
+
+		if listener.TLS.Mode != nil && *listener.TLS.Mode == gwapiv1.TLSModeTerminate {
+			if len(listener.TLS.CertificateRefs) == 0 {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionProgrammed,
+					metav1.ConditionFalse,
+					gwapiv1.ListenerReasonInvalid,
+					"Listener must have TLS certificate refs set for TLS mode Terminate.",
+				)
+				break
+			}
+			secrets := t.validateTerminateModeAndGetTLSSecrets(listener, resources)
+			listener.SetTLSSecrets(secrets)
+		}
+	}
+}
+
+func (t *Translator) validateHostName(listener *ListenerContext) {
+	if listener.Protocol == gwapiv1.UDPProtocolType || listener.Protocol == gwapiv1.TCPProtocolType {
+		if listener.Hostname != nil {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionProgrammed,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalid,
+				fmt.Sprintf("Listener must not have hostname set when protocol is %s.", listener.Protocol),
+			)
+		}
+	}
+}
+
+func (t *Translator) validateAllowedRoutes(listener *ListenerContext, routeKinds ...gwapiv1.Kind) {
+	canSupportKinds := make([]gwapiv1.RouteGroupKind, len(routeKinds))
+	for i, routeKind := range routeKinds {
+		canSupportKinds[i] = gwapiv1.RouteGroupKind{Group: GroupPtr(gwapiv1.GroupName), Kind: routeKind}
+	}
+	if listener.AllowedRoutes == nil || len(listener.AllowedRoutes.Kinds) == 0 {
+		listener.SetSupportedKinds(canSupportKinds...)
+		return
+	}
+
+	supportedRouteKinds := make([]gwapiv1.Kind, 0)
+	supportedKinds := make([]gwapiv1.RouteGroupKind, 0)
+	unSupportedKinds := make([]gwapiv1.RouteGroupKind, 0)
+
+	for _, kind := range listener.AllowedRoutes.Kinds {
+
+		// if there is a group it must match `gateway.networking.k8s.io`
+		if kind.Group != nil && string(*kind.Group) != gwapiv1.GroupName {
+			listener.SetCondition(
+				gwapiv1.ListenerConditionResolvedRefs,
+				metav1.ConditionFalse,
+				gwapiv1.ListenerReasonInvalidRouteKinds,
+				fmt.Sprintf("Group is not supported, group must be %s", gwapiv1.GroupName),
+			)
+			continue
+		}
+
+		found := false
+		for _, routeKind := range routeKinds {
+			if kind.Kind == routeKind {
+				supportedKinds = append(supportedKinds, kind)
+				supportedRouteKinds = append(supportedRouteKinds, kind.Kind)
+				found = true
+				break
+			}
+		}
+
+		if !found {
+			unSupportedKinds = append(unSupportedKinds, kind)
+		}
+	}
+
+	for _, kind := range unSupportedKinds {
+		var printRouteKinds []gwapiv1.Kind
+		if len(supportedKinds) == 0 {
+			printRouteKinds = routeKinds
+		} else {
+			printRouteKinds = supportedRouteKinds
+		}
+		listener.SetCondition(
+			gwapiv1.ListenerConditionResolvedRefs,
+			metav1.ConditionFalse,
+			gwapiv1.ListenerReasonInvalidRouteKinds,
+			fmt.Sprintf("%s is not supported, kind must be one of %v", string(kind.Kind), printRouteKinds),
+		)
+	}
+
+	listener.SetSupportedKinds(supportedKinds...)
+}
+
+type portListeners struct {
+	listeners []*ListenerContext
+	protocols sets.Set[string]
+	hostnames map[string]int
+}
+
+// Port, protocol and hostname tuple should be unique across all listeners on merged Gateways.
+func (t *Translator) validateConflictedMergedListeners(gateways []*GatewayContext) {
+	listenerSets := sets.Set[string]{}
+	for _, gateway := range gateways {
+		for _, listener := range gateway.listeners {
+			hostname := new(gwapiv1.Hostname)
+			if listener.Hostname != nil {
+				hostname = listener.Hostname
+			}
+			portProtocolHostname := fmt.Sprintf("%s:%s:%d", listener.Protocol, *hostname, listener.Port)
+			if listenerSets.Has(portProtocolHostname) {
+				listener.SetCondition(
+					gwapiv1.ListenerConditionConflicted,
+					metav1.ConditionTrue,
+					gwapiv1.ListenerReasonHostnameConflict,
+					"Port, protocol and hostname tuple must be unique for every listener",
+				)
+			}
+			listenerSets.Insert(portProtocolHostname)
+		}
+	}
+}
+
+func (t *Translator) validateConflictedLayer7Listeners(gateways []*GatewayContext) {
+	// Iterate through all layer-7 (HTTP, HTTPS, TLS) listeners and collect info about protocols
+	// and hostnames per port.
+	for _, gateway := range gateways {
+		portListenerInfo := map[gwapiv1.PortNumber]*portListeners{}
+		for _, listener := range gateway.listeners {
+			if listener.Protocol == gwapiv1.UDPProtocolType || listener.Protocol == gwapiv1.TCPProtocolType {
+				continue
+			}
+			if portListenerInfo[listener.Port] == nil {
+				portListenerInfo[listener.Port] = &portListeners{
+					protocols: sets.Set[string]{},
+					hostnames: map[string]int{},
+				}
+			}
+
+			portListenerInfo[listener.Port].listeners = append(portListenerInfo[listener.Port].listeners, listener)
+
+			var protocol string
+			switch listener.Protocol {
+			// HTTPS and TLS can co-exist on the same port
+			case gwapiv1.HTTPSProtocolType, gwapiv1.TLSProtocolType:
+				protocol = "https/tls"
+			default:
+				protocol = string(listener.Protocol)
+			}
+			portListenerInfo[listener.Port].protocols.Insert(protocol)
+
+			var hostname string
+			if listener.Hostname != nil {
+				hostname = string(*listener.Hostname)
+			}
+
+			portListenerInfo[listener.Port].hostnames[hostname]++
+		}
+
+		// Set Conflicted conditions for any listeners with conflicting specs.
+		for _, info := range portListenerInfo {
+			for _, listener := range info.listeners {
+				if len(info.protocols) > 1 {
+					listener.SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonProtocolConflict,
+						"All listeners for a given port must use a compatible protocol",
+					)
+				}
+
+				var hostname string
+				if listener.Hostname != nil {
+					hostname = string(*listener.Hostname)
+				}
+
+				if info.hostnames[hostname] > 1 {
+					listener.SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonHostnameConflict,
+						"All listeners for a given port must use a unique hostname",
+					)
+				}
+			}
+		}
+	}
+}
+
+func (t *Translator) validateConflictedLayer4Listeners(gateways []*GatewayContext, protocols ...gwapiv1.ProtocolType) {
+	// Iterate through all layer-4(TCP UDP) listeners and check if there are more than one listener on the same port
+	for _, gateway := range gateways {
+		portListenerInfo := map[gwapiv1.PortNumber]*portListeners{}
+		for _, listener := range gateway.listeners {
+			for _, protocol := range protocols {
+				if listener.Protocol == protocol {
+					if portListenerInfo[listener.Port] == nil {
+						portListenerInfo[listener.Port] = &portListeners{}
+					}
+					portListenerInfo[listener.Port].listeners = append(portListenerInfo[listener.Port].listeners, listener)
+				}
+			}
+		}
+
+		// Leave the first one and set Conflicted conditions for all other listeners with conflicting specs.
+		for _, info := range portListenerInfo {
+			if len(info.listeners) > 1 {
+				for i := 1; i < len(info.listeners); i++ {
+					info.listeners[i].SetCondition(
+						gwapiv1.ListenerConditionConflicted,
+						metav1.ConditionTrue,
+						gwapiv1.ListenerReasonProtocolConflict,
+						fmt.Sprintf("Only one %s listener is allowed in a given port", strings.Join(protocolSliceToStringSlice(protocols), "/")),
+					)
+				}
+			}
+		}
+	}
+}
+
+func (t *Translator) validateCrossNamespaceRef(from crossNamespaceFrom, to crossNamespaceTo, referenceGrants []*gwapiv1b1.ReferenceGrant) bool {
+	for _, referenceGrant := range referenceGrants {
+		// The ReferenceGrant must be defined in the namespace of
+		// the "to" (the referent).
+		if referenceGrant.Namespace != to.namespace {
+			continue
+		}
+
+		// Check if the ReferenceGrant has a matching "from".
+		var fromAllowed bool
+		for _, refGrantFrom := range referenceGrant.Spec.From {
+			if string(refGrantFrom.Namespace) == from.namespace && string(refGrantFrom.Group) == from.group && string(refGrantFrom.Kind) == from.kind {
+				fromAllowed = true
+				break
+			}
+		}
+		if !fromAllowed {
+			continue
+		}
+
+		// Check if the ReferenceGrant has a matching "to".
+		var toAllowed bool
+		for _, refGrantTo := range referenceGrant.Spec.To {
+			if string(refGrantTo.Group) == to.group && string(refGrantTo.Kind) == to.kind && (refGrantTo.Name == nil || *refGrantTo.Name == "" || string(*refGrantTo.Name) == to.name) {
+				toAllowed = true
+				break
+			}
+		}
+		if !toAllowed {
+			continue
+		}
+
+		// If we got here, both the "from" and the "to" were allowed by this
+		// reference grant.
+		return true
+	}
+
+	// If we got here, no reference policy or reference grant allowed both the "from" and "to".
+	return false
+}
+
+// Checks if a hostname is valid according to RFC 1123 and gateway API's requirement that it not be an IP address
+func (t *Translator) validateHostname(hostname string) error {
+	if errs := validation.IsDNS1123Subdomain(hostname); errs != nil {
+		return fmt.Errorf("hostname %q is invalid: %v", hostname, errs)
+	}
+
+	// IP addresses are not allowed so parsing the hostname as an address needs to fail
+	if _, err := netip.ParseAddr(hostname); err == nil {
+		return fmt.Errorf("hostname: %q cannot be an ip address", hostname)
+	}
+
+	labelIdx := 0
+	for i := range hostname {
+		if hostname[i] == '.' {
+
+			if i-labelIdx > 63 {
+				return fmt.Errorf("label: %q in hostname %q cannot exceed 63 characters", hostname[labelIdx:i], hostname)
+			}
+			labelIdx = i + 1
+		}
+	}
+	// Check the last label
+	if len(hostname)-labelIdx > 63 {
+		return fmt.Errorf("label: %q in hostname %q cannot exceed 63 characters", hostname[labelIdx:], hostname)
+	}
+
+	return nil
+}
+
+// validateSecretRef checks three things:
+//  1. Does the secret reference have a valid Group and kind
+//  2. If the secret reference is a cross-namespace reference,
+//     is it permitted by any ReferenceGrant
+//  3. Does the secret exist
+func (t *Translator) validateSecretRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretObjRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) (*v1.Secret, error) {
+
+	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
+		return nil, err
+	}
+
+	secretNamespace := from.namespace
+	if secretObjRef.Namespace != nil {
+		secretNamespace = string(*secretObjRef.Namespace)
+	}
+	secret := resources.GetSecret(secretNamespace, string(secretObjRef.Name))
+
+	if secret == nil {
+		return nil, fmt.Errorf(
+			"secret %s/%s does not exist", secretNamespace, secretObjRef.Name)
+	}
+
+	return secret, nil
+}
+
+func (t *Translator) validateConfigMapRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretObjRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) (*v1.ConfigMap, error) {
+
+	if err := t.validateSecretObjectRef(allowCrossNamespace, from, secretObjRef, resources); err != nil {
+		return nil, err
+	}
+
+	configMapNamespace := from.namespace
+	if secretObjRef.Namespace != nil {
+		configMapNamespace = string(*secretObjRef.Namespace)
+	}
+	configMap := resources.GetConfigMap(configMapNamespace, string(secretObjRef.Name))
+
+	if configMap == nil {
+		return nil, fmt.Errorf(
+			"configmap %s/%s does not exist", configMapNamespace, secretObjRef.Name)
+	}
+
+	return configMap, nil
+}
+
+func (t *Translator) validateSecretObjectRef(
+	allowCrossNamespace bool,
+	from crossNamespaceFrom,
+	secretRef gwapiv1b1.SecretObjectReference,
+	resources *Resources) error {
+	var kind string
+	if secretRef.Group != nil && string(*secretRef.Group) != "" {
+		return errors.New("secret ref group must be unspecified/empty")
+	}
+
+	if secretRef.Kind == nil { // nolint
+		kind = KindSecret
+	} else if string(*secretRef.Kind) == KindSecret {
+		kind = KindSecret
+	} else if string(*secretRef.Kind) == KindConfigMap {
+		kind = KindConfigMap
+	} else {
+		return fmt.Errorf("secret ref kind must be %s", KindSecret)
+	}
+
+	if secretRef.Namespace != nil &&
+		string(*secretRef.Namespace) != "" &&
+		string(*secretRef.Namespace) != from.namespace {
+		if !allowCrossNamespace {
+			return fmt.Errorf(
+				"secret ref namespace must be unspecified/empty or %s",
+				from.namespace)
+		}
+
+		if !t.validateCrossNamespaceRef(
+			from,
+			crossNamespaceTo{
+				group:     "",
+				kind:      kind,
+				namespace: string(*secretRef.Namespace),
+				name:      string(secretRef.Name),
+			},
+			resources.ReferenceGrants,
+		) {
+			return fmt.Errorf(
+				"certificate ref to secret %s/%s not permitted by any ReferenceGrant",
+				*secretRef.Namespace, secretRef.Name)
+		}
+
+	}
+
+	return nil
+}
+
+// TODO: zhaohuabing combine this function with the one in the route translator
+// validateExtServiceBackendReference validates the backend reference for an
+// external service referenced by an EG policy.
+// This can also be used for the other external services deployed in the cluster,
+// such as the external processing filter, gRPC Access Log Service, etc.
+// It checks:
+//  1. The group is nil or empty, indicating the core API group.
+//  2. The kind is Service.
+//  3. The port is specified.
+//  4. The service exists and the specified port is found.
+//  5. The cross-namespace reference is permitted by the ReferenceGrants if the
+//     namespace is different from the policy's namespace.
+func (t *Translator) validateExtServiceBackendReference(
+	backendRef *gwapiv1.BackendObjectReference,
+	ownerNamespace string,
+	resources *Resources) error {
+
+	// These are sanity checks, they should never happen because the API server
+	// should have caught them
+	if backendRef.Group != nil && *backendRef.Group != "" {
+		return errors.New(
+			"group is invalid, only the core API group (specified by omitting" +
+				" the group field or setting it to an empty string) is supported")
+	}
+	if backendRef.Kind != nil && *backendRef.Kind != KindService {
+		return errors.New("kind is invalid, only Service (specified by omitting " +
+			"the kind field or setting it to 'Service') is supported")
+	}
+	if backendRef.Port == nil {
+		return errors.New("a valid port number corresponding to a port on the Service must be specified")
+	}
+
+	// check if the service is valid
+	serviceNamespace := NamespaceDerefOr(backendRef.Namespace, ownerNamespace)
+	service := resources.GetService(serviceNamespace, string(backendRef.Name))
+	if service == nil {
+		return fmt.Errorf("service %s/%s not found", serviceNamespace, backendRef.Name)
+	}
+	var portFound bool
+	for _, port := range service.Spec.Ports {
+		portProtocol := port.Protocol
+		if port.Protocol == "" { // Default protocol is TCP
+			portProtocol = v1.ProtocolTCP
+		}
+		// currently only HTTP and GRPC are supported, both of which are TCP
+		if port.Port == int32(*backendRef.Port) && portProtocol == v1.ProtocolTCP {
+			portFound = true
+			break
+		}
+	}
+
+	if !portFound {
+		return fmt.Errorf(
+			"TCP Port %d not found on service %s/%s",
+			*backendRef.Port, serviceNamespace, string(backendRef.Name),
+		)
+	}
+
+	// check if the cross-namespace reference is permitted
+	// if backendRef.Namespace != nil && string(*backendRef.Namespace) != "" &&
+	// 	string(*backendRef.Namespace) != ownerNamespace {
+	// 	if !t.validateCrossNamespaceRef(
+	// 		crossNamespaceFrom{
+	// 			group:     egv1a1.GroupName,
+	// 			kind:      KindSecurityPolicy,
+	// 			namespace: ownerNamespace,
+	// 		},
+	// 		crossNamespaceTo{
+	// 			group:     GroupDerefOr(backendRef.Group, ""),
+	// 			kind:      KindDerefOr(backendRef.Kind, KindService),
+	// 			namespace: string(*backendRef.Namespace),
+	// 			name:      string(backendRef.Name),
+	// 		},
+	// 		resources.ReferenceGrants,
+	// 	) {
+	// 		return fmt.Errorf(
+	// 			"backend ref to %s %s/%s not permitted by any ReferenceGrant",
+	// 			KindService, *backendRef.Namespace, backendRef.Name)
+	// 	}
+	// }
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/version/version.go b/adapter/internal/operator/gateway-api/version/version.go
new file mode 100644
index 000000000..64440dd3a
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/version/version.go
@@ -0,0 +1,97 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package version
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"runtime/debug"
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
+	"sigs.k8s.io/yaml"
+)
+
+type Info struct {
+	EnvoyGatewayVersion    string `json:"envoyGatewayVersion"`
+	GatewayAPIVersion      string `json:"gatewayAPIVersion"`
+	EnvoyProxyVersion      string `json:"envoyProxyVersion"`
+	EnforcerVersion        string `json:"enforcerVersion"`
+	ShutdownManagerVersion string `json:"shutdownManagerVersion"`
+	GitCommitID            string `json:"gitCommitID"`
+}
+
+func Get() Info {
+	return Info{
+		EnvoyGatewayVersion:    envoyGatewayVersion,
+		GatewayAPIVersion:      gatewayAPIVersion,
+		EnvoyProxyVersion:      envoyProxyVersion,
+		EnforcerVersion:        enforcerVersion,
+		ShutdownManagerVersion: shutdownManagerVersion,
+		GitCommitID:            gitCommitID,
+	}
+}
+
+var (
+	envoyGatewayVersion    string
+	gatewayAPIVersion      string
+	envoyProxyVersion      = strings.Split(v1alpha1.DefaultEnvoyProxyImage, ":")[1]
+	enforcerVersion        = strings.Split(v1alpha1.DefaultEnforcerImage, ":")[1]
+	shutdownManagerVersion string
+	gitCommitID            string
+)
+
+func init() {
+	bi, ok := debug.ReadBuildInfo()
+	if ok {
+		for _, dep := range bi.Deps {
+			if dep.Path == "sigs.k8s.io/gateway-api" {
+				gatewayAPIVersion = dep.Version
+			}
+		}
+	}
+}
+
+// Print shows the versions of the Envoy Gateway.
+func Print(w io.Writer, format string) error {
+	v := Get()
+	switch format {
+	case "json":
+		if marshalled, err := json.MarshalIndent(v, "", "  "); err == nil {
+			_, _ = fmt.Fprintln(w, string(marshalled))
+		}
+	case "yaml":
+		if marshalled, err := yaml.Marshal(v); err == nil {
+			_, _ = fmt.Fprintln(w, string(marshalled))
+		}
+	default:
+		_, _ = fmt.Fprintf(w, "ENVOY_GATEWAY_VERSION: %s\n", v.EnvoyGatewayVersion)
+		_, _ = fmt.Fprintf(w, "ENVOY_PROXY_VERSION: %s\n", v.EnvoyProxyVersion)
+		_, _ = fmt.Fprintf(w, "GATEWAYAPI_VERSION: %s\n", v.GatewayAPIVersion)
+		_, _ = fmt.Fprintf(w, "SHUTDOWN_MANAGER_VERSION: %s\n", v.ShutdownManagerVersion)
+		_, _ = fmt.Fprintf(w, "GIT_COMMIT_ID: %s\n", v.GitCommitID)
+	}
+
+	return nil
+}
diff --git a/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go b/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
new file mode 100644
index 000000000..c9b217ae5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/cache/snapshotcache.go
@@ -0,0 +1,333 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/xds/v3/snapshotter.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package cache
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"strconv"
+	"sync"
+
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	discoveryv3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	cachev3 "github.com/envoyproxy/go-control-plane/pkg/cache/v3"
+	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/types"
+)
+
+var Hash = cachev3.IDHash{}
+
+// SnapshotCacheWithCallbacks uses the go-control-plane SimpleCache to store snapshots of
+// Envoy resources, sliced by Node ID so that we can do incremental xDS properly.
+// It does this by also implementing callbacks to make sure that the cache is kept
+// up to date for each new node.
+//
+// Having the cache also implement the callbacks is a little bit hacky, but it makes sure
+// that all the required bookkeeping happens.
+// TODO(youngnick): Talk to the go-control-plane maintainers and see if we can upstream
+// this in a better way.
+type SnapshotCacheWithCallbacks interface {
+	cachev3.SnapshotCache
+	serverv3.Callbacks
+	GenerateNewSnapshot(string, types.XdsResources) error
+}
+
+type snapshotMap map[string]*cachev3.Snapshot
+
+type nodeInfoMap map[int64]*corev3.Node
+
+type snapshotCache struct {
+	cachev3.SnapshotCache
+	streamIDNodeInfo nodeInfoMap
+	snapshotVersion  int64
+	lastSnapshot     snapshotMap
+	mu               sync.Mutex
+}
+
+// GenerateNewSnapshot takes a table of resources (the output from the IR->xDS
+// translator) and updates the snapshot version.
+func (s *snapshotCache) GenerateNewSnapshot(irKey string, resources types.XdsResources) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	version := s.newSnapshotVersion()
+
+	// Create a snapshot with all xDS resources.
+	snapshot, err := cachev3.NewSnapshot(
+		version,
+		resources,
+	)
+	if err != nil {
+		return err
+	}
+
+	s.lastSnapshot[irKey] = snapshot
+
+	for _, node := range s.getNodeIDs(irKey) {
+		loggers.LoggerAPKOperator.Debugf("Generating a snapshot with Node %s", node)
+		err := s.SetSnapshot(context.TODO(), node, snapshot)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// newSnapshotVersion increments the current snapshotVersion
+// and returns as a string.
+func (s *snapshotCache) newSnapshotVersion() string {
+	// Reset the snapshotVersion if it ever hits max size.
+	if s.snapshotVersion == math.MaxInt64 {
+		s.snapshotVersion = 0
+	}
+
+	// Increment the snapshot version & return as string.
+	s.snapshotVersion++
+	return strconv.FormatInt(s.snapshotVersion, 10)
+}
+
+// NewSnapshotCache gives you a fresh SnapshotCache.
+// It needs a logger that supports the go-control-plane
+// required interface (Debugf, Infof, Warnf, and Errorf).
+func NewSnapshotCache(ads bool) SnapshotCacheWithCallbacks {
+	// // Set up the nasty wrapper hack.
+	// wrappedLogger := logger.Sugar()
+	//todo(amali) check the logger passing
+	return &snapshotCache{
+		SnapshotCache:    cachev3.NewSnapshotCache(ads, &Hash, loggers.LoggerAPKOperator),
+		lastSnapshot:     make(snapshotMap),
+		streamIDNodeInfo: make(nodeInfoMap),
+	}
+}
+
+// getNodeIDs retrieves the node ids from the node info map whose
+// cluster field matches the ir key
+func (s *snapshotCache) getNodeIDs(irKey string) []string {
+	var nodeIDs []string
+	for _, node := range s.streamIDNodeInfo {
+		if node != nil && node.Cluster == irKey {
+			nodeIDs = append(nodeIDs, node.Id)
+		}
+	}
+
+	return nodeIDs
+}
+
+// OnStreamOpen and the other OnStream* functions implement the callbacks for the
+// state-of-the-world stream types.
+func (s *snapshotCache) OnStreamOpen(_ context.Context, streamID int64, _ string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.streamIDNodeInfo[streamID] = nil
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamClosed(streamID int64, _ *corev3.Node) {
+	// TODO: something with the node?
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.streamIDNodeInfo, streamID)
+}
+
+func (s *snapshotCache) OnStreamRequest(streamID int64, req *discoveryv3.DiscoveryRequest) error {
+	s.mu.Lock()
+	// We could do this a little earlier than the defer, since the last half of this func is only logging
+	// but that seemed like a premature optimization.
+	defer s.mu.Unlock()
+
+	// It's possible that only the first discovery request will have a node ID set.
+	// We also need to save the node ID to the node list anyway.
+	// So check if we have a nodeID for this stream already, then set it if not.
+	if s.streamIDNodeInfo[streamID] == nil {
+		if req.Node.Id == "" {
+			return fmt.Errorf("couldn't get the node ID from the first discovery request on stream %d", streamID)
+		}
+		loggers.LoggerAPKOperator.Debugf("First discovery request on stream %d, got nodeID %s", streamID, req.Node.Id)
+		s.streamIDNodeInfo[streamID] = req.Node
+	}
+	nodeID := s.streamIDNodeInfo[streamID].Id
+	cluster := s.streamIDNodeInfo[streamID].Cluster
+
+	var nodeVersion string
+
+	var errorCode int32
+	var errorMessage string
+
+	// If no snapshot has been generated yet, we can't do anything, so don't mess with this request.
+	// go-control-plane will respond with an empty response, then send an update when a snapshot is generated.
+	if s.lastSnapshot[cluster] == nil {
+		return nil
+	}
+
+	_, err := s.GetSnapshot(nodeID)
+	if err != nil {
+		err = s.SetSnapshot(context.TODO(), nodeID, s.lastSnapshot[cluster])
+		if err != nil {
+			return err
+		}
+	}
+
+	if req.Node != nil {
+		if bv := req.Node.GetUserAgentBuildVersion(); bv != nil && bv.Version != nil {
+			nodeVersion = fmt.Sprintf("v%d.%d.%d", bv.Version.MajorNumber, bv.Version.MinorNumber, bv.Version.Patch)
+		}
+	}
+
+	loggers.LoggerAPKOperator.Debugf("Got a new request, version_info %s, response_nonce %s, nodeID %s, node_version %s", req.VersionInfo, req.ResponseNonce, nodeID, nodeVersion)
+
+	if status := req.ErrorDetail; status != nil {
+		// if Envoy rejected the last update log the details here.
+		// TODO(youngnick): Handle NACK properly
+		errorCode = status.Code
+		errorMessage = status.Message
+	}
+
+	loggers.LoggerAPKOperator.Debugf("handling v3 xDS resource request, version_info %s, response_nonce %s, nodeID %s, node_version %s, resource_names %v, type_url %s, errorCode %d, errorMessage %s",
+		req.VersionInfo, req.ResponseNonce,
+		nodeID, nodeVersion, req.ResourceNames, req.GetTypeUrl(),
+		errorCode, errorMessage)
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamResponse(_ context.Context, streamID int64, _ *discoveryv3.DiscoveryRequest, _ *discoveryv3.DiscoveryResponse) {
+	// No mutex lock required here because no writing to the cache.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		loggers.LoggerAPKOperator.Errorf("Tried to send a response to a node we haven't seen yet on stream %d", streamID)
+	} else {
+		loggers.LoggerAPKOperator.Debugf("Sending Response on stream %d to node %s", streamID, node.Id)
+	}
+}
+
+// OnDeltaStreamOpen and the other OnDeltaStream*/OnStreamDelta* functions implement
+// the callbacks for the incremental xDS versions.
+// Yes, the different ordering in the name is part of the go-control-plane interface.
+func (s *snapshotCache) OnDeltaStreamOpen(_ context.Context, streamID int64, _ string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	// Ensure that we're adding the streamID to the Node ID list.
+	s.streamIDNodeInfo[streamID] = nil
+
+	return nil
+}
+
+func (s *snapshotCache) OnDeltaStreamClosed(streamID int64, _ *corev3.Node) {
+	// TODO: something with the node?
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	delete(s.streamIDNodeInfo, streamID)
+}
+
+func (s *snapshotCache) OnStreamDeltaRequest(streamID int64, req *discoveryv3.DeltaDiscoveryRequest) error {
+	s.mu.Lock()
+	// We could do this a little earlier than with a defer, since the last half of this func is logging
+	// but that seemed like a premature optimization.
+	defer s.mu.Unlock()
+
+	var nodeVersion string
+	var errorCode int32
+	var errorMessage string
+	// It's possible that only the first incremental discovery request will have a node ID set.
+	// We also need to save the node ID to the node list anyway.
+	// So check if we have a nodeID for this stream already, then set it if not.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		if req.Node.Id == "" {
+			return fmt.Errorf("couldn't get the node ID from the first incremental discovery request on stream %d", streamID)
+		}
+		loggers.LoggerAPKOperator.Debugf("First incremental discovery request on stream %d, got nodeID %s", streamID, req.Node.Id)
+		s.streamIDNodeInfo[streamID] = req.Node
+	}
+	nodeID := s.streamIDNodeInfo[streamID].Id
+	cluster := s.streamIDNodeInfo[streamID].Cluster
+
+	// If no snapshot has been written into the snapshotCache yet, we can't do anything, so don't mess with
+	// this request. go-control-plane will respond with an empty response, then send an update when a
+	// snapshot is generated.
+	if s.lastSnapshot[cluster] == nil {
+		return nil
+	}
+
+	_, err := s.GetSnapshot(nodeID)
+	if err != nil {
+		err = s.SetSnapshot(context.TODO(), nodeID, s.lastSnapshot[cluster])
+		if err != nil {
+			return err
+		}
+	}
+
+	if req.Node != nil {
+		if bv := req.Node.GetUserAgentBuildVersion(); bv != nil && bv.Version != nil {
+			nodeVersion = fmt.Sprintf("v%d.%d.%d", bv.Version.MajorNumber, bv.Version.MinorNumber, bv.Version.Patch)
+		}
+	}
+
+	loggers.LoggerAPKOperator.Debugf("Got a new request, response_nonce %s, nodeID %s, node_version %s",
+		req.ResponseNonce, nodeID, nodeVersion)
+	if status := req.ErrorDetail; status != nil {
+		// if Envoy rejected the last update log the details here.
+		// TODO(youngnick): Handle NACK properly
+		errorCode = status.Code
+		errorMessage = status.Message
+	}
+	loggers.LoggerAPKOperator.Debugf("handling v3 xDS resource request, response_nonce %s, nodeID %s, node_version %s, resource_names_subscribe %v, resource_names_unsubscribe %v, type_url %s, errorCode %d, errorMessage %s",
+		req.ResponseNonce,
+		nodeID, nodeVersion,
+		req.ResourceNamesSubscribe, req.ResourceNamesUnsubscribe,
+		req.GetTypeUrl(),
+		errorCode, errorMessage)
+
+	return nil
+}
+
+func (s *snapshotCache) OnStreamDeltaResponse(streamID int64, _ *discoveryv3.DeltaDiscoveryRequest, _ *discoveryv3.DeltaDiscoveryResponse) {
+	// No mutex lock required here because no writing to the cache.
+	node := s.streamIDNodeInfo[streamID]
+	if node == nil {
+		loggers.LoggerAPKOperator.Errorf("Tried to send a response to a node we haven't seen yet on stream %d", streamID)
+	} else {
+		loggers.LoggerAPKOperator.Debugf("Sending Incremental Response on stream %d to node %s", streamID, node.Id)
+	}
+}
+
+func (s *snapshotCache) OnFetchRequest(_ context.Context, _ *discoveryv3.DiscoveryRequest) error {
+	return nil
+}
+
+func (s *snapshotCache) OnFetchResponse(_ *discoveryv3.DiscoveryRequest, _ *discoveryv3.DiscoveryResponse) {
+}
diff --git a/adapter/internal/operator/gateway-api/xds/filters/wellknown.go b/adapter/internal/operator/gateway-api/xds/filters/wellknown.go
new file mode 100644
index 000000000..215f0769b
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/filters/wellknown.go
@@ -0,0 +1,64 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package filters
+
+import (
+	grpcstats "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_stats/v3"
+	grpcweb "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/grpc_web/v3"
+	httprouter "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/router/v3"
+	hcm "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/wellknown"
+	"github.com/wso2/apk/adapter/pkg/utils/protocov"
+	"google.golang.org/protobuf/types/known/wrapperspb"
+)
+
+var (
+	GRPCWeb = &hcm.HttpFilter{
+		Name: wellknown.GRPCWeb,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&grpcweb.GrpcWeb{}),
+		},
+	}
+	GRPCStats = &hcm.HttpFilter{
+		Name: wellknown.HTTPGRPCStats,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&grpcstats.FilterConfig{
+				EmitFilterState: true,
+				PerMethodStatSpecifier: &grpcstats.FilterConfig_StatsForAllMethods{
+					StatsForAllMethods: &wrapperspb.BoolValue{Value: true},
+				},
+			}),
+		},
+	}
+)
+
+func GenerateRouterFilter(enableEnvoyHeaders bool) *hcm.HttpFilter {
+	return &hcm.HttpFilter{
+		Name: wellknown.Router,
+		ConfigType: &hcm.HttpFilter_TypedConfig{
+			TypedConfig: protocov.ToAny(&httprouter.Router{
+				SuppressEnvoyHeaders: !enableEnvoyHeaders,
+			}),
+		},
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
new file mode 100644
index 000000000..ffbafca29
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -0,0 +1,187 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"strconv"
+	"time"
+
+	"google.golang.org/grpc/keepalive"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/service/cluster/v3"
+	discoveryv3 "github.com/envoyproxy/go-control-plane/envoy/service/discovery/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/service/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/service/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/service/route/v3"
+	runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3"
+	secretv3 "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
+	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/cache"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/types"
+	"github.com/wso2/apk/adapter/pkg/utils/tlsutils"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
+)
+
+const (
+	// XdsServerAddress is the listening address of the xds-server.
+	XdsServerAddress = "0.0.0.0"
+	// xdsTLSCertFilename is the fully qualified path of the file containing the
+	// xDS server TLS certificate.
+	// xdsTLSCertFilename = "/home/wso2/security/keystore/adapter.crt"
+	// // xdsTLSKeyFilename is the fully qualified path of the file containing the
+	// // xDS server TLS key.
+	// xdsTLSKeyFilename = "/home/wso2/security/keystore/adapter.key"
+	// xdsTLSCaFilename is the fully qualified path of the file containing the
+	// xDS server trusted CA certificate.
+	// xdsTLSCaFilename = "/home/wso2/security/truststore/adapter.crt"
+)
+
+type Config struct {
+	Xds   *message.Xds
+	grpc  *grpc.Server
+	cache cache.SnapshotCacheWithCallbacks
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("xds-server")
+}
+
+// Start starts the xds-server runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+
+	// Set up the gRPC server and register the xDS handler.
+	// Create SnapshotCache before start subscribeAndTranslate,
+	// prevent panics in case cache is nil.
+	cfg := r.tlsConfig(tlsutils.GetKeyLocations())
+	r.grpc = grpc.NewServer(grpc.Creds(credentials.NewTLS(cfg)), grpc.KeepaliveEnforcementPolicy(keepalive.EnforcementPolicy{
+		MinTime:             15 * time.Second,
+		PermitWithoutStream: true,
+	}))
+
+	r.cache = cache.NewSnapshotCache(true)
+	registerServer(serverv3.NewServer(ctx, r.cache, r.cache), r.grpc)
+
+	// Start and listen xDS gRPC Server.
+	go r.serveXdsServer(ctx)
+
+	// Start message Subscription.
+	go r.subscribeAndTranslate(ctx)
+	loggers.LoggerAPKOperator.Info("started xds runner")
+	return
+}
+
+func (r *Runner) serveXdsServer(ctx context.Context) {
+	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
+	l, err := net.Listen("tcp", addr)
+	if err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", bootstrap.DefaultXdsServerPort)
+		return
+	}
+
+	go func() {
+		<-ctx.Done()
+		loggers.LoggerAPKOperator.Info("grpc server shutting down")
+		// We don't use GracefulStop here because envoy
+		// has long-lived hanging xDS requests. There's no
+		// mechanism to make those pending requests fail,
+		// so we forcibly terminate the TCP sessions.
+		r.grpc.Stop()
+	}()
+
+	if err = r.grpc.Serve(l); err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to start grpc based xds server")
+	}
+}
+
+// registerServer registers the given xDS protocol Server with the gRPC
+// runtime.
+func registerServer(srv serverv3.Server, g *grpc.Server) {
+	// register services
+	discoveryv3.RegisterAggregatedDiscoveryServiceServer(g, srv)
+	secretv3.RegisterSecretDiscoveryServiceServer(g, srv)
+	clusterv3.RegisterClusterDiscoveryServiceServer(g, srv)
+	endpointv3.RegisterEndpointDiscoveryServiceServer(g, srv)
+	listenerv3.RegisterListenerDiscoveryServiceServer(g, srv)
+	routev3.RegisterRouteDiscoveryServiceServer(g, srv)
+	runtimev3.RegisterRuntimeDiscoveryServiceServer(g, srv)
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: string("xds-server"), Message: "xds"}, r.Xds.Subscribe(ctx),
+		func(update message.Update[string, *types.ResourceVersionTable], errChan chan error) {
+			key := update.Key
+			val := update.Value
+
+			loggers.LoggerAPKOperator.Info("Received an update in xds server")
+			var err error
+			if update.Delete {
+				err = r.cache.GenerateNewSnapshot(key, nil)
+			} else if val != nil && val.XdsResources != nil {
+				if r.cache == nil {
+					loggers.LoggerAPKOperator.Error("Failed to init snapshot cache ", err)
+					errChan <- err
+				} else {
+					// Update snapshot cache
+					err = r.cache.GenerateNewSnapshot(key, val.XdsResources)
+				}
+			}
+			if err != nil {
+				loggers.LoggerAPKOperator.Error("Failed to generate a snapshot ", err)
+				errChan <- err
+			}
+		},
+	)
+
+	loggers.LoggerAPKOperator.Info("subscriber shutting down")
+}
+
+func (r *Runner) tlsConfig(cert, key, ca string) *tls.Config {
+	extCert, err := tlsutils.GetServerCertificate(cert, key)
+	if err != nil {
+		loggers.LoggerAPKOperator.Error("failed to parse CA certificate")
+		return nil
+	}
+	caCertPool := tlsutils.GetTrustedCertPool(ca)
+	return &tls.Config{
+		Certificates: []tls.Certificate{extCert},
+		ClientAuth:   tls.RequireAndVerifyClientCert,
+		ClientCAs:    caCertPool,
+		MinVersion:   tls.VersionTLS13,
+	}
+}
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
new file mode 100644
index 000000000..3dba8c03f
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
@@ -0,0 +1,201 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"net"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+)
+
+// func TestTLSConfig(t *testing.T) {
+// 	// Create trusted CA, server and client certs.
+// 	trustedCACert := certyaml.Certificate{
+// 		Subject: "cn=trusted-ca",
+// 	}
+// 	egCertBeforeRotation := certyaml.Certificate{
+// 		Subject:         "cn=eg-before-rotation",
+// 		SubjectAltNames: []string{"DNS:localhost"},
+// 		Issuer:          &trustedCACert,
+// 	}
+// 	egCertAfterRotation := certyaml.Certificate{
+// 		Subject:         "cn=eg-after-rotation",
+// 		SubjectAltNames: []string{"DNS:localhost"},
+// 		Issuer:          &trustedCACert,
+// 	}
+// 	trustedEnvoyCert := certyaml.Certificate{
+// 		Subject: "cn=trusted-envoy",
+// 		Issuer:  &trustedCACert,
+// 	}
+
+// 	// Create another CA and a client cert to test that untrusted clients are denied.
+// 	untrustedCACert := certyaml.Certificate{
+// 		Subject: "cn=untrusted-ca",
+// 	}
+// 	untrustedClientCert := certyaml.Certificate{
+// 		Subject: "cn=untrusted-client",
+// 		Issuer:  &untrustedCACert,
+// 	}
+
+// 	caCertPool := x509.NewCertPool()
+// 	ca, err := trustedCACert.X509Certificate()
+// 	require.NoError(t, err)
+// 	caCertPool.AddCert(&ca)
+
+// 	tests := map[string]struct {
+// 		serverCredentials *certyaml.Certificate
+// 		clientCredentials *certyaml.Certificate
+// 		expectError       bool
+// 	}{
+// 		"successful TLS connection established": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"rotating server credentials returns new server cert": {
+// 			serverCredentials: &egCertAfterRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"rotating server credentials again to ensure rotation can be repeated": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &trustedEnvoyCert,
+// 			expectError:       false,
+// 		},
+// 		"fail to connect with client certificate which is not signed by correct CA": {
+// 			serverCredentials: &egCertBeforeRotation,
+// 			clientCredentials: &untrustedClientCert,
+// 			expectError:       true,
+// 		},
+// 	}
+
+// 	// Create temporary directory to store certificates and key for the server.
+// 	configDir, err := os.MkdirTemp("", "eg-testdata-")
+// 	require.NoError(t, err)
+// 	defer os.RemoveAll(configDir)
+
+// 	caFile := filepath.Join(configDir, "ca.crt")
+// 	certFile := filepath.Join(configDir, "tls.crt")
+// 	keyFile := filepath.Join(configDir, "tls.key")
+
+// 	// Initial set of credentials must be written into temp directory before
+// 	// starting the tests to avoid error at server startup.
+// 	err = trustedCACert.WritePEM(caFile, keyFile)
+// 	require.NoError(t, err)
+// 	err = egCertBeforeRotation.WritePEM(certFile, keyFile)
+// 	require.NoError(t, err)
+
+// 	r := New(&Config{})
+// 	g := grpc.NewServer(grpc.Creds(credentials.NewTLS(r.tlsConfig(certFile, keyFile, caFile))))
+// 	if g == nil {
+// 		t.Error("failed to create server")
+// 	}
+
+// 	address := "localhost:8001"
+// 	l, err := net.Listen("tcp", address)
+// 	require.NoError(t, err)
+
+// 	go func() {
+// 		err := g.Serve(l)
+// 		require.NoError(t, err)
+// 	}()
+// 	defer g.GracefulStop()
+
+// 	for name, tc := range tests {
+// 		tc := tc
+// 		t.Run(name, func(t *testing.T) {
+// 			// Store certificate and key to temp dir used by serveContext.
+// 			err = tc.serverCredentials.WritePEM(certFile, keyFile)
+// 			require.NoError(t, err)
+// 			clientCert, _ := tc.clientCredentials.TLSCertificate()
+// 			receivedCert, err := tryConnect(address, clientCert, caCertPool)
+// 			gotError := err != nil
+// 			if gotError != tc.expectError {
+// 				t.Errorf("Unexpected result when connecting to the server: %s", err)
+// 			}
+// 			if err == nil {
+// 				expectedCert, _ := tc.serverCredentials.X509Certificate()
+// 				assert.Equal(t, &expectedCert, receivedCert)
+// 			}
+// 		})
+// 	}
+// }
+
+// tryConnect tries to establish TLS connection to the server.
+// If successful, return the server certificate.
+func tryConnect(address string, clientCert tls.Certificate, caCertPool *x509.CertPool) (*x509.Certificate, error) {
+	clientConfig := &tls.Config{
+		ServerName:   "localhost",
+		MinVersion:   tls.VersionTLS13,
+		Certificates: []tls.Certificate{clientCert},
+		RootCAs:      caCertPool,
+	}
+	conn, err := tls.Dial("tcp", address, clientConfig)
+	if err != nil {
+		return nil, err
+	}
+	defer conn.Close()
+
+	err = peekError(conn)
+	if err != nil {
+		return nil, err
+	}
+
+	return conn.ConnectionState().PeerCertificates[0], nil
+}
+
+// peekError is a workaround for TLS 1.3: due to shortened handshake, TLS alert
+// from server is received at first read from the socket. To receive alert for
+// bad certificate, this function tries to read one byte.
+// Adapted from https://golang.org/src/crypto/tls/handshake_client_test.go
+func peekError(conn net.Conn) error {
+	_ = conn.SetReadDeadline(time.Now().Add(100 * time.Millisecond))
+	_, err := conn.Read(make([]byte, 1))
+	if err != nil {
+		var netErr net.Error
+		if !errors.As(netErr, &netErr) || !netErr.Timeout() {
+			return err
+		}
+	}
+	return nil
+}
+
+func TestServeXdsServerListenFailed(t *testing.T) {
+	// Occupy the address to make listening failed
+	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
+	l, err := net.Listen("tcp", addr)
+	require.NoError(t, err)
+	defer l.Close()
+
+	r := New(&Config{})
+	// Don't crash in this function
+	r.serveXdsServer(context.Background())
+}
diff --git a/adapter/internal/operator/gateway-api/xds/utils/utils.go b/adapter/internal/operator/gateway-api/xds/utils/utils.go
new file mode 100644
index 000000000..e6f44d5c5
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/xds/utils/utils.go
@@ -0,0 +1,66 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"bytes"
+
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+	"sigs.k8s.io/yaml"
+)
+
+func MarshalResourcesToJSON(resources []types.Resource) ([]byte, error) {
+	msgs := make([]proto.Message, 0)
+	for _, resource := range resources {
+		msgs = append(msgs, resource.(proto.Message))
+	}
+	var buffer bytes.Buffer
+	buffer.WriteByte('[')
+	for idx, msg := range msgs {
+		if idx != 0 {
+			buffer.WriteByte(',')
+		}
+		b, err := protojson.Marshal(msg)
+		if err != nil {
+			return nil, err
+		}
+		buffer.Write(b)
+	}
+	buffer.WriteByte(']')
+	return buffer.Bytes(), nil
+}
+
+// ResourcesToYAMLString converts xDS Resource types into YAML string
+func ResourcesToYAMLString(resources []types.Resource) (string, error) {
+	jsonBytes, err := MarshalResourcesToJSON(resources)
+	if err != nil {
+		return "", err
+	}
+	data, err := yaml.JSONToYAML(jsonBytes)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
diff --git a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
new file mode 100644
index 000000000..6463a14e3
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
@@ -0,0 +1,213 @@
+//go:build !ignore_autogenerated
+
+/*
+ *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ */
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package gatewayapi
+
+import (
+	"github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	corev1 "k8s.io/api/core/v1"
+	discoveryv1 "k8s.io/api/discovery/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"sigs.k8s.io/gateway-api/apis/v1"
+	"sigs.k8s.io/gateway-api/apis/v1alpha2"
+	"sigs.k8s.io/gateway-api/apis/v1beta1"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *Resources) DeepCopyInto(out *Resources) {
+	*out = *in
+	if in.GatewayClass != nil {
+		in, out := &in.GatewayClass, &out.GatewayClass
+		*out = new(v1.GatewayClass)
+		(*in).DeepCopyInto(*out)
+	}
+	if in.Gateways != nil {
+		in, out := &in.Gateways, &out.Gateways
+		*out = make([]*v1.Gateway, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1.Gateway)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.HTTPRoutes != nil {
+		in, out := &in.HTTPRoutes, &out.HTTPRoutes
+		*out = make([]*v1.HTTPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1.HTTPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.GRPCRoutes != nil {
+		in, out := &in.GRPCRoutes, &out.GRPCRoutes
+		*out = make([]*v1alpha2.GRPCRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.GRPCRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TLSRoutes != nil {
+		in, out := &in.TLSRoutes, &out.TLSRoutes
+		*out = make([]*v1alpha2.TLSRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.TLSRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.TCPRoutes != nil {
+		in, out := &in.TCPRoutes, &out.TCPRoutes
+		*out = make([]*v1alpha2.TCPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.TCPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.UDPRoutes != nil {
+		in, out := &in.UDPRoutes, &out.UDPRoutes
+		*out = make([]*v1alpha2.UDPRoute, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.UDPRoute)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ReferenceGrants != nil {
+		in, out := &in.ReferenceGrants, &out.ReferenceGrants
+		*out = make([]*v1beta1.ReferenceGrant, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1beta1.ReferenceGrant)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Namespaces != nil {
+		in, out := &in.Namespaces, &out.Namespaces
+		*out = make([]*corev1.Namespace, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Namespace)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Services != nil {
+		in, out := &in.Services, &out.Services
+		*out = make([]*corev1.Service, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Service)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Backends != nil {
+		in, out := &in.Backends, &out.Backends
+		*out = make([]*v1alpha1.Backend, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha1.Backend)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.EndpointSlices != nil {
+		in, out := &in.EndpointSlices, &out.EndpointSlices
+		*out = make([]*discoveryv1.EndpointSlice, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(discoveryv1.EndpointSlice)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.Secrets != nil {
+		in, out := &in.Secrets, &out.Secrets
+		*out = make([]*corev1.Secret, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.Secret)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ConfigMaps != nil {
+		in, out := &in.ConfigMaps, &out.ConfigMaps
+		*out = make([]*corev1.ConfigMap, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(corev1.ConfigMap)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+	if in.ExtensionRefFilters != nil {
+		in, out := &in.ExtensionRefFilters, &out.ExtensionRefFilters
+		*out = make([]unstructured.Unstructured, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+	if in.BackendTLSPolicies != nil {
+		in, out := &in.BackendTLSPolicies, &out.BackendTLSPolicies
+		*out = make([]*v1alpha2.BackendTLSPolicy, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(v1alpha2.BackendTLSPolicy)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
+func (in *Resources) DeepCopy() *Resources {
+	if in == nil {
+		return nil
+	}
+	out := new(Resources)
+	in.DeepCopyInto(out)
+	return out
+}
diff --git a/adapter/internal/operator/infrastructure/runner/runner.go b/adapter/internal/operator/infrastructure/runner/runner.go
new file mode 100644
index 000000000..f4f9b4010
--- /dev/null
+++ b/adapter/internal/operator/infrastructure/runner/runner.go
@@ -0,0 +1,103 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+type Config struct {
+	InfraIR *message.InfraIR
+}
+
+type Runner struct {
+	Config
+	mgr infrastructure.Manager
+}
+
+func (r *Runner) Name() string {
+	return string("infrastructure")
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+// Start starts the infrastructure runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+
+	r.mgr, err = infrastructure.NewManager()
+	if err != nil {
+		loggers.LoggerAPKOperator.Error(err, "failed to create new manager")
+		return err
+	}
+	go r.subscribeToProxyInfraIR(ctx)
+
+	// Enable global ratelimit if it has been configured.
+	// if r.EnvoyGateway.RateLimit != nil {
+	// 	go r.enableRateLimitInfra(ctx)
+	// }
+
+	loggers.LoggerAPKOperator.Info("started")
+	return
+}
+
+func (r *Runner) subscribeToProxyInfraIR(ctx context.Context) {
+	// Subscribe to resources
+	message.HandleSubscription(message.Metadata{Runner: string("infrastructure"), Message: "infra-ir"}, r.InfraIR.Subscribe(ctx),
+		func(update message.Update[string, *ir.Infra], errChan chan error) {
+			loggers.LoggerAPKOperator.Info("Received an update in infrastructure provider ...")
+			val := update.Value
+
+			if update.Delete {
+				if err := r.mgr.DeleteProxyInfra(ctx, val); err != nil {
+					loggers.LoggerAPKOperator.Error(err, "failed to delete infra")
+					errChan <- err
+				}
+			} else {
+				// Manage the proxy infra.
+				if len(val.Proxy.Listeners) == 0 {
+					loggers.LoggerAPKOperator.Info("Infra IR was updated, but no listeners were found. Skipping infra creation.")
+					return
+				}
+
+				if err := r.mgr.CreateOrUpdateProxyInfra(ctx, val); err != nil {
+					loggers.LoggerAPKOperator.Error("Failed to create new infra ", err)
+					errChan <- err
+				}
+			}
+		},
+	)
+	loggers.LoggerAPKOperator.Info("infra subscriber shutting down")
+}
+
+// func (r *Runner) enableRateLimitInfra(ctx context.Context) {
+// 	if err := r.mgr.CreateOrUpdateRateLimitInfra(ctx); err != nil {
+// 		loggers.LoggerAPKOperator.Error(err, "failed to create ratelimit infra")
+// 	}
+// }
diff --git a/adapter/internal/operator/message/types.go b/adapter/internal/operator/message/types.go
new file mode 100644
index 000000000..a5e22562c
--- /dev/null
+++ b/adapter/internal/operator/message/types.go
@@ -0,0 +1,106 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message
+
+import (
+	"github.com/telepresenceio/watchable"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	xdstypes "github.com/wso2/apk/adapter/internal/types"
+	"k8s.io/apimachinery/pkg/types"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// ProviderResources message
+type ProviderResources struct {
+	// GatewayAPIResources is a map from a GatewayClass name to
+	// a group of gateway API and other related resources.
+	GatewayAPIResources watchable.Map[string, *gatewayapi.ControllerResources]
+
+	// GatewayAPIStatuses is a group of gateway api
+	// resource statuses maps.
+	GatewayAPIStatuses
+}
+
+func (p *ProviderResources) GetResources() []*gatewayapi.Resources {
+	if p.GatewayAPIResources.Len() == 0 {
+		return nil
+	}
+
+	for _, v := range p.GatewayAPIResources.LoadAll() {
+		return *v
+	}
+
+	return nil
+}
+
+func (p *ProviderResources) GetResourcesByGatewayClass(name string) *gatewayapi.Resources {
+	for _, r := range p.GetResources() {
+		if r != nil && r.GatewayClass != nil && r.GatewayClass.Name == name {
+			return r
+		}
+	}
+
+	return nil
+}
+
+func (p *ProviderResources) GetResourcesKey() string {
+	if p.GatewayAPIResources.Len() == 0 {
+		return ""
+	}
+	for k := range p.GatewayAPIResources.LoadAll() {
+		return k
+	}
+	return ""
+}
+
+func (p *ProviderResources) Close() {
+	p.GatewayAPIResources.Close()
+	p.GatewayAPIStatuses.Close()
+}
+
+// GatewayAPIStatuses contains gateway API resources statuses
+type GatewayAPIStatuses struct {
+	GatewayStatuses   watchable.Map[types.NamespacedName, *gwapiv1.GatewayStatus]
+	HTTPRouteStatuses watchable.Map[types.NamespacedName, *gwapiv1.HTTPRouteStatus]
+}
+
+func (s *GatewayAPIStatuses) Close() {
+	s.GatewayStatuses.Close()
+	s.HTTPRouteStatuses.Close()
+}
+
+// XdsIR message
+type XdsIR struct {
+	watchable.Map[string, *ir.Xds]
+}
+
+// InfraIR message
+type InfraIR struct {
+	watchable.Map[string, *ir.Infra]
+}
+
+// Xds message
+type Xds struct {
+	watchable.Map[string, *xdstypes.ResourceVersionTable]
+}
diff --git a/adapter/internal/operator/message/watchutil.go b/adapter/internal/operator/message/watchutil.go
new file mode 100644
index 000000000..f72ed1927
--- /dev/null
+++ b/adapter/internal/operator/message/watchutil.go
@@ -0,0 +1,71 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message
+
+import (
+	"github.com/telepresenceio/watchable"
+	"github.com/wso2/apk/adapter/internal/loggers"
+)
+
+type Update[K comparable, V any] watchable.Update[K, V]
+
+type Metadata struct {
+	Runner  string
+	Message string
+}
+
+// HandleSubscription takes a channel returned by
+// watchable.Map.Subscribe() (or .SubscribeSubset()), and calls the
+// given function for each initial value in the map, and for any
+// updates.
+//
+// This is better than simply iterating over snapshot.Updates because
+// it handles the case where the watchable.Map already contains
+// entries before .Subscribe is called.
+func HandleSubscription[K comparable, V any](
+	meta Metadata,
+	subscription <-chan watchable.Snapshot[K, V],
+	handle func(updateFunc Update[K, V], errChans chan error),
+) {
+	//TODO: find a suitable value
+	errChans := make(chan error, 10)
+	go func() {
+		for err := range errChans {
+			loggers.LoggerAPKOperator.Error(err, "observed an error")
+		}
+	}()
+
+	if snapshot, ok := <-subscription; ok {
+		for k, v := range snapshot.State {
+			handle(Update[K, V]{
+				Key:   k,
+				Value: v,
+			}, errChans)
+		}
+	}
+	for snapshot := range subscription {
+		for _, update := range snapshot.Updates {
+			handle(Update[K, V](update), errChans)
+		}
+	}
+}
diff --git a/adapter/internal/operator/message/watchutil_test.go b/adapter/internal/operator/message/watchutil_test.go
new file mode 100644
index 000000000..2206b25d4
--- /dev/null
+++ b/adapter/internal/operator/message/watchutil_test.go
@@ -0,0 +1,79 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package message_test
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/telepresenceio/watchable"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+)
+
+func TestHandleSubscriptionAlreadyClosed(t *testing.T) {
+	ch := make(chan watchable.Snapshot[string, any])
+	close(ch)
+
+	var calls int
+	message.HandleSubscription[string, any](
+		message.Metadata{Runner: "demo", Message: "demo"},
+		ch,
+		func(update message.Update[string, any], errChans chan error) { calls++ },
+	)
+	assert.Equal(t, 0, calls)
+}
+
+func TestHandleSubscriptionAlreadyInitialized(t *testing.T) {
+	var m watchable.Map[string, any]
+	m.Store("foo", "bar")
+
+	endCtx, end := context.WithCancel(context.Background())
+	go func() {
+		<-endCtx.Done()
+		m.Store("baz", "qux")
+		m.Delete("qux")       // no-op
+		m.Store("foo", "bar") // no-op
+		m.Delete("baz")
+		time.Sleep(100 * time.Millisecond)
+		m.Close()
+	}()
+
+	var storeCalls int
+	var deleteCalls int
+	message.HandleSubscription[string, any](
+		message.Metadata{Runner: "demo", Message: "demo"},
+		m.Subscribe(context.Background()),
+		func(update message.Update[string, any], errChans chan error) {
+			end()
+			if update.Delete {
+				deleteCalls++
+			} else {
+				storeCalls++
+			}
+		},
+	)
+	assert.Equal(t, 2, storeCalls)
+	assert.Equal(t, 1, deleteCalls)
+}
diff --git a/adapter/internal/operator/provider-resources/runner/runner.go b/adapter/internal/operator/provider-resources/runner/runner.go
new file mode 100644
index 000000000..78982e9c6
--- /dev/null
+++ b/adapter/internal/operator/provider-resources/runner/runner.go
@@ -0,0 +1,249 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	"github.com/wso2/apk/adapter/internal/operator/utils"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
+	v1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+type Config struct {
+	ProviderResources *message.ProviderResources
+	XdsIR             *message.XdsIR
+	InfraIR           *message.InfraIR
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return "gateway-api"
+}
+
+// Start starts the gateway-api translator runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	go r.subscribeAndTranslate(ctx)
+	return
+}
+
+func (r *Runner) subscribeAndTranslate(ctx context.Context) {
+	message.HandleSubscription(message.Metadata{Runner: "gateway-api", Message: "provider-resources"}, r.ProviderResources.GatewayAPIResources.Subscribe(ctx),
+		func(update message.Update[string, *gatewayapi.ControllerResources], errChan chan error) {
+			val := update.Value
+			loggers.LoggerAPKOperator.Info("Received an update in provider resources ...")
+			// There is only 1 key which is the controller name
+			// so when a delete is triggered, delete all IR keys
+			if update.Delete || val == nil {
+				r.deleteAllIRKeys()
+				r.deleteAllStatusKeys()
+				return
+			}
+
+			// IR keys for watchable
+			var curIRKeys, newIRKeys []string
+
+			// Get current IR keys
+			for key := range r.InfraIR.LoadAll() {
+				curIRKeys = append(curIRKeys, key)
+			}
+
+			// Get all status keys from watchable and save them in this StatusesToDelete structure.
+			// Iterating through the controller resources, any valid keys will be removed from statusesToDelete.
+			// Remaining keys will be deleted from watchable before we exit this function.
+			statusesToDelete := r.getAllStatuses()
+
+			for _, resources := range *val {
+				// Translate and publish IRs.
+				t := &gatewayapi.Translator{
+					GatewayControllerName: "wso2.com/apk-gateway-default",
+					GatewayClassName:      v1.ObjectName(resources.GatewayClass.Name),
+				}
+
+				// Translate to IR
+				result := t.Translate(resources)
+
+				// Publish the IRs.
+				// Also validate the ir before sending it.
+				for key, val := range result.InfraIR {
+					if err := val.Validate(); err != nil {
+						loggers.LoggerAPKOperator.Error(err, "unable to validate infra ir, skipped sending it")
+						errChan <- err
+					} else {
+						r.InfraIR.Store(key, val)
+						newIRKeys = append(newIRKeys, key)
+					}
+				}
+
+				for key, val := range result.XdsIR {
+					if err := val.Validate(); err != nil {
+						loggers.LoggerAPKOperator.Error(err, "unable to validate xds ir, skipped sending it")
+						errChan <- err
+					} else {
+						r.XdsIR.Store(key, val)
+					}
+				}
+
+				// Update Status
+				for _, gateway := range result.Gateways {
+					gateway := gateway
+					key := utils.NamespacedName(gateway)
+					r.ProviderResources.GatewayStatuses.Store(key, &gateway.Status)
+					delete(statusesToDelete.GatewayStatusKeys, key)
+				}
+				for _, httpRoute := range result.HTTPRoutes {
+					httpRoute := httpRoute
+					key := utils.NamespacedName(httpRoute)
+					r.ProviderResources.HTTPRouteStatuses.Store(key, &httpRoute.Status)
+					delete(statusesToDelete.HTTPRouteStatusKeys, key)
+				}
+				// 	for _, grpcRoute := range result.GRPCRoutes {
+				// 		grpcRoute := grpcRoute
+				// 		key := utils.NamespacedName(grpcRoute)
+				// 		r.ProviderResources.GRPCRouteStatuses.Store(key, &grpcRoute.Status)
+				// 		delete(statusesToDelete.GRPCRouteStatusKeys, key)
+				// 	}
+				// 	for _, tlsRoute := range result.TLSRoutes {
+				// 		tlsRoute := tlsRoute
+				// 		key := utils.NamespacedName(tlsRoute)
+				// 		r.ProviderResources.TLSRouteStatuses.Store(key, &tlsRoute.Status)
+				// 		delete(statusesToDelete.TLSRouteStatusKeys, key)
+				// 	}
+				// 	for _, tcpRoute := range result.TCPRoutes {
+				// 		tcpRoute := tcpRoute
+				// 		key := utils.NamespacedName(tcpRoute)
+				// 		r.ProviderResources.TCPRouteStatuses.Store(key, &tcpRoute.Status)
+				// 		delete(statusesToDelete.TCPRouteStatusKeys, key)
+				// 	}
+				// 	for _, udpRoute := range result.UDPRoutes {
+				// 		udpRoute := udpRoute
+				// 		key := utils.NamespacedName(udpRoute)
+				// 		r.ProviderResources.UDPRouteStatuses.Store(key, &udpRoute.Status)
+				// 		delete(statusesToDelete.UDPRouteStatusKeys, key)
+				// 	}
+
+				// 	// Skip updating status for policies with empty status
+				// 	// They may have been skipped in this translation because
+				// 	// their target is not found (not relevant)
+
+				// 	for _, backendTLSPolicy := range result.BackendTLSPolicies {
+				// 		backendTLSPolicy := backendTLSPolicy
+				// 		key := utils.NamespacedName(backendTLSPolicy)
+				// 		if !(reflect.ValueOf(backendTLSPolicy.Status).IsZero()) {
+				// 			r.ProviderResources.BackendTLSPolicyStatuses.Store(key, &backendTLSPolicy.Status)
+				// 		}
+				// 		delete(statusesToDelete.BackendTLSPolicyStatusKeys, key)
+				// 	}
+
+			}
+
+			// Delete IR keys
+			// There is a 1:1 mapping between infra and xds IR keys
+			delKeys := getIRKeysToDelete(curIRKeys, newIRKeys)
+			for _, key := range delKeys {
+				r.InfraIR.Delete(key)
+				r.XdsIR.Delete(key)
+			}
+
+			// Delete status keys
+			r.deleteStatusKeys(statusesToDelete)
+		},
+	)
+	loggers.LoggerAPKOperator.Info("shutting down")
+}
+
+type StatusesToDelete struct {
+	GatewayStatusKeys   map[types.NamespacedName]bool
+	HTTPRouteStatusKeys map[types.NamespacedName]bool
+}
+
+func (r *Runner) getAllStatuses() *StatusesToDelete {
+	// Maps storing status keys to be deleted
+	ds := &StatusesToDelete{
+		GatewayStatusKeys:   make(map[types.NamespacedName]bool),
+		HTTPRouteStatusKeys: make(map[types.NamespacedName]bool),
+	}
+
+	// Get current status keys
+	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
+		ds.GatewayStatusKeys[key] = true
+	}
+	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
+		ds.HTTPRouteStatusKeys[key] = true
+	}
+
+	return ds
+}
+
+func (r *Runner) deleteStatusKeys(ds *StatusesToDelete) {
+	for key := range ds.GatewayStatusKeys {
+		r.ProviderResources.GatewayStatuses.Delete(key)
+		delete(ds.GatewayStatusKeys, key)
+	}
+	for key := range ds.HTTPRouteStatusKeys {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+		delete(ds.HTTPRouteStatusKeys, key)
+	}
+}
+
+// deleteAllIRKeys deletes all XdsIR and InfraIR
+func (r *Runner) deleteAllIRKeys() {
+	for key := range r.InfraIR.LoadAll() {
+		r.InfraIR.Delete(key)
+		r.XdsIR.Delete(key)
+	}
+}
+
+// deleteAllStatusKeys deletes all status keys stored by the subscriber.
+func (r *Runner) deleteAllStatusKeys() {
+	// Fields of GatewayAPIStatuses
+	for key := range r.ProviderResources.GatewayStatuses.LoadAll() {
+		r.ProviderResources.GatewayStatuses.Delete(key)
+	}
+	for key := range r.ProviderResources.HTTPRouteStatuses.LoadAll() {
+		r.ProviderResources.HTTPRouteStatuses.Delete(key)
+	}
+}
+
+// getIRKeysToDelete returns the list of IR keys to delete
+// based on the difference between the current keys and the
+// new keys parameters passed to the function.
+func getIRKeysToDelete(curKeys, newKeys []string) []string {
+	curSet := sets.NewString(curKeys...)
+	newSet := sets.NewString(newKeys...)
+
+	delSet := curSet.Difference(newSet)
+
+	return delSet.List()
+}
diff --git a/adapter/internal/operator/provider/runner/provider_runner.go b/adapter/internal/operator/provider/runner/provider_runner.go
new file mode 100644
index 000000000..d241b67e6
--- /dev/null
+++ b/adapter/internal/operator/provider/runner/provider_runner.go
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package runner
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/wso2/apk/adapter/internal/loggers"
+	provider "github.com/wso2/apk/adapter/internal/operator/gateway-api/provider/kubernetes"
+	"github.com/wso2/apk/adapter/internal/operator/message"
+	ctrl "sigs.k8s.io/controller-runtime"
+)
+
+type Config struct {
+	ProviderResources *message.ProviderResources
+}
+
+type Runner struct {
+	Config
+}
+
+func New(cfg *Config) *Runner {
+	return &Runner{Config: *cfg}
+}
+
+func (r *Runner) Name() string {
+	return string("provider")
+}
+
+// Start the provider runner
+func (r *Runner) Start(ctx context.Context) (err error) {
+	loggers.LoggerAPKOperator.Info("Started Runner Kubernetes operator...")
+	cfg, err := ctrl.GetConfig()
+	if err != nil {
+		return fmt.Errorf("failed to get kubeconfig: %w", err)
+	}
+	p, err := provider.New(cfg, r.ProviderResources)
+	if err != nil {
+		return fmt.Errorf("failed to create provider %s: %w", "Kubernetes", err)
+	}
+	go func() {
+		err := p.Start(ctx)
+		if err != nil {
+			loggers.LoggerAPKOperator.Error("Unable to start kubernetes operator provider", err)
+		}
+	}()
+	return nil
+}
diff --git a/adapter/internal/operator/status/conditions.go b/adapter/internal/operator/status/conditions.go
new file mode 100644
index 000000000..0ef2b69b3
--- /dev/null
+++ b/adapter/internal/operator/status/conditions.go
@@ -0,0 +1,183 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/status/gatewayclassconditions.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package status
+
+import (
+	"fmt"
+	"time"
+	"unicode"
+
+	appsv1 "k8s.io/api/apps/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+const (
+	ReasonOlderGatewayClassExists gwapiv1.GatewayClassConditionReason = "OlderGatewayClassExists"
+
+	MsgOlderGatewayClassExists   = "Invalid GatewayClass: another older GatewayClass with the same Spec.Controller exists"
+	MsgValidGatewayClass         = "Valid GatewayClass"
+	MsgGatewayClassInvalidParams = "Invalid parametersRef"
+)
+
+// computeGatewayClassAcceptedCondition computes the GatewayClass Accepted status condition.
+func computeGatewayClassAcceptedCondition(gatewayClass *gwapiv1.GatewayClass,
+	accepted bool,
+	reason, msg string) metav1.Condition {
+	switch accepted {
+	case true:
+		return metav1.Condition{
+			Type:               string(gwapiv1.GatewayClassConditionStatusAccepted),
+			Status:             metav1.ConditionTrue,
+			Reason:             reason,
+			Message:            msg,
+			ObservedGeneration: gatewayClass.Generation,
+			LastTransitionTime: metav1.NewTime(time.Now()),
+		}
+	default:
+		return metav1.Condition{
+			Type:               string(gwapiv1.GatewayClassConditionStatusAccepted),
+			Status:             metav1.ConditionFalse,
+			Reason:             reason,
+			Message:            msg,
+			ObservedGeneration: gatewayClass.Generation,
+			LastTransitionTime: metav1.NewTime(time.Now()),
+		}
+	}
+}
+
+// computeGatewayAcceptedCondition computes the Gateway Accepted status condition.
+func computeGatewayAcceptedCondition(gw *gwapiv1.Gateway, accepted bool) metav1.Condition {
+	switch accepted {
+	case true:
+		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionTrue,
+			string(gwapiv1.GatewayReasonAccepted),
+			"The Gateway has been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+	default:
+		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonAccepted),
+			"The Gateway has not been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+	}
+}
+
+// computeGatewayProgrammedCondition computes the Gateway Programmed status condition.
+// Programmed condition surfaces true when the Envoy Deployment status is ready.
+func computeGatewayProgrammedCondition(gw *gwapiv1.Gateway, deployment *appsv1.Deployment) metav1.Condition {
+	if len(gw.Status.Addresses) == 0 {
+		return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonAddressNotAssigned),
+			"No addresses have been assigned to the Gateway", time.Now(), gw.Generation)
+	}
+
+	// If there are no available replicas for the Envoy Deployment, don't
+	// mark the Gateway as ready yet.
+
+	if deployment == nil || deployment.Status.AvailableReplicas == 0 {
+		return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionFalse,
+			string(gwapiv1.GatewayReasonNoResources),
+			"Deployment replicas unavailable", time.Now(), gw.Generation)
+	}
+
+	message := fmt.Sprintf("Address assigned to the Gateway, %d/%d envoy Deployment replicas available",
+		deployment.Status.AvailableReplicas, deployment.Status.Replicas)
+	return newCondition(string(gwapiv1.GatewayConditionProgrammed), metav1.ConditionTrue,
+		string(gwapiv1.GatewayConditionProgrammed), message, time.Now(), gw.Generation)
+}
+
+// MergeConditions adds or updates matching conditions, and updates the transition
+// time if details of a condition have changed. Returns the updated condition array.
+func MergeConditions(conditions []metav1.Condition, updates ...metav1.Condition) []metav1.Condition {
+	var additions []metav1.Condition
+	for i, update := range updates {
+		add := true
+		for j, cond := range conditions {
+			if cond.Type == update.Type {
+				add = false
+				if conditionChanged(cond, update) {
+					conditions[j].Status = update.Status
+					conditions[j].Reason = update.Reason
+					conditions[j].Message = update.Message
+					conditions[j].ObservedGeneration = update.ObservedGeneration
+					conditions[j].LastTransitionTime = update.LastTransitionTime
+					break
+				}
+			}
+		}
+		if add {
+			additions = append(additions, updates[i])
+		}
+	}
+	conditions = append(conditions, additions...)
+	return conditions
+}
+
+func newCondition(t string, status metav1.ConditionStatus, reason, msg string, lt time.Time, og int64) metav1.Condition {
+	return metav1.Condition{
+		Type:               t,
+		Status:             status,
+		Reason:             reason,
+		Message:            msg,
+		LastTransitionTime: metav1.NewTime(lt),
+		ObservedGeneration: og,
+	}
+}
+
+func conditionChanged(a, b metav1.Condition) bool {
+	return (a.Status != b.Status) ||
+		(a.Reason != b.Reason) ||
+		(a.Message != b.Message) ||
+		(a.ObservedGeneration != b.ObservedGeneration)
+}
+
+// Error2ConditionMsg format the error string to a Status condition message.
+// * Convert the first letter to capital
+// * Append "." to the string if it doesn't exit
+func Error2ConditionMsg(err error) string {
+	if err == nil {
+		return ""
+	}
+
+	message := err.Error()
+	if message == "" {
+		return message
+	}
+
+	// Convert the string to a rune slice for easier manipulation
+	runes := []rune(message)
+
+	// Check if the first rune is a letter and convert it to uppercase
+	if unicode.IsLetter(runes[0]) {
+		runes[0] = unicode.ToUpper(runes[0])
+	}
+
+	// Convert the rune slice back to a string
+	return string(runes)
+}
diff --git a/adapter/internal/operator/status/gateway.go b/adapter/internal/operator/status/gateway.go
new file mode 100644
index 000000000..475cf0772
--- /dev/null
+++ b/adapter/internal/operator/status/gateway.go
@@ -0,0 +1,108 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package status
+
+import (
+	appsv1 "k8s.io/api/apps/v1"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// UpdateGatewayStatusAcceptedCondition updates the status condition for the provided Gateway based on the accepted state.
+func UpdateGatewayStatusAcceptedCondition(gw *gwapiv1.Gateway, accepted bool) *gwapiv1.Gateway {
+	gw.Status.Conditions = MergeConditions(gw.Status.Conditions, computeGatewayAcceptedCondition(gw, accepted))
+	return gw
+}
+
+// UpdateGatewayStatusProgrammedCondition updates the status addresses for the provided gateway
+// based on the status IP/Hostname of svc and updates the Programmed condition based on the
+// service and deployment state.
+func UpdateGatewayStatusProgrammedCondition(gw *gwapiv1.Gateway, svc *corev1.Service, deployment *appsv1.Deployment, nodeAddresses ...string) {
+	var addresses, hostnames []string
+	// Update the status addresses field.
+	if svc != nil {
+		// If the addresses is explicitly set in the Gateway spec by the user, use it
+		// to populate the Status
+		if len(gw.Spec.Addresses) > 0 {
+			// Make sure the addresses have been populated into ExternalIPs/ClusterIPs
+			// and use that value
+			if len(svc.Spec.ExternalIPs) > 0 {
+				addresses = append(addresses, svc.Spec.ExternalIPs...)
+			} else if len(svc.Spec.ClusterIPs) > 0 {
+				addresses = append(addresses, svc.Spec.ClusterIPs...)
+			}
+		} else {
+			if svc.Spec.Type == corev1.ServiceTypeLoadBalancer {
+				for i := range svc.Status.LoadBalancer.Ingress {
+					switch {
+					case len(svc.Status.LoadBalancer.Ingress[i].IP) > 0:
+						addresses = append(addresses, svc.Status.LoadBalancer.Ingress[i].IP)
+					case len(svc.Status.LoadBalancer.Ingress[i].Hostname) > 0:
+						// Remove when the following supports the hostname address type:
+						// https://github.com/kubernetes-sigs/gateway-api/blob/v0.5.0/conformance/utils/kubernetes/helpers.go#L201-L207
+						if svc.Status.LoadBalancer.Ingress[i].Hostname == "localhost" {
+							addresses = append(addresses, "0.0.0.0")
+						}
+						hostnames = append(hostnames, svc.Status.LoadBalancer.Ingress[i].Hostname)
+					}
+				}
+			}
+
+			if svc.Spec.Type == corev1.ServiceTypeClusterIP {
+				for i := range svc.Spec.ClusterIPs {
+					if svc.Spec.ClusterIPs[i] != "" {
+						addresses = append(addresses, svc.Spec.ClusterIPs[i])
+					}
+				}
+			}
+
+			if svc.Spec.Type == corev1.ServiceTypeNodePort {
+				addresses = nodeAddresses
+			}
+		}
+
+		var gwAddresses []gwapiv1.GatewayStatusAddress
+		for i := range addresses {
+			addr := gwapiv1.GatewayStatusAddress{
+				Type:  ptr.To(gwapiv1.IPAddressType),
+				Value: addresses[i],
+			}
+			gwAddresses = append(gwAddresses, addr)
+		}
+
+		for i := range hostnames {
+			addr := gwapiv1.GatewayStatusAddress{
+				Type:  ptr.To(gwapiv1.HostnameAddressType),
+				Value: hostnames[i],
+			}
+			gwAddresses = append(gwAddresses, addr)
+		}
+
+		gw.Status.Addresses = gwAddresses
+	} else {
+		gw.Status.Addresses = nil
+	}
+	// Update the programmed condition.
+	gw.Status.Conditions = MergeConditions(gw.Status.Conditions, computeGatewayProgrammedCondition(gw, deployment))
+}
diff --git a/adapter/internal/operator/status/gatewayclass.go b/adapter/internal/operator/status/gatewayclass.go
new file mode 100644
index 000000000..ca5461fb1
--- /dev/null
+++ b/adapter/internal/operator/status/gatewayclass.go
@@ -0,0 +1,42 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+// This file contains code derived from Contour,
+// https://github.com/projectcontour/contour
+// from the source file
+// https://github.com/projectcontour/contour/blob/main/internal/status/gatewayclass.go
+// and is provided here subject to the following:
+// Copyright Project Contour Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package status
+
+import (
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+)
+
+// SetGatewayClassAccepted inserts or updates the Accepted condition
+// for the provided GatewayClass.
+func SetGatewayClassAccepted(gc *gwapiv1.GatewayClass, accepted bool, reason, msg string) *gwapiv1.GatewayClass {
+	gc.Status.Conditions = MergeConditions(gc.Status.Conditions, computeGatewayClassAcceptedCondition(gc, accepted, reason, msg))
+	return gc
+}
diff --git a/adapter/internal/operator/status/status.go b/adapter/internal/operator/status/status.go
index c08b7df83..0ca1b4f17 100644
--- a/adapter/internal/operator/status/status.go
+++ b/adapter/internal/operator/status/status.go
@@ -65,7 +65,8 @@ func (updateHandler *UpdateHandler) applyUpdate(update Update) {
 	})
 
 	if err != nil {
-		loggers.LoggerAPKOperator.Errorf("Unable to update status for %s, Error : %v ", update.NamespacedName.String(), err)
+		loggers.LoggerAPKOperator.Errorf("Unable to update status for %s, Resource Kind : %+v, Error : %v ",
+			update.NamespacedName.String(), update.Resource.GetObjectKind(), err)
 	}
 }
 
diff --git a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
index 644cda1e8..e01ee44b4 100644
--- a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
@@ -1,5 +1,4 @@
 //go:build !ignore_autogenerated
-// +build !ignore_autogenerated
 
 /*
  *  Copyright (c) 2023, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
@@ -167,7 +166,8 @@ func (in *GQLRouteState) DeepCopyInto(out *GQLRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha2.GQLRoute)
 				(*in).DeepCopyInto(*out)
 			}
@@ -301,14 +301,16 @@ func (in *GatewayStateData) DeepCopyInto(out *GatewayStateData) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = make(map[string][]byte, len(*in))
 				for key, val := range *in {
 					var outVal []byte
 					if val == nil {
 						(*out)[key] = nil
 					} else {
-						in, out := &val, &outVal
+						inVal := (*in)[key]
+						in, out := &inVal, &outVal
 						*out = make([]byte, len(*in))
 						copy(*out, *in)
 					}
@@ -390,7 +392,8 @@ func (in *HTTPRouteState) DeepCopyInto(out *HTTPRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1.HTTPRoute)
 				(*in).DeepCopyInto(*out)
 			}
diff --git a/adapter/internal/types/resourceversiontable.go b/adapter/internal/types/resourceversiontable.go
new file mode 100644
index 000000000..b22a53468
--- /dev/null
+++ b/adapter/internal/types/resourceversiontable.go
@@ -0,0 +1,196 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	"fmt"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"google.golang.org/protobuf/proto"
+)
+
+// XdsResources represents all the xds resources
+type XdsResources = map[resourcev3.Type][]types.Resource
+
+// ResourceVersionTable holds all the translated xds resources
+type ResourceVersionTable struct {
+	XdsResources
+}
+
+// DeepCopyInto copies the contents into the output object
+// This was generated by controller-gen, moved from
+// zz_generated.deepcopy.go and updated to use proto.Clone
+// to deep copy the proto.Message
+func (t *ResourceVersionTable) DeepCopyInto(out *ResourceVersionTable) {
+	*out = *t
+	if t.XdsResources != nil {
+		in, out := &t.XdsResources, &out.XdsResources
+		*out = make(map[string][]types.Resource, len(*in))
+		for key, val := range *in {
+			var outVal []types.Resource
+			if val == nil {
+				(*out)[key] = nil
+			} else {
+				// Snippet was generated by controller-gen
+				//G601: Implicit memory aliasing in for loop.
+				in, out := &val, &outVal //nolint:gosec,scopelint
+				*out = make([]types.Resource, len(*in))
+				for i := range *in {
+					(*out)[i] = proto.Clone((*in)[i])
+				}
+			}
+			(*out)[key] = outVal
+		}
+	}
+}
+
+// DeepCopy generates a deep copy of the ResourceVersionTable object.
+// This was generated by controller-gen and moved over from
+// zz_generated.deepcopy.go to this file.
+func (t *ResourceVersionTable) DeepCopy() *ResourceVersionTable {
+	if t == nil {
+		return nil
+	}
+	out := new(ResourceVersionTable)
+	t.DeepCopyInto(out)
+	return out
+}
+
+// GetXdsResources retrieves the translated xds resources saved in the translator context.
+func (t *ResourceVersionTable) GetXdsResources() XdsResources {
+	return t.XdsResources
+}
+
+func (t *ResourceVersionTable) AddXdsResource(rType resourcev3.Type, xdsResource types.Resource) error {
+	// It's a sanity check to make sure the xdsResource is not nil
+	if xdsResource == nil {
+		return fmt.Errorf("xds resource is nil")
+	}
+
+	// Perform type switch to handle different types of xdsResource
+	switch rType {
+	case resourcev3.ListenerType:
+		// Handle Type specific operations
+		if resourceOfType, ok := xdsResource.(*listenerv3.Listener); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Listener type", xdsResource)
+		}
+	case resourcev3.RouteType:
+		// Handle Type specific operations
+		if resourceOfType, ok := xdsResource.(*routev3.RouteConfiguration); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to RouteConfiguration type", xdsResource)
+		}
+
+	case resourcev3.SecretType:
+		// Handle specific operations
+		if resourceOfType, ok := xdsResource.(*tlsv3.Secret); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Secret type", xdsResource)
+		}
+
+	case resourcev3.EndpointType:
+		if resourceOfType, ok := xdsResource.(*endpointv3.ClusterLoadAssignment); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to ClusterLoadAssignment type", xdsResource)
+		}
+
+	case resourcev3.ClusterType:
+		// Handle specific operations
+		if resourceOfType, ok := xdsResource.(*clusterv3.Cluster); ok {
+			if err := resourceOfType.ValidateAll(); err != nil {
+				return fmt.Errorf("validation failed for xds resource %+v, err: %w", xdsResource, err)
+			}
+		} else {
+			return fmt.Errorf("failed to cast xds resource %+v to Cluster type", xdsResource)
+		}
+	case resourcev3.RateLimitConfigType:
+		// Handle specific operations
+		// cfg resource from runner.go is the RateLimitConfig type from "github.com/envoyproxy/go-control-plane/ratelimit/config/ratelimit/v3", which does have validate function.
+
+		// Add more cases for other types as needed
+	default:
+		// Handle the case when the type is not recognized or supported
+	}
+
+	if t.XdsResources == nil {
+		t.XdsResources = make(XdsResources)
+	}
+	if t.XdsResources[rType] == nil {
+		t.XdsResources[rType] = make([]types.Resource, 0, 1)
+	}
+
+	t.XdsResources[rType] = append(t.XdsResources[rType], xdsResource)
+	return nil
+}
+
+// AddOrReplaceXdsResource will update an existing resource of rType according to matchFunc or add as a new resource
+// if none satisfy the match criteria. It will only update the first match it finds, regardless
+// if multiple resources satisfy the match criteria.
+func (t *ResourceVersionTable) AddOrReplaceXdsResource(rType resourcev3.Type, resource types.Resource, matchFunc func(existing types.Resource, new types.Resource) bool) error {
+	if t.XdsResources == nil || t.XdsResources[rType] == nil {
+		return t.AddXdsResource(rType, resource)
+	}
+
+	var found bool
+	for i, r := range t.XdsResources[rType] {
+		if matchFunc(r, resource) {
+			t.XdsResources[rType][i] = resource
+			found = true
+			break
+		}
+	}
+	if !found {
+		if err := t.AddXdsResource(rType, resource); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// SetResources will update an entire entry of the XdsResources for a certain type to the provided resources
+func (t *ResourceVersionTable) SetResources(rType resourcev3.Type, xdsResources []types.Resource) {
+	if t.XdsResources == nil {
+		t.XdsResources = make(XdsResources)
+	}
+
+	t.XdsResources[rType] = xdsResources
+}
diff --git a/adapter/internal/types/resourceversiontable_test.go b/adapter/internal/types/resourceversiontable_test.go
new file mode 100644
index 000000000..d734dea70
--- /dev/null
+++ b/adapter/internal/types/resourceversiontable_test.go
@@ -0,0 +1,913 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package types
+
+import (
+	"testing"
+
+	clusterv3 "github.com/envoyproxy/go-control-plane/envoy/config/cluster/v3"
+	corev3 "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
+	endpointv3 "github.com/envoyproxy/go-control-plane/envoy/config/endpoint/v3"
+	listenerv3 "github.com/envoyproxy/go-control-plane/envoy/config/listener/v3"
+	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
+	tlsv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/transport_sockets/tls/v3"
+	"github.com/envoyproxy/go-control-plane/pkg/cache/types"
+	resourcev3 "github.com/envoyproxy/go-control-plane/pkg/resource/v3"
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/testing/protocmp"
+)
+
+var (
+	testListener = &listenerv3.Listener{
+		Name: "test-listener",
+	}
+	testSecret = &tlsv3.Secret{
+		Name: "test-secret",
+	}
+)
+
+func TestDeepCopy(t *testing.T) {
+	testCases := []struct {
+		name string
+		in   *ResourceVersionTable
+		out  *ResourceVersionTable
+	}{
+		{
+			name: "nil",
+			in:   nil,
+			out:  nil,
+		},
+		{
+			name: "listener",
+			in: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+			out: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "kitchen-sink",
+			in: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+					resourcev3.SecretType:   []types.Resource{testSecret},
+				},
+			},
+			out: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+					resourcev3.SecretType:   []types.Resource{testSecret},
+				},
+			},
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			if tc.out == nil {
+				require.Nil(t, tc.in.DeepCopy())
+			} else {
+				diff := cmp.Diff(tc.out, tc.in.DeepCopy(), protocmp.Transform())
+				require.Empty(t, diff)
+			}
+		})
+	}
+}
+
+func TestAddOrReplaceXdsResource(t *testing.T) {
+	testListener := &listenerv3.Listener{
+		Name: "test-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "exampleservice.examplenamespace.svc.cluster.local",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 5000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	updatedListener := &listenerv3.Listener{
+		Name: "test-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "newsvc.newns.svc.cluster.local",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 8000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	testCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "exampleservice.examplenamespace.svc.cluster.local",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	updatedCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "modified.example.svc.cluster.local",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "exampleservice.examplenamespace.svc.cluster.local",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	updatedEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "modified.example.svc.cluster.local",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testRouteConfig := &routev3.RouteConfiguration{
+		Name: "test-route-config",
+		VirtualHosts: []*routev3.VirtualHost{
+			{
+				Name:    "test-virtual-host",
+				Domains: []string{"test.example.com"},
+				Routes: []*routev3.Route{
+					{
+						Match: &routev3.RouteMatch{
+							PathSpecifier: &routev3.RouteMatch_Prefix{
+								Prefix: "/",
+							},
+						},
+						Action: &routev3.Route_Route{
+							Route: &routev3.RouteAction{
+								ClusterSpecifier: &routev3.RouteAction_Cluster{
+									Cluster: "test-cluster",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	testSecret := &tlsv3.Secret{
+		Name: "example-secret",
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN CERTIFICATE-----\n... Your certificate data ... \n-----END CERTIFICATE-----"),
+					},
+				},
+				PrivateKey: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN PRIVATE KEY-----\n... Your private key data ... \n-----END PRIVATE KEY-----"),
+					},
+				},
+			},
+		},
+		// Add other fields for the secret as needed.
+	}
+
+	testCases := []struct {
+		name       string
+		tableIn    *ResourceVersionTable
+		typeIn     resourcev3.Type
+		resourceIn types.Resource
+		funcIn     func(existing types.Resource, new types.Resource) bool
+		tableOut   *ResourceVersionTable
+	}{
+		{
+			name: "inject-new-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name: "replace-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: updatedCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{updatedCluster},
+				},
+			},
+		},
+		{
+			name: "inject-new-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: testEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{testEndpoint},
+				},
+			},
+		},
+		{
+			name: "replace-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{testEndpoint},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: updatedEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{updatedEndpoint},
+				},
+			},
+		},
+		{
+			name: "inject-new-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: testListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "replace-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: updatedListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{updatedListener},
+				},
+			},
+		},
+		{
+			name: "inject-nil-resourcetype",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name:       "inject-nil resources",
+			tableIn:    &ResourceVersionTable{},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: testCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{testCluster},
+				},
+			},
+		},
+		{
+			name: "inject-route-config",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: testRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{testRouteConfig},
+				},
+			},
+		},
+		{
+			name: "new-secret",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: testSecret,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{testSecret},
+				},
+			},
+		},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.tableIn.AddOrReplaceXdsResource(tc.typeIn, tc.resourceIn, tc.funcIn)
+			require.NoError(t, err)
+			diff := cmp.Diff(tc.tableOut, tc.tableIn.DeepCopy(), protocmp.Transform())
+			require.Empty(t, diff)
+		})
+	}
+}
+
+func TestInvalidAddXdsResource(t *testing.T) {
+	invalidListener := &listenerv3.Listener{
+		Name: "invalid-listener",
+		Address: &corev3.Address{
+			Address: &corev3.Address_SocketAddress{
+				SocketAddress: &corev3.SocketAddress{
+					Address: "",
+					PortSpecifier: &corev3.SocketAddress_PortValue{
+						PortValue: 5000,
+					},
+					Protocol: corev3.SocketAddress_TCP,
+				},
+			},
+		},
+	}
+	invalidRouteConfig := &routev3.RouteConfiguration{
+		Name: "test-route-config",
+		VirtualHosts: []*routev3.VirtualHost{
+			{
+				Name:    "", // missing name
+				Domains: []string{"test.example.com"},
+				Routes: []*routev3.Route{
+					{
+						Match: &routev3.RouteMatch{
+							PathSpecifier: &routev3.RouteMatch_Prefix{
+								Prefix: "/",
+							},
+						},
+						Action: &routev3.Route_Route{
+							Route: &routev3.RouteAction{
+								ClusterSpecifier: &routev3.RouteAction_Cluster{
+									Cluster: "test-cluster",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	invalidCluster := &clusterv3.Cluster{
+		Name: "test-cluster",
+		LoadAssignment: &endpointv3.ClusterLoadAssignment{
+			ClusterName: "test-cluster",
+			Endpoints: []*endpointv3.LocalityLbEndpoints{
+				{
+					LbEndpoints: []*endpointv3.LbEndpoint{
+						{
+							HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+								Endpoint: &endpointv3.Endpoint{
+									Address: &corev3.Address{
+										Address: &corev3.Address_SocketAddress{
+											SocketAddress: &corev3.SocketAddress{
+												Address: "",
+												PortSpecifier: &corev3.SocketAddress_PortValue{
+													PortValue: 5000,
+												},
+												Protocol: corev3.SocketAddress_TCP,
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+	invalidEndpoint := &endpointv3.ClusterLoadAssignment{
+		ClusterName: "test-cluster",
+		Endpoints: []*endpointv3.LocalityLbEndpoints{
+			{
+				LbEndpoints: []*endpointv3.LbEndpoint{
+					{
+						HostIdentifier: &endpointv3.LbEndpoint_Endpoint{
+							Endpoint: &endpointv3.Endpoint{
+								Address: &corev3.Address{
+									Address: &corev3.Address_SocketAddress{
+										SocketAddress: &corev3.SocketAddress{
+											Address: "",
+											PortSpecifier: &corev3.SocketAddress_PortValue{
+												PortValue: 5000,
+											},
+											Protocol: corev3.SocketAddress_TCP,
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	invalidSecret := &tlsv3.Secret{
+		Name: "=*&",
+		Type: &tlsv3.Secret_TlsCertificate{
+			TlsCertificate: &tlsv3.TlsCertificate{
+				CertificateChain: &corev3.DataSource{
+					Specifier: &corev3.DataSource_InlineBytes{
+						InlineBytes: []byte("-----BEGIN CERTIFICATE-----\n... Your certificate data ... \n-----END CERTIFICATE-----"),
+					},
+				},
+				PrivateKey: &corev3.DataSource{},
+			},
+		},
+		// Add other fields for the secret as needed.
+	}
+
+	testCases := []struct {
+		name       string
+		tableIn    *ResourceVersionTable
+		typeIn     resourcev3.Type
+		resourceIn types.Resource
+		funcIn     func(existing types.Resource, new types.Resource) bool
+		tableOut   *ResourceVersionTable
+	}{
+		{
+			name: "inject-invalid-listener",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{testListener},
+				},
+			},
+		},
+		{
+			name: "inject-invalid-route-config",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: invalidRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "inject-invalid-cluster",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-cluster-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ClusterType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ClusterType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldCluster := existing.(*clusterv3.Cluster)
+				newCluster := new.(*clusterv3.Cluster)
+				if newCluster == nil || oldCluster == nil {
+					return false
+				}
+				if oldCluster.Name == newCluster.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-listener-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.ListenerType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.ListenerType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-route-config-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.RouteType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.RouteType,
+			resourceIn: invalidCluster,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-secret-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: invalidRouteConfig,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "invalid-secret",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.SecretType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.SecretType,
+			resourceIn: invalidSecret,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldListener := existing.(*listenerv3.Listener)
+				newListener := new.(*listenerv3.Listener)
+				if newListener == nil || oldListener == nil {
+					return false
+				}
+				if oldListener.Name == newListener.Name {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "inject-invalid-endpoint",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: invalidEndpoint,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+		{
+			name: "cast-endpoint-type",
+			tableIn: &ResourceVersionTable{
+				XdsResources: XdsResources{
+					resourcev3.EndpointType: []types.Resource{},
+				},
+			},
+			typeIn:     resourcev3.EndpointType,
+			resourceIn: invalidListener,
+			funcIn: func(existing types.Resource, new types.Resource) bool {
+				oldEndpoint := existing.(*endpointv3.ClusterLoadAssignment)
+				newEndpoint := new.(*endpointv3.ClusterLoadAssignment)
+				if newEndpoint == nil || oldEndpoint == nil {
+					return false
+				}
+				if oldEndpoint.ClusterName == newEndpoint.ClusterName {
+					return true
+				}
+				return false
+			},
+			tableOut: nil,
+		},
+	}
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.tableIn.AddOrReplaceXdsResource(tc.typeIn, tc.resourceIn, tc.funcIn)
+			require.Error(t, err)
+		})
+	}
+}
diff --git a/adapter/pkg/utils/file/file.go b/adapter/pkg/utils/file/file.go
new file mode 100644
index 000000000..51740db97
--- /dev/null
+++ b/adapter/pkg/utils/file/file.go
@@ -0,0 +1,44 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package file
+
+import (
+	"bufio"
+	"os"
+)
+
+func Write(data string, filepath string) error {
+	file, err := os.OpenFile(filepath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	write := bufio.NewWriter(file)
+	_, err = write.WriteString(data)
+	if err != nil {
+		return err
+	}
+	write.Flush()
+
+	return nil
+}
diff --git a/adapter/pkg/utils/misc/misc.go b/adapter/pkg/utils/misc/misc.go
new file mode 100644
index 000000000..f4080c5f0
--- /dev/null
+++ b/adapter/pkg/utils/misc/misc.go
@@ -0,0 +1,73 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"crypto/sha256"
+	"fmt"
+	"hash/fnv"
+	"strings"
+
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// NamespacedName creates and returns object's NamespacedName.
+func NamespacedName(obj client.Object) types.NamespacedName {
+	return types.NamespacedName{
+		Namespace: obj.GetNamespace(),
+		Name:      obj.GetName(),
+	}
+}
+
+// GetHashedName returns a partially hashed name for the string including up to the given length of the original name characters before the hash.
+// Input `nsName` should be formatted as `{Namespace}/{ResourceName}`.
+func GetHashedName(nsName string, length int) string {
+	hashedName := Digest256(nsName)
+	// replace `/` with `-` to create a valid K8s resource name
+	resourceName := strings.ReplaceAll(nsName, "/", "-")
+	if length > 0 && len(resourceName) > length {
+		// resource name needs to be trimmed, as container port name must not contain consecutive hyphens
+		trimmedName := strings.TrimSuffix(resourceName[0:length], "-")
+		return fmt.Sprintf("%s-%s", trimmedName, hashedName[0:8])
+	}
+	// Ideally we should use 32-bit hash instead of 64-bit hash and return the first 8 characters of the hash.
+	// However, we are using 64-bit hash to maintain backward compatibility.
+	return fmt.Sprintf("%s-%s", resourceName, hashedName[0:8])
+}
+
+// Digest256 returns a sha256 hash of the input string.
+// The hash is represented as a hexadecimal string of length 64.
+func Digest256(str string) string {
+	h := sha256.New() // Using sha256 instead of sha1 due to Blocklisted import crypto/sha1: weak cryptographic primitive (gosec)
+	h.Write([]byte(str))
+	return strings.ToLower(fmt.Sprintf("%x", h.Sum(nil)))
+}
+
+// Digest32 returns a 32-bit hash of the input string.
+// The hash is represented as a hexadecimal string of length 8.
+func Digest32(str string) string {
+	h := fnv.New32a()
+	_, _ = h.Write([]byte(str))
+	return fmt.Sprintf("%x", h.Sum32())
+}
diff --git a/adapter/pkg/utils/misc/misc_test.go b/adapter/pkg/utils/misc/misc_test.go
new file mode 100644
index 000000000..e6cf51a30
--- /dev/null
+++ b/adapter/pkg/utils/misc/misc_test.go
@@ -0,0 +1,50 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package utils
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetHashedName(t *testing.T) {
+	testCases := []struct {
+		name     string
+		nsName   string
+		length   int
+		expected string
+	}{
+		{"test default name", "http", 6, "http-e0603c49"},
+		{"test removing trailing slash", "namespace/name", 10, "namespace-18a6500f"},
+		{"test removing trailing hyphen", "apk/eg/http", 6, "apk-eg-9df93c35"},
+	}
+
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			result := GetHashedName(tc.nsName, tc.length)
+			require.Equal(t, tc.expected, result, "Result does not match expected string")
+		})
+	}
+}
diff --git a/adapter/pkg/utils/protocov/protocov.go b/adapter/pkg/utils/protocov/protocov.go
new file mode 100644
index 000000000..6040be9e9
--- /dev/null
+++ b/adapter/pkg/utils/protocov/protocov.go
@@ -0,0 +1,55 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package protocov
+
+import (
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const (
+	APIPrefix = "type.googleapis.com/"
+)
+
+var (
+	marshalOpts = proto.MarshalOptions{}
+)
+
+func ToAnyWithError(msg proto.Message) (*anypb.Any, error) {
+	b, err := marshalOpts.Marshal(msg)
+	if err != nil {
+		return nil, err
+	}
+	return &anypb.Any{
+		TypeUrl: APIPrefix + string(msg.ProtoReflect().Descriptor().FullName()),
+		Value:   b,
+	}, nil
+}
+
+func ToAny(msg proto.Message) *anypb.Any {
+	res, err := ToAnyWithError(msg)
+	if err != nil {
+		return nil
+	}
+	return res
+}
diff --git a/adapter/pkg/utils/regex/regex.go b/adapter/pkg/utils/regex/regex.go
new file mode 100644
index 000000000..5bd9d9577
--- /dev/null
+++ b/adapter/pkg/utils/regex/regex.go
@@ -0,0 +1,36 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package regex
+
+import (
+	"fmt"
+	"regexp"
+)
+
+// Validate validates a regex string.
+func Validate(regex string) error {
+	if _, err := regexp.Compile(regex); err != nil {
+		return fmt.Errorf("regex %q is invalid: %w", regex, err)
+	}
+	return nil
+}
diff --git a/adapter/pkg/utils/regex/regex_test.go b/adapter/pkg/utils/regex/regex_test.go
new file mode 100644
index 000000000..129ac7254
--- /dev/null
+++ b/adapter/pkg/utils/regex/regex_test.go
@@ -0,0 +1,51 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package regex
+
+import "testing"
+
+func TestValidate(t *testing.T) {
+	tests := []struct {
+		name    string
+		regex   string
+		wantErr bool
+	}{
+		{
+			name:    "Valid regex",
+			regex:   "^[a-z0-9-]+$",
+			wantErr: false,
+		},
+		{
+			name:    "Invalid regex",
+			regex:   "^[a-z0-9-++$",
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if err := Validate(tt.regex); (err != nil) != tt.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}
diff --git a/adapter/pkg/utils/stringutils/string_utils.go b/adapter/pkg/utils/stringutils/string_utils.go
index 829f02bdd..b8394f0db 100644
--- a/adapter/pkg/utils/stringutils/string_utils.go
+++ b/adapter/pkg/utils/stringutils/string_utils.go
@@ -67,3 +67,16 @@ func ToStringArray[T any](array []T) []string {
 	}
 	return vHosts
 }
+
+// RemoveString returns a newly created []string that contains all items from slice that
+// are not equal to s.
+func RemoveString(slice []string, s string) []string {
+	var newSlice []string
+	for _, item := range slice {
+		if item == s {
+			continue
+		}
+		newSlice = append(newSlice, item)
+	}
+	return newSlice
+}
diff --git a/adapter/pkg/utils/stringutils/string_utils_test.go b/adapter/pkg/utils/stringutils/string_utils_test.go
index ae6713257..7fa736841 100644
--- a/adapter/pkg/utils/stringutils/string_utils_test.go
+++ b/adapter/pkg/utils/stringutils/string_utils_test.go
@@ -17,6 +17,7 @@
 package stringutils
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -95,3 +96,42 @@ func TestMaskString(t *testing.T) {
 		assert.Equal(t, item.output, result, item.message, i)
 	}
 }
+
+func TestRemoveString(t *testing.T) {
+	tests := []struct {
+		testName string
+		input    []string
+		remove   string
+		want     []string
+	}{
+		{
+			testName: "Nil input slice",
+			input:    nil,
+			remove:   "",
+			want:     nil,
+		},
+		{
+			testName: "Remove a string from input slice",
+			input:    []string{"a", "ab", "cdef"},
+			remove:   "ab",
+			want:     []string{"a", "cdef"},
+		},
+		{
+			testName: "Slice doesn't contain the string",
+			input:    []string{"a", "ab", "cdef"},
+			remove:   "NotPresentInSlice",
+			want:     []string{"a", "ab", "cdef"},
+		},
+		{
+			testName: "All strings removed, result is nil",
+			input:    []string{"a"},
+			remove:   "a",
+			want:     nil,
+		},
+	}
+	for _, tt := range tests {
+		if got := RemoveString(tt.input, tt.remove); !reflect.DeepEqual(got, tt.want) {
+			t.Errorf("%v: RemoveString(%v, %q) = %v WANT %v", tt.testName, tt.input, tt.remove, got, tt.want)
+		}
+	}
+}
diff --git a/adapter/revive.toml b/adapter/revive.toml
index 0024ff213..80be43d1f 100644
--- a/adapter/revive.toml
+++ b/adapter/revive.toml
@@ -12,7 +12,7 @@ exclude = [ "internal/operator/controllers/cp/suite_test.go","internal/operator/
 [rule.error-return]
 [rule.error-strings]
 [rule.error-naming]
-[rule.exported]
+# [rule.exported]
 [rule.if-return]
 [rule.increment-decrement]
 [rule.var-naming]
diff --git a/gateway/enforcer/Dockerfile b/gateway/enforcer/Dockerfile
index e803dd809..d77635d61 100644
--- a/gateway/enforcer/Dockerfile
+++ b/gateway/enforcer/Dockerfile
@@ -79,7 +79,7 @@ ENV ENFORCER_PUBLIC_CERT_PATH=/home/wso2/security/keystore/mg.pem
 ENV TRUSTED_CA_CERTS_PATH=/home/wso2/security/truststore
 ENV ADAPTER_HOST_NAME=adapter
 ENV ADAPTER_HOST=adapter
-ENV ADAPTER_XDS_PORT=18000
+ENV ADAPTER_XDS_PORT=18001
 ENV COMMON_CONTROLLER_HOST_NAME=common-controller
 ENV COMMON_CONTROLLER_HOST=common-controller
 ENV COMMON_CONTROLLER_XDS_PORT=18002
diff --git a/helm-charts/Chart.lock b/helm-charts/Chart.lock
index dc7956e06..2de28a9e0 100644
--- a/helm-charts/Chart.lock
+++ b/helm-charts/Chart.lock
@@ -7,6 +7,6 @@ dependencies:
   version: 17.8.0
 - name: cert-manager
   repository: https://charts.jetstack.io
-  version: v1.10.1
-digest: sha256:93196eab275694d9fd00865dcf2e1c57c1bdd8f1c5f63b91c6bfdb91a673fde2
-generated: "2024-08-25T08:46:59.765985+05:30"
+  version: v1.10.2
+digest: sha256:c73e2790cdd6cef996f40aecb00224e74e8aae146a7d1c4afb528720b404f76c
+generated: "2024-06-13T16:05:27.648453+05:30"
diff --git a/helm-charts/Chart.yaml b/helm-charts/Chart.yaml
index 0eb9f5baf..4a35f5ad6 100644
--- a/helm-charts/Chart.yaml
+++ b/helm-charts/Chart.yaml
@@ -14,6 +14,6 @@ dependencies:
     repository: "https://charts.bitnami.com/bitnami"
     condition: redis.enabled
   - name: cert-manager
-    version: "v1.10.1"
+    version: "v1.10.2"
     repository: "https://charts.jetstack.io"
     condition: certmanager.enabled
diff --git a/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml b/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
new file mode 100644
index 000000000..b154b3eee
--- /dev/null
+++ b/helm-charts/templates/cert-manager/certificates/envoy-certificate.yaml
@@ -0,0 +1,43 @@
+# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
+#
+# WSO2 LLC. licenses this file to you under the Apache License,
+# Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# The following manifests contain a self-signed issuer CR and a certificate CR.
+# More document can be found at https://docs.cert-manager.io
+
+{{- if .Values.wso2.apk.dp.enabled }}
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: envoy-cert
+  namespace: {{ .Release.Namespace }}
+spec:
+  commonName: envoy-gateway
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+  dnsNames:
+  - \*.{{ .Release.Namespace }}.svc
+  - \*.{{ .Release.Namespace }}.svc.cluster.local
+  issuerRef:
+    kind: {{ .Values.certmanager.issuerKind | default "ClusterIssuer" }}
+    {{ if .Values.certmanager.servers -}}
+    name: {{  .Values.certmanager.servers.issuerName | default "selfsigned-issuer" }}
+    {{- else -}}
+    name: {{ template "apk-helm.resource.prefix" . }}-selfsigned-issuer
+    {{- end }}
+  secretName: envoy-cert
+{{- end -}}
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
index 9167c587d..3416b7cdd 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
@@ -88,7 +88,7 @@ spec:
             {{- else }}
               subPath: ca.crt
             {{- end }}
-            - name: router-truststore-secret-volume
+            - name: envoy-truststore-secret-volume
               mountPath: /home/wso2/security/truststore/router.crt
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
               subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
@@ -158,13 +158,9 @@ spec:
         #   secret:
         #     secretName: {{ template "apk-helm.resource.prefix" . }}-webhook-server-cert
         #     defaultMode: 420
-        - name: router-truststore-secret-volume
+        - name: envoy-truststore-secret-volume
           secret: 
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.secretName | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
-          {{- end }}
+            secretName: envoy-cert
         - name: enforcer-truststore-secret-volume
           secret: 
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
index 9d1d9bde9..abecda2fa 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
@@ -38,7 +38,7 @@ data:
     # limitations under the License.
     # -----------------------------------------------------------------------
 
-    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
     grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
         -tls \
         -tls-ca-cert "${ADAPTER_PUBLIC_CERT_PATH}" \
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
deleted file mode 100644
index b9a5a8c59..000000000
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
+++ /dev/null
@@ -1,50 +0,0 @@
-# --------------------------------------------------------------------
-# Copyright (c) 2022, WSO2 LLC. (http://wso2.com) All Rights Reserved.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-# -----------------------------------------------------------------------
-
-{{- if .Values.wso2.apk.dp.enabled }}
-{{- if and .Values.wso2.apk.dp.gateway.autoscaling .Values.wso2.apk.dp.gateway.autoscaling.enabled -}}
-
-apiVersion: autoscaling/v2
-kind: HorizontalPodAutoscaler
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-autoscaller
-  namespace: {{ .Release.Namespace }}
-spec:
-  scaleTargetRef:
-    apiVersion: apps/v1
-    kind: Deployment
-    name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
-  minReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.minReplicas }}
-  maxReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.maxReplicas }}
-  metrics:
-    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
-    - type: Resource
-      resource:
-        name: memory
-        target:
-          type: Utilization
-          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
-    {{- end }}
-    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
-    - type: Resource
-      resource:
-        name: cpu
-        target:
-          type: Utilization
-          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
-    {{- end }}
-{{- end }}
-{{- end}}
\ No newline at end of file
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
deleted file mode 100644
index 0173aed7a..000000000
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
+++ /dev/null
@@ -1,41 +0,0 @@
-# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
-#
-# WSO2 LLC. licenses this file to you under the Apache License,
-# Version 2.0 (the "License"); you may not use this file except
-# in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-{{- if .Values.wso2.apk.dp.enabled }}
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-service
-  namespace : {{ .Release.Namespace }}
-{{if and .Values.wso2.apk.dp.gatewayRuntime.service .Values.wso2.apk.dp.gatewayRuntime.service.annotations }}
-  annotations:
-{{ toYaml .Values.wso2.apk.dp.gatewayRuntime.service.annotations | indent 4 }}
-{{ end }}
-spec:
-  type: {{ .Values.wso2.apk.dp.gateway.service.type | default "LoadBalancer" }}
-  # label keys and values that must match in order to receive traffic for this service
-  selector:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 4}}
-  ports:
-{{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
-  - name: "http-endpoint"
-    protocol: TCP
-    port: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080 }}
-{{ end }}
-  - name: "https-endpoint"
-    protocol: TCP
-    port: 9095
-{{- end -}}
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index f034acbe5..55052640b 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -10,6 +10,7 @@ data:
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}
       environment = "{{ .Values.wso2.apk.dp.environment.name }}"
       {{- end }}
+      namespace = "{{ .Release.Namespace }}"
     {{ if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
     [adapter.operator]
       namespaces = [{{ include "commaJoinedQuotedList" .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces}}]
@@ -32,6 +33,7 @@ data:
 
     {{ if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.router .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs }}
     [router]
+      namespace = "{{ .Release.Namespace }}"
       {{ if .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.systemHost }}
       systemHost = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.systemHost }}"
       {{ end }}
diff --git a/helm-charts/templates/serviceAccount/apk-cluster-role.yaml b/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
index 3022a5b82..fd320f9ff 100644
--- a/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
+++ b/helm-charts/templates/serviceAccount/apk-cluster-role.yaml
@@ -20,12 +20,21 @@ kind: ClusterRole
 metadata:
   name: {{ .Values.wso2.apk.auth.roleName }}
 rules:
+  - apiGroups: ["discovery.k8s.io"]
+    resources: ["endpointslices"]
+    verbs: ["get","list","watch","update","delete","create"]
   - apiGroups: [""]
-    resources: ["services","configmaps","secrets"]
+    resources: ["services","configmaps","secrets", "namespaces", "serviceaccounts", "events", "nodes"]
     verbs: ["get","list","watch","update","delete","create"]
+  - apiGroups: ["autoscaling"]
+    resources: ["horizontalpodautoscalers"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
   - apiGroups: ["gateway.networking.k8s.io"]
-    resources: ["httproutes","gateways","gatewayclasses","grpcroutes"]
-    verbs: ["get","list","watch","update","delete","create"]
+    resources: ["httproutes","gateways","gatewayclasses","grpcroutes", "referencegrants"]
+    verbs: ["get","list","watch","update","delete","create", "patch"]
   - apiGroups: [ "gateway.networking.k8s.io" ]
     resources: [ "gateways/status","gatewayclasses/status","httproutes/status" ]
     verbs: [ "get","patch","update" ]

From 2c04a72c0e9887395b38570f63d998087862e938 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 14:41:42 +0530
Subject: [PATCH 02/40] add config for gateway deployment

---
 adapter/config/default_config.go              | 34 +++++++-
 adapter/config/types.go                       | 41 ++++++++-
 adapter/internal/adapter/adapter.go           | 42 +++++-----
 .../gateway-api/bootstrap/bootstrap.go        | 15 ++--
 .../operator/gateway-api/crypto/certgen.go    |  2 +-
 .../infrastructure/kubernetes/infra.go        | 25 +-----
 .../kubernetes/proxy/resource.go              | 84 ++++++-------------
 .../kubernetes/proxy/resource_provider.go     |  2 +-
 .../provider/kubernetes/controller.go         |  2 +-
 .../provider/kubernetes/predicates.go         |  3 -
 .../gateway-api/translator/runner/runner.go   | 46 ----------
 .../operator/gateway-api/xds/runner/runner.go | 10 +--
 .../gateway-api/xds/runner/runner_test.go     |  8 +-
 adapter/pkg/health/health.go                  |  4 +-
 adapter/resources/check_health.sh             |  2 +-
 gateway/enforcer/Dockerfile                   | 12 ---
 .../gateway-components/log-conf.yaml          | 12 ++-
 helm-charts/values.yaml                       | 10 ++-
 18 files changed, 155 insertions(+), 199 deletions(-)

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index 51bb47424..8ed335bad 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -31,7 +31,6 @@ var defaultConfig = &Config{
 		Operator: operator{
 			Namespaces: nil,
 		},
-		Namespace:   "apk",
 		Environment: "Default",
 		Metrics: Metrics{
 			Enabled: false,
@@ -49,7 +48,6 @@ var defaultConfig = &Config{
 		},
 	},
 	Envoy: envoy{
-		Namespace:         "apk",
 		ListenerCodecType: "AUTO",
 		// todo(amali) move connect timeout to crd
 		ClusterTimeoutInSeconds:          20,
@@ -275,4 +273,36 @@ var defaultConfig = &Config{
 			"endpoint":               "/api/v2/spans",
 		},
 	},
+	Deployment: deployment{
+		//todo(amali) add validation
+		Gateway: gateway{
+			Namespace:                "apk",
+			AdapterHostName:          "",
+			AdapterHost:              "",
+			CommonControllerHostName: "",
+			CommonControllerHost:     "",
+			EnforcerPrivateKeyPath:   "/home/wso2/security/keystore/enforcer.key",
+			EnforcerPublicCertPath:   "/home/wso2/security/keystore/enforcer.crt",
+			EnforcerServerName:       "",
+			AdapterTrustedCAPath:     "/home/wso2/security/truststore",
+			AdapterXDSPort:           "18000",
+			CommonControllerXDSPort:  "18002",
+			CommonControllerRestPort: "18003",
+			EnforcerLabel:            "wso2-apk-default",
+			EnforcerRegion:           "UNKNOWN",
+			EnforcerXDSMaxMsgSize:    "4194304",
+			EnforcerXDSMaxRetries:    "3",
+			JavaOpts:                 "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+			Volumes: volumes{
+				RatelimiterTruststoreSecretVolume: "",
+				EnforcerKeystoreSecretVolume:      "",
+				RouterKeystoreSecretVolume:        "",
+				AdapterTruststoreSecretVolume:     "",
+				EnforcerJwtSecretVolume:           "",
+				EnforcerTrustedCerts:              "",
+				EnforcerApikeyCert:                "",
+				IDPCertificateSecretVolume:        "",
+			},
+		},
+	},
 }
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 329482ad9..9638af9ef 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -79,6 +79,7 @@ type Config struct {
 	PartitionServer  partitionServer  `toml:"partitionServer"`
 	Analytics        analytics        `toml:"analytics"`
 	Tracing          tracing
+	Deployment       deployment
 }
 
 // Adapter related Configurations
@@ -93,8 +94,6 @@ type adapter struct {
 	Operator operator
 	// Environment of the Adapter
 	Environment string
-	// Namespace of the Adapter
-	Namespace string
 	// Metric represents configurations to expose/export go metrics
 	Metrics Metrics
 	// ControlPlane represents the connection configuration of ControlPlane
@@ -103,8 +102,6 @@ type adapter struct {
 
 // Envoy Listener Component related configurations.
 type envoy struct {
-	// Namespace of the envoyproxy gateway
-	Namespace string
 	// ListenerCodecType Default to AUTO where both http1 and http2 connections are handled
 	// It can be specifically set to either HTTP1 or HTTP2
 	ListenerCodecType string
@@ -318,6 +315,42 @@ type tracing struct {
 	ConfigProperties map[string]string
 }
 
+type deployment struct {
+	Gateway gateway
+}
+
+type gateway struct {
+	Namespace                string
+	AdapterHostName          string
+	AdapterHost              string
+	CommonControllerHostName string
+	CommonControllerHost     string
+	EnforcerPrivateKeyPath   string
+	EnforcerPublicCertPath   string
+	EnforcerServerName       string
+	AdapterTrustedCAPath     string
+	AdapterXDSPort           string
+	CommonControllerXDSPort  string
+	CommonControllerRestPort string
+	EnforcerLabel            string
+	EnforcerRegion           string
+	EnforcerXDSMaxMsgSize    string
+	EnforcerXDSMaxRetries    string
+	JavaOpts                 string
+	Volumes                  volumes
+}
+
+type volumes struct {
+	RatelimiterTruststoreSecretVolume string
+	EnforcerKeystoreSecretVolume      string
+	RouterKeystoreSecretVolume        string
+	AdapterTruststoreSecretVolume     string
+	EnforcerJwtSecretVolume           string
+	EnforcerTrustedCerts              string
+	EnforcerApikeyCert                string
+	IDPCertificateSecretVolume        string
+}
+
 // Metrics defines the configuration for metrics collection.
 type Metrics struct {
 	Enabled bool
diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 4b696d5e9..7c46efcd9 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -140,67 +140,67 @@ func runManagementServer(conf *config.Config, server xdsv3.Server, enforcerServe
 
 func SetupRunners(conf *config.Config) {
 	ctx := ctrl.SetupSignalHandler()
-	// start the operator
-	pResources := new(message.ProviderResources)
-	// Start the Provider Service
-	// It fetches the resources from the configured provider type
+
+	// Step 1: Start the Kubernetes Provider Service
+	// It fetches the resources from the kubernetes
 	// and publishes it
 	// It also subscribes to status resources and once it receives
 	// a status resource back, it writes it out.
+	// Final processed crs will be stored in following pResources.
+	pResources := new(message.ProviderResources)
 	providerRunner := providerrunner.New(&providerrunner.Config{
 		ProviderResources: pResources,
 	})
 	if err := providerRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting provider service", err)
+		logger.LoggerAPKOperator.Error("Error while starting provider service ", err)
 	}
 
-	xdsIR := new(message.XdsIR)
-	infraIR := new(message.InfraIR)
-	// Start the GatewayAPI Translator Runner
+	// Step 2: Start the GatewayAPI Translator Runner
 	// It subscribes to the provider resources, translates it to xDS IR
 	// and infra IR resources and publishes them.
+	// Final processed structs will be in pResources, xdsIR, and infraIR
+	xdsIR := new(message.XdsIR)
+	infraIR := new(message.InfraIR)
 	gwRunner := runner.New(&runner.Config{
 		ProviderResources: pResources,
 		XdsIR:             xdsIR,
 		InfraIR:           infraIR,
 	})
 	if err := gwRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting translation service", err)
+		logger.LoggerAPKOperator.Error("Error while starting translation service ", err)
 	}
 
-	xds := new(message.Xds)
-	// Start the Xds Translator Service
+	// Step 3: Start the Xds Translator Service
 	// It subscribes to the xdsIR, translates it into xds Resources and publishes it.
+	// Final xds configs are in xds.
+	xds := new(message.Xds)
 	xdsTranslatorRunner := xdstranslatorrunner.New(&xdstranslatorrunner.Config{
-		// Server:            *cfg,
-		XdsIR: xdsIR,
-		Xds:   xds,
-		// ExtensionManager:  extMgr,
+		XdsIR:             xdsIR,
+		Xds:               xds,
 		ProviderResources: pResources,
 	})
 	if err := xdsTranslatorRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting xds translator service", err)
+		logger.LoggerAPKOperator.Error("Error while starting xds translator service ", err)
 	}
 
-	// Start the Infra Manager Runner
+	// Step 4: Start the Infra Manager Runner
 	// It subscribes to the infraIR, translates it into Envoy Proxy infrastructure
 	// resources such as K8s deployment and services.
 	infraRunner := infrarunner.New(&infrarunner.Config{
 		InfraIR: infraIR,
 	})
 	if err := infraRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting infrastructure service", err)
+		logger.LoggerAPKOperator.Error("Error while starting infrastructure service ", err)
 	}
 
-	// Start the xDS Server
+	// Step 5: Start the xDS Server
 	// It subscribes to the xds Resources and configures the remote Envoy Proxy
 	// via the xDS Protocol.
 	xdsServerRunner := xdsserverrunner.New(&xdsserverrunner.Config{
-		// Server: *cfg,
 		Xds: xds,
 	})
 	if err := xdsServerRunner.Start(ctx); err != nil {
-		logger.LoggerAPKOperator.Error("Error while starting xds service", err)
+		logger.LoggerAPKOperator.Error("Error while starting xds service ", err)
 	}
 }
 
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
index 9c132361d..1e51b63e1 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
@@ -26,9 +26,11 @@ import (
 	// Register embed
 	_ "embed"
 	"fmt"
+	"strconv"
 	"strings"
 	"text/template"
 
+	"github.com/wso2/apk/adapter/config"
 	egv1a1 "github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
 	"github.com/wso2/apk/adapter/pkg/utils/regex"
 	"k8s.io/apimachinery/pkg/util/sets"
@@ -37,9 +39,6 @@ import (
 const (
 	// envoyCfgFileName is the name of the Envoy configuration file.
 	envoyCfgFileName = "bootstrap.yaml"
-	// envoyGatewayXdsServerHost is the DNS name of the Xds Server within Envoy Gateway.
-	// It defaults to the Envoy Gateway Kubernetes service.
-	envoyGatewayXdsServerHost = "envoy-gateway"
 	// EnvoyAdminAddress is the listening address of the envoy admin interface.
 	EnvoyAdminAddress = "0.0.0.0"
 	// EnvoyAdminPort is the port used to expose admin interface.
@@ -47,9 +46,6 @@ const (
 	// envoyAdminAccessLogPath is the path used to expose admin access log.
 	envoyAdminAccessLogPath = "/dev/null"
 
-	// DefaultXdsServerPort is the default listening port of the xds-server.
-	DefaultXdsServerPort = 18000
-
 	envoyReadinessAddress = "0.0.0.0"
 	EnvoyReadinessPort    = 19001
 	EnvoyReadinessPath    = "/ready"
@@ -193,12 +189,13 @@ func GetRenderedBootstrapConfig(proxyMetrics *egv1a1.ProxyMetrics) (string, erro
 			}
 		}
 	}
-
+	conf := config.ReadConfigs()
+	xdsport, _ := strconv.Atoi(conf.Deployment.Gateway.AdapterXDSPort)
 	cfg := &bootstrapConfig{
 		parameters: bootstrapParameters{
 			XdsServer: xdsServerParameters{
-				Address: envoyGatewayXdsServerHost,
-				Port:    DefaultXdsServerPort,
+				Address: conf.Deployment.Gateway.AdapterHost,
+				Port:    int32(xdsport),
 			},
 			AdminServer: adminServerParameters{
 				Address:       EnvoyAdminAddress,
diff --git a/adapter/internal/operator/gateway-api/crypto/certgen.go b/adapter/internal/operator/gateway-api/crypto/certgen.go
index 87a8f1bcd..dfc2bd305 100644
--- a/adapter/internal/operator/gateway-api/crypto/certgen.go
+++ b/adapter/internal/operator/gateway-api/crypto/certgen.go
@@ -109,7 +109,7 @@ type certificateRequest struct {
 // and Envoy returning them as a *Certificates struct or error if encountered.
 func GenerateCerts() (*Certificates, error) {
 	conf := config.ReadConfigs()
-	gatewayNs := conf.Envoy.Namespace
+	gatewayNs := conf.Deployment.Gateway.Namespace
 	certCfg := new(Configuration)
 
 	certCfg.getProvider()
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
index de1057994..69da43826 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/infra.go
@@ -58,7 +58,7 @@ type Infra struct {
 func NewInfra(cli client.Client) *Infra {
 	conf := config.ReadConfigs()
 	return &Infra{
-		Namespace: conf.Envoy.Namespace,
+		Namespace: conf.Deployment.Gateway.Namespace,
 		Client:    New(cli),
 	}
 }
@@ -67,33 +67,10 @@ func NewInfra(cli client.Client) *Infra {
 // provided ResourceRender, if it doesn't exist and updates it if it does.
 func (i *Infra) createOrUpdate(ctx context.Context, r ResourceRender) error {
 
-	// certs, err := crypto.GenerateCerts()
-	// if err != nil {
-	// 	return fmt.Errorf("failed to generate certificates: %w", err)
-	// }
-	// secrets, err := gatewayapi.CreateOrUpdateSecrets(ctx, i.Client.Client, gatewayapi.CertsToSecret(i.Namespace, certs), true)
-
-	// if err != nil {
-	// 	if errors.Is(err, gatewayapi.ErrSecretExists) {
-	// 		loggers.LoggerAPKOperator.Info(err.Error())
-	// 	} else {
-	// 		return fmt.Errorf("failed to create or update secrets: %w", err)
-	// 	}
-	// } else {
-	// 	for i := range secrets {
-	// 		s := secrets[i]
-	// 		loggers.LoggerAPKOperator.Info("created secret", "namespace", s.Namespace, "name", s.Name)
-	// 	}
-	// }
-
 	if err := i.createOrUpdateServiceAccount(ctx, r); err != nil {
 		return fmt.Errorf("failed to create or update serviceaccount %s/%s: %w", i.Namespace, r.Name(), err)
 	}
 
-	// if err := i.createOrUpdateConfigMap(ctx, r); err != nil {
-	// 	return fmt.Errorf("failed to create or update configmap %s/%s: %w", i.Namespace, r.Name(), err)
-	// }
-
 	if err := i.createOrUpdateDeployment(ctx, r); err != nil {
 		return fmt.Errorf("failed to create or update deployment %s/%s: %w", i.Namespace, r.Name(), err)
 	}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index d301e3059..e87d802f1 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -492,44 +492,14 @@ func expectedEnforcerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec)
 }
 
 // expectedDeploymentVolumes returns expected proxy deployment volumes.
-func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+func expectedDeploymentVolumes(deploymentSpec *egv1a1.KubernetesDeploymentSpec) []corev1.Volume {
+	conf := config.ReadConfigs()
 	volumes := []corev1.Volume{
-		// {
-		// 	Name: "certs",
-		// 	VolumeSource: corev1.VolumeSource{
-		// 		Secret: &corev1.SecretVolumeSource{
-		// 			SecretName:  "envoy",
-		// 			DefaultMode: ptr.To[int32](420),
-		// 		},
-		// 	},
-		// },
-		// {
-		// 	Name: "sds",
-		// 	VolumeSource: corev1.VolumeSource{
-		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
-		// 			LocalObjectReference: corev1.LocalObjectReference{
-		// 				Name: ExpectedResourceHashedName(name),
-		// 			},
-		// 			Items: []corev1.KeyToPath{
-		// 				{
-		// 					Key:  SdsCAFilename,
-		// 					Path: SdsCAFilename,
-		// 				},
-		// 				{
-		// 					Key:  SdsCertFilename,
-		// 					Path: SdsCertFilename,
-		// 				},
-		// 			},
-		// 			DefaultMode: ptr.To[int32](420),
-		// 			Optional:    ptr.To(false),
-		// 		},
-		// 	},
-		// },
 		{
 			Name: "ratelimiter-truststore-secret-volume",
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
-					SecretName:  "apk-test-wso2-apk-ratelimiter-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.RatelimiterTruststoreSecretVolume,
 					DefaultMode: ptr.To[int32](420),
 				},
 			},
@@ -539,7 +509,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerKeystoreSecretVolume,
 				},
 			},
 		},
@@ -559,7 +529,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "envoy-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.RouterKeystoreSecretVolume,
 				},
 			},
 		},
@@ -568,7 +538,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-adapter-server-cert",
+					SecretName:  conf.Deployment.Gateway.Volumes.AdapterTruststoreSecretVolume,
 				},
 			},
 		},
@@ -577,7 +547,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-keystore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerJwtSecretVolume,
 				},
 			},
 		},
@@ -586,7 +556,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerTrustedCerts,
 				},
 			},
 		},
@@ -595,7 +565,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.EnforcerApikeyCert,
 				},
 			},
 		},
@@ -604,7 +574,7 @@ func expectedDeploymentVolumes(name string, deploymentSpec *egv1a1.KubernetesDep
 			VolumeSource: corev1.VolumeSource{
 				Secret: &corev1.SecretVolumeSource{
 					DefaultMode: ptr.To[int32](420),
-					SecretName:  "apk-test-wso2-apk-enforcer-truststore-secret",
+					SecretName:  conf.Deployment.Gateway.Volumes.IDPCertificateSecretVolume,
 				},
 			},
 		},
@@ -651,72 +621,70 @@ func expectedContainerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev
 
 func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1.EnvVar {
 	conf := config.ReadConfigs()
-	adapterNs := conf.Adapter.Namespace
-	gatewayNs := conf.Envoy.Namespace
 	env := []corev1.EnvVar{
 		{
 			Name:  "ADAPTER_HOST_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.AdapterHostName,
 		},
 		{
 			Name:  "ADAPTER_HOST",
-			Value: fmt.Sprintf("apk-test-wso2-apk-adapter-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.AdapterHost,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_HOST_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.CommonControllerHostName,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_HOST",
-			Value: fmt.Sprintf("apk-test-wso2-apk-common-controller-service.%s.svc", adapterNs),
+			Value: conf.Deployment.Gateway.CommonControllerHost,
 		},
 		{
 			Name:  "ENFORCER_PRIVATE_KEY_PATH",
-			Value: "/home/wso2/security/keystore/enforcer.key",
+			Value: conf.Deployment.Gateway.EnforcerPrivateKeyPath,
 		},
 		{
 			Name:  "ENFORCER_PUBLIC_CERT_PATH",
-			Value: "/home/wso2/security/keystore/enforcer.crt",
+			Value: conf.Deployment.Gateway.EnforcerPublicCertPath,
 		},
 		{
 			Name:  "ENFORCER_SERVER_NAME",
-			Value: fmt.Sprintf("apk-test-wso2-apk-enforcer-service.%s.svc", gatewayNs),
+			Value: conf.Deployment.Gateway.EnforcerServerName,
 		},
 		{
 			Name:  "TRUSTED_CA_CERTS_PATH",
-			Value: "/home/wso2/security/truststore",
+			Value: conf.Deployment.Gateway.AdapterTrustedCAPath,
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: "18000",
+			Value: conf.Deployment.Gateway.AdapterXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
-			Value: "18002",
+			Value: conf.Deployment.Gateway.CommonControllerXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_REST_PORT",
-			Value: "18003",
+			Value: conf.Deployment.Gateway.CommonControllerRestPort,
 		},
 		{
 			Name:  "ENFORCER_LABEL",
-			Value: "wso2-apk-default",
+			Value: conf.Deployment.Gateway.EnforcerLabel,
 		},
 		{
 			Name:  "ENFORCER_REGION",
-			Value: "UNKNOWN",
+			Value: conf.Deployment.Gateway.EnforcerRegion,
 		},
 		{
 			Name:  "XDS_MAX_MSG_SIZE",
-			Value: "4194304",
+			Value: conf.Deployment.Gateway.EnforcerXDSMaxMsgSize,
 		},
 		{
 			Name:  "XDS_MAX_RETRIES",
-			Value: "3",
+			Value: conf.Deployment.Gateway.EnforcerXDSMaxRetries,
 		},
 		{
 			Name:  "JAVA_OPTS",
-			Value: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+			Value: conf.Deployment.Gateway.JavaOpts,
 		},
 	}
 
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
index 3947f7b5a..e54df5e0b 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -273,7 +273,7 @@ func (r *ResourceRender) Deployment() (*appsv1.Deployment, error) {
 					SecurityContext:               deploymentConfig.Pod.SecurityContext,
 					Affinity:                      deploymentConfig.Pod.Affinity,
 					Tolerations:                   deploymentConfig.Pod.Tolerations,
-					Volumes:                       expectedDeploymentVolumes(r.infra.Name, deploymentConfig),
+					Volumes:                       expectedDeploymentVolumes(deploymentConfig),
 					ImagePullSecrets:              deploymentConfig.Pod.ImagePullSecrets,
 					NodeSelector:                  deploymentConfig.Pod.NodeSelector,
 					TopologySpreadConstraints:     deploymentConfig.Pod.TopologySpreadConstraints,
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index de30222c9..db7e35f57 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -88,7 +88,7 @@ func InitGatewayController(mgr manager.Manager, pResourses *message.ProviderReso
 		statusUpdater: statusUpdater,
 		mgr:           mgr,
 		resources:     pResourses,
-		namespace:     conf.Envoy.Namespace,
+		namespace:     conf.Deployment.Gateway.Namespace,
 		store:         newProviderStore(),
 	}
 	c, err := controller.New(constants.GatewayControllerNew, mgr, controller.Options{Reconciler: r})
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
index 156fb9f3b..91a523564 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -166,9 +166,6 @@ func (r *gatewayReconcilerNew) envoyDeploymentForGateway(ctx context.Context, ga
 	}
 	deployment := new(appsv1.Deployment)
 	if err := r.client.Get(ctx, key, deployment); err != nil {
-		if k8errors.IsNotFound(err) {
-			return nil, nil
-		}
 		return nil, err
 	}
 	return deployment, nil
diff --git a/adapter/internal/operator/gateway-api/translator/runner/runner.go b/adapter/internal/operator/gateway-api/translator/runner/runner.go
index be0131072..3eedac788 100644
--- a/adapter/internal/operator/gateway-api/translator/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/translator/runner/runner.go
@@ -71,22 +71,6 @@ func (r *Runner) subscribeAndTranslate(ctx context.Context) {
 				// Translate to xds resources
 				t := &translator.Translator{}
 
-				// Set the extension manager if an extension is loaded
-				// if r.ExtensionManager != nil {
-				// 	t.ExtensionManager = &r.ExtensionManager
-				// }
-
-				// Set the rate limit service URL if global rate limiting is enabled.
-				// if r.EnvoyGateway.RateLimit != nil {
-				// 	t.GlobalRateLimit = &translator.GlobalRateLimitSettings{
-				// 		ServiceURL: ratelimit.GetServiceURL(r.Namespace, r.DNSDomain),
-				// 		FailClosed: r.EnvoyGateway.RateLimit.FailClosed,
-				// 	}
-				// 	if r.EnvoyGateway.RateLimit.Timeout != nil {
-				// 		t.GlobalRateLimit.Timeout = r.EnvoyGateway.RateLimit.Timeout.Duration
-				// 	}
-				// }
-
 				result, err := t.Translate(val)
 				if err != nil {
 					loggers.LoggerAPKOperator.Error("Failed to translate xds ir ", err)
@@ -100,38 +84,8 @@ func (r *Runner) subscribeAndTranslate(ctx context.Context) {
 					return
 				}
 
-				// Get all status keys from watchable and save them in the map statusesToDelete.
-				// Iterating through result.EnvoyPatchPolicyStatuses, any valid keys will be removed from statusesToDelete.
-				// Remaining keys will be deleted from watchable before we exit this function.
-				// statusesToDelete := make(map[ktypes.NamespacedName]bool)
-				// for key := range r.ProviderResources.EnvoyPatchPolicyStatuses.LoadAll() {
-				// 	statusesToDelete[key] = true
-				// }
-
-				// // Publish EnvoyPatchPolicyStatus
-				// for _, e := range result.EnvoyPatchPolicyStatuses {
-				// 	key := ktypes.NamespacedName{
-				// 		Name:      e.Name,
-				// 		Namespace: e.Namespace,
-				// 	}
-				// 	// Skip updating status for policies with empty status
-				// 	// They may have been skipped in this translation because
-				// 	// their target is not found (not relevant)
-				// 	if !(reflect.ValueOf(e.Status).IsZero()) {
-				// 		r.ProviderResources.EnvoyPatchPolicyStatuses.Store(key, e.Status)
-				// 	}
-				// 	delete(statusesToDelete, key)
-				// }
-				// // Discard the EnvoyPatchPolicyStatuses to reduce memory footprint
-				// result.EnvoyPatchPolicyStatuses = nil
-
 				// Publish
 				r.Xds.Store(key, result)
-
-				// Delete all the deletable status keys
-				// for key := range statusesToDelete {
-				// 	r.ProviderResources.EnvoyPatchPolicyStatuses.Delete(key)
-				// }
 			}
 		},
 	)
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
index ffbafca29..b78207444 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -25,8 +25,8 @@ package runner
 import (
 	"context"
 	"crypto/tls"
+	"fmt"
 	"net"
-	"strconv"
 	"time"
 
 	"google.golang.org/grpc/keepalive"
@@ -39,8 +39,8 @@ import (
 	runtimev3 "github.com/envoyproxy/go-control-plane/envoy/service/runtime/v3"
 	secretv3 "github.com/envoyproxy/go-control-plane/envoy/service/secret/v3"
 	serverv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
+	"github.com/wso2/apk/adapter/config"
 	"github.com/wso2/apk/adapter/internal/loggers"
-	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/cache"
 	"github.com/wso2/apk/adapter/internal/operator/message"
 	"github.com/wso2/apk/adapter/internal/types"
@@ -106,10 +106,10 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 }
 
 func (r *Runner) serveXdsServer(ctx context.Context) {
-	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
-	l, err := net.Listen("tcp", addr)
+	conf := config.ReadConfigs()
+	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
 	if err != nil {
-		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", bootstrap.DefaultXdsServerPort)
+		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", conf.Deployment.Gateway.AdapterXDSPort)
 		return
 	}
 
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
index 3dba8c03f..ea2929d53 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
@@ -27,13 +27,13 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
+	"fmt"
 	"net"
-	"strconv"
 	"testing"
 	"time"
 
 	"github.com/stretchr/testify/require"
-	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
+	"github.com/wso2/apk/adapter/config"
 )
 
 // func TestTLSConfig(t *testing.T) {
@@ -189,9 +189,9 @@ func peekError(conn net.Conn) error {
 }
 
 func TestServeXdsServerListenFailed(t *testing.T) {
+	conf := config.ReadConfigs()
 	// Occupy the address to make listening failed
-	addr := net.JoinHostPort(XdsServerAddress, strconv.Itoa(bootstrap.DefaultXdsServerPort))
-	l, err := net.Listen("tcp", addr)
+	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
 	require.NoError(t, err)
 	defer l.Close()
 
diff --git a/adapter/pkg/health/health.go b/adapter/pkg/health/health.go
index 4f65c16dd..9edaad386 100644
--- a/adapter/pkg/health/health.go
+++ b/adapter/pkg/health/health.go
@@ -58,8 +58,8 @@ type Server struct {
 
 // Check responds the health check client with health status of the Adapter
 func (s Server) Check(ctx context.Context, request *healthservice.HealthCheckRequest) (*healthservice.HealthCheckResponse, error) {
-	logger.LoggerHealth.Debugf("Querying health state for Adapter service \"%s\"", request.Service)
-	logger.LoggerHealth.Debugf("Internal health state map: %v", serviceHealthStatus)
+	// logger.LoggerHealth.Debugf("Querying health state for Adapter service \"%s\"", request.Service)
+	// logger.LoggerHealth.Debugf("Internal health state map: %v", serviceHealthStatus)
 
 	if request.Service == "" {
 		// overall health of the server
diff --git a/adapter/resources/check_health.sh b/adapter/resources/check_health.sh
index 8d5e18abd..93c56cad5 100755
--- a/adapter/resources/check_health.sh
+++ b/adapter/resources/check_health.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 # -----------------------------------------------------------------------
 
-ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
 ADAPTER_SERVER_NAME="${ADAPTER_SERVER_NAME:-adapter}"
 grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
     -tls \
diff --git a/gateway/enforcer/Dockerfile b/gateway/enforcer/Dockerfile
index d77635d61..6ee7000f8 100644
--- a/gateway/enforcer/Dockerfile
+++ b/gateway/enforcer/Dockerfile
@@ -74,18 +74,6 @@ ENV JAVA_OPTS=""
 ENV ENFORCER_HOME=${APK_USER_HOME}
 ARG CHECKSUM_AMD64="7e564681110ee4563637457b91e42f62f96b79618a835bb05ae2305acdcc3db0"
 ARG CHECKSUM_ARM64="3759148e22a494149a4abae269adee0d20c428b966683426e2319f9047da521d"
-ENV ENFORCER_PRIVATE_KEY_PATH=/home/wso2/security/keystore/mg.key
-ENV ENFORCER_PUBLIC_CERT_PATH=/home/wso2/security/keystore/mg.pem
-ENV TRUSTED_CA_CERTS_PATH=/home/wso2/security/truststore
-ENV ADAPTER_HOST_NAME=adapter
-ENV ADAPTER_HOST=adapter
-ENV ADAPTER_XDS_PORT=18001
-ENV COMMON_CONTROLLER_HOST_NAME=common-controller
-ENV COMMON_CONTROLLER_HOST=common-controller
-ENV COMMON_CONTROLLER_XDS_PORT=18002
-ENV ENFORCER_LABEL="default"
-ENV XDS_MAX_MSG_SIZE=4194304
-ENV XDS_MAX_RETRIES=3
 #todo update the connection string
 ENV APPLICATIONINSIGHTS_CONNECTION_STRING=InstrumentationKey=;IngestionEndpoint=https://westus2-2.in.applicationinsights.azure.com/
 
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index 55052640b..f8ae1dbd9 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -6,11 +6,21 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.toml: | 
+
+    [deployment.gateway.volumes]
+      ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"
+			enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
+			routerKeystoreSecretVolume = "envoy-cert"
+			adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
+			enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
+			enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+			enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+			idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}
       environment = "{{ .Values.wso2.apk.dp.environment.name }}"
       {{- end }}
-      namespace = "{{ .Release.Namespace }}"
     {{ if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
     [adapter.operator]
       namespaces = [{{ include "commaJoinedQuotedList" .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces}}]
diff --git a/helm-charts/values.yaml b/helm-charts/values.yaml
index 6b83d1f19..d1664f9d0 100644
--- a/helm-charts/values.yaml
+++ b/helm-charts/values.yaml
@@ -59,7 +59,8 @@ wso2:
       gateway:
         listener:
           hostname: "gw.wso2.com"
-        service: {}
+        service: 
+          type: "NodePort"
           # secretName: "idp-tls"
       # partitionServer:
       #   enabled: false
@@ -124,8 +125,8 @@ wso2:
           image: wso2/apk-adapter:1.2.0-m1
           security:
             sslHostname: "adapter"
-        #     logging:
-        #       level: "INFO" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
+          logging:
+            level: "DEBG" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
         # #          logFormat: "TEXT" # Values can be "JSON", "TEXT"
         # configs:
         #   apiNamespaces:
@@ -247,7 +248,8 @@ wso2:
               sslHostname: "enforcer"
 #            logging:
 #              level: DEBUG
-#            configs:
+            configs:
+              javaOpts: "-Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2"
 #              tls:
 #                secretName: "router-cert"
 #                certKeyFilename: ""

From c5e9badb7af5b0adf0548635d3d44f202a0a4006 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 16:16:53 +0530
Subject: [PATCH 03/40] fix config.toml tabs

---
 .../gateway-components/log-conf.yaml          | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index f8ae1dbd9..0d8bfce18 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -6,16 +6,26 @@ metadata:
   namespace: {{ .Release.Namespace }}
 data:
   config.toml: | 
+    [deployment.gateway]
+      namespace = "{{ .Release.Namespace }}"
+      adapterHostName = "{{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc"
+      adapterHost = "{{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc"
+      commonControllerHostName = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
+      commonControllerHost = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
+      enforcerServerName = "{{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc"
+      {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}
+        javaOpts = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}"
+      {{- end }}
 
     [deployment.gateway.volumes]
       ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"
-			enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
-			routerKeystoreSecretVolume = "envoy-cert"
-			adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
-			enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
-			enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-			enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-			idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      enforcerKeystoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert"
+      routerKeystoreSecretVolume = "envoy-cert"
+      adapterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-adapter-server-cert"
+      enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
+      enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
 
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}

From d44648e25df3ef3dc59bfa9b299038e31acc6747 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 5 Aug 2024 16:59:53 +0530
Subject: [PATCH 04/40] fix config

---
 .../templates/data-plane/gateway-components/log-conf.yaml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index 0d8bfce18..c04aa0e7a 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -25,7 +25,7 @@ data:
       enforcerJwtSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret"
       enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
       enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
-      idpCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      iDPCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
 
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}

From 1a6b3bee7ed648f884996b4077f981644fb83163 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Tue, 6 Aug 2024 12:12:31 +0530
Subject: [PATCH 05/40] Start API controller along with new gateway controller

---
 adapter/internal/discovery/xds/server.go      | 16 ++---
 .../operator/controllers/dp/api_controller.go | 35 +++++-----
 .../provider/kubernetes/kubernetes.go         | 65 +++++++++++++++++++
 3 files changed, 90 insertions(+), 26 deletions(-)

diff --git a/adapter/internal/discovery/xds/server.go b/adapter/internal/discovery/xds/server.go
index 2336d9941..310269f82 100644
--- a/adapter/internal/discovery/xds/server.go
+++ b/adapter/internal/discovery/xds/server.go
@@ -227,16 +227,16 @@ func UpdateXdsCacheOnAPIChange(labels map[string]struct{}) bool {
 	revisionStatus := false
 	// TODO: (VirajSalaka) check possible optimizations, Since the number of labels are low by design it should not be an issue
 	for newLabel := range labels {
-		listeners, clusters, routes, endpoints, apis := GenerateEnvoyResoucesForGateway(newLabel)
+		_, _, _, _, apis := GenerateEnvoyResoucesForGateway(newLabel)
 		UpdateEnforcerApis(newLabel, apis, "")
-		success := UpdateXdsCacheWithLock(newLabel, endpoints, clusters, routes, listeners)
+		// success := UpdateXdsCacheWithLock(newLabel, endpoints, clusters, routes, listeners)
 		logger.LoggerXds.Debugf("Xds Cache is updated for the label : %v", newLabel)
-		if success {
-			// if even one label was updated with latest revision, we take the revision as deployed.
-			// (other labels also will get updated successfully)
-			revisionStatus = success
-			continue
-		}
+		// if success {
+		// 	// if even one label was updated with latest revision, we take the revision as deployed.
+		// 	// (other labels also will get updated successfully)
+		// 	revisionStatus = success
+		// 	continue
+		// }
 	}
 	return revisionStatus
 }
diff --git a/adapter/internal/operator/controllers/dp/api_controller.go b/adapter/internal/operator/controllers/dp/api_controller.go
index 267c505d5..7eae15414 100644
--- a/adapter/internal/operator/controllers/dp/api_controller.go
+++ b/adapter/internal/operator/controllers/dp/api_controller.go
@@ -67,40 +67,39 @@ import (
 )
 
 const (
-	httpRouteAPIIndex = "httpRouteAPIIndex"
-	gqlRouteAPIIndex  = "gqlRouteAPIIndex"
+	httpRouteAPIIndex = "httpRouteAPIIndexApiController"
+	gqlRouteAPIIndex  = "gqlRouteAPIIndexApiController"
 	grpcRouteAPIIndex = "grpcRouteAPIIndex"
 	// apiAuthenticationIndex Index for API level authentications
-	apiAuthenticationIndex = "apiAuthenticationIndex"
+	apiAuthenticationIndex = "apiAuthenticationIndexApiController"
 	// apiAuthenticationResourceIndex Index for resource level authentications
-	apiAuthenticationResourceIndex = "apiAuthenticationResourceIndex"
+	apiAuthenticationResourceIndex = "apiAuthenticationResourceIndexApiController"
 	// apiRateLimitIndex Index for API level ratelimits
-	apiRateLimitIndex = "apiRateLimitIndex"
+	apiRateLimitIndex = "apiRateLimitIndexApiController"
 	// apiRateLimitResourceIndex Index for resource level ratelimits
-	apiRateLimitResourceIndex = "apiRateLimitResourceIndex"
+	apiRateLimitResourceIndex = "apiRateLimitResourceIndexApiController"
 	// gatewayHTTPRouteIndex Index for gateway httproutes
-	gatewayHTTPRouteIndex = "gatewayHTTPRouteIndex"
-	// gatewayGRPCRouteIndex Index for gateway grpcroutes
+	gatewayHTTPRouteIndex = "gatewayHTTPRouteIndexApiController"
 	gatewayGRPCRouteIndex = "gatewayGRPCRouteIndex"
 	// apiAPIPolicyIndex Index for API level apipolicies
-	apiAPIPolicyIndex = "apiAPIPolicyIndex"
+	apiAPIPolicyIndex = "apiAPIPolicyIndexApiController"
 	// apiAPIPolicyResourceIndex Index for resource level apipolicies
-	apiAPIPolicyResourceIndex        = "apiAPIPolicyResourceIndex"
-	serviceHTTPRouteIndex            = "serviceHTTPRouteIndex"
-	httprouteScopeIndex              = "httprouteScopeIndex"
+	apiAPIPolicyResourceIndex        = "apiAPIPolicyResourceIndexApiController"
+	serviceHTTPRouteIndex            = "serviceHTTPRouteIndexApiController"
+	httprouteScopeIndex              = "httprouteScopeIndexApiController"
 	grpcRouteScopeIndex              = "grpcRouteScopeIndex"
-	gqlRouteScopeIndex               = "gqlRouteScopeIndex"
+	gqlRouteScopeIndex               = "gqlRouteScopeIndexApiController"
 	configMapBackend                 = "configMapBackend"
 	configMapAPIDefinition           = "configMapAPIDefinition"
 	secretBackend                    = "secretBackend"
 	configMapAuthentication          = "configMapAuthentication"
 	secretAuthentication             = "secretAuthentication"
-	backendHTTPRouteIndex            = "backendHTTPRouteIndex"
-	backendGQLRouteIndex             = "backendGQLRouteIndex"
+	backendHTTPRouteIndex            = "backendHTTPRouteIndexApiController"
+	backendGQLRouteIndex             = "backendGQLRouteIndexApiController"
+	interceptorServiceAPIPolicyIndex = "interceptorServiceAPIPolicyIndexApiController"
+	backendInterceptorServiceIndex   = "backendInterceptorServiceIndexApiController"
+	backendJWTAPIPolicyIndex         = "backendJWTAPIPolicyIndexApiController"
 	backendGRPCRouteIndex            = "backendGRPCRouteIndex"
-	interceptorServiceAPIPolicyIndex = "interceptorServiceAPIPolicyIndex"
-	backendInterceptorServiceIndex   = "backendInterceptorServiceIndex"
-	backendJWTAPIPolicyIndex         = "backendJWTAPIPolicyIndex"
 	aiRatelimitPolicyToBackendIndex  = "aiRatelimitPolicyToBackendIndex"
 	subscriptionToAPIIndex           = "subscriptionToAPIIndex"
 	apiToSubscriptionIndex           = "apiToSubscriptionIndex"
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
index d72604230..282195b79 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
@@ -26,6 +26,7 @@ import (
 	"context"
 	"flag"
 	"fmt"
+	"strings"
 
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/provider"
 	"github.com/wso2/apk/adapter/internal/operator/message"
@@ -37,6 +38,14 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
+	"github.com/wso2/apk/adapter/config"	
+	"github.com/wso2/apk/adapter/pkg/metrics"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	"github.com/wso2/apk/adapter/pkg/logging"
+	"github.com/wso2/apk/adapter/internal/operator/synchronizer"
+	dpcontrollers "github.com/wso2/apk/adapter/internal/operator/controllers/dp"
+
+
 )
 
 // Provider is the scaffolding for the Kubernetes provider. It sets up dependencies
@@ -64,7 +73,22 @@ func New(cfg *rest.Config, resources *message.ProviderResources) (*Provider, err
 		LeaderElectionID:       "operator-lease.apk.wso2.com",
 	}
 
+	
+	conf := config.ReadConfigs()
+	metricsConfig := conf.Adapter.Metrics
+	if metricsConfig.Enabled {
+		mgrOpts.Metrics.BindAddress = fmt.Sprintf(":%d", metricsConfig.Port)
+		// Register the metrics collector
+		if strings.EqualFold(metricsConfig.Type, metrics.PrometheusMetricType) {
+			loggers.LoggerAPKOperator.Info("Registering Prometheus metrics collector.")
+			metrics.RegisterPrometheusCollector()
+		}
+	} else {
+		mgrOpts.Metrics.BindAddress = "0"
+	}
+
 	mgr, err := ctrl.NewManager(cfg, mgrOpts)
+
 	if err != nil {
 		return nil, fmt.Errorf("failed to create manager: %w", err)
 	}
@@ -89,6 +113,47 @@ func New(cfg *rest.Config, resources *message.ProviderResources) (*Provider, err
 		return nil, fmt.Errorf("unable to set up ready check: %w", err)
 	}
 
+	if err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error2600, logging.BLOCKER, "Unable to start manager: %v", err))
+	}
+
+	// TODO: Decide on a buffer size and add to config.
+	ch := make(chan *synchronizer.APIEvent, 10)
+	successChannel := make(chan synchronizer.SuccessEvent, 10)
+
+	gatewaych := make(chan synchronizer.GatewayEvent, 10)
+	if err := mgr.Add(updateHandler); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Failed to add status update handler %v", err)
+	}
+	operatorDataStore := synchronizer.GetOperatorDataStore()
+	if err := dpcontrollers.NewGatewayController(mgr, operatorDataStore, updateHandler, &gatewaych); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Error creating Gateway controller: %v", err)
+	}
+
+	if err := dpcontrollers.NewAPIController(mgr, operatorDataStore, updateHandler, &ch, &successChannel); err != nil {
+		loggers.LoggerAPKOperator.Errorf("Error creating API controller: %v", err)
+	}
+
+	if err := dpcontrollers.NewTokenIssuerReconciler(mgr); err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error3114, logging.BLOCKER, "Error creating JWT Issuer controller: %v", err))
+	}
+	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error2602, logging.BLOCKER, "Unable to set up health check: %v", err))
+	}
+	if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
+		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error2603, logging.BLOCKER, "Unable to set up ready check: %v", err))
+	}
+
+	go synchronizer.HandleAPILifeCycleEvents(&ch, &successChannel)
+	go synchronizer.HandleGatewayLifeCycleEvents(&gatewaych)
+	if config.ReadConfigs().PartitionServer.Enabled {
+		go synchronizer.SendEventToPartitionServer()
+	}
+
+	// if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
+	// 	loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error2604, logging.BLOCKER, "Problem running manager: %v", err))
+	// }
+
 	return &Provider{
 		manager: mgr,
 		client:  mgr.GetClient(),

From b05050803abb2846f0160547b90872def1a3c57a Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 8 Aug 2024 09:20:22 +0530
Subject: [PATCH 06/40] Fix xds updates

---
 .../gateway-api/bootstrap/bootstrap.yaml.tpl         |  2 +-
 .../infrastructure/kubernetes/proxy/resource.go      |  2 +-
 adapter/internal/operator/gateway-api/ir/xds.go      |  2 +-
 .../gateway-api/provider/kubernetes/controller.go    |  2 +-
 .../gateway-api/provider/kubernetes/helpers.go       |  2 +-
 .../gateway-api/v1alpha1/envoyproxy_types.go         |  4 ++--
 .../operator/gateway-api/v1alpha1/shared_types.go    |  8 ++++----
 .../internal/operator/gateway-api/version/version.go |  2 +-
 .../operator/gateway-api/xds/runner/runner.go        |  4 ++--
 adapter/internal/operator/status/conditions.go       |  4 ++--
 adapter/pkg/health/health.go                         | 12 +++++++-----
 11 files changed, 23 insertions(+), 21 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
index bad77c930..26d703f49 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -128,7 +128,7 @@ static_resources:
           endpoint:
             address:
               socket_address:
-                address: apk-test-wso2-apk-adapter-service.apk.svc
+                address: {{ .XdsServer.Address }}
                 port_value: {{ .XdsServer.Port }}
     typed_extension_protocol_options:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index e87d802f1..55fa4f8cb 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -58,7 +58,7 @@ const (
 	// envoyContainerName is the name of the Envoy container.
 	envoyContainerName    = "envoy"
 	enforcerContainerName = "enforcer"
-	// envoyNsEnvVar is the name of the Envoy Gateway namespace environment variable.
+	// envoyNsEnvVar is the name of the APK Gateway namespace environment variable.
 	envoyNsEnvVar = "ENVOY_GATEWAY_NAMESPACE"
 	// envoyPodEnvVar is the name of the Envoy pod name environment variable.
 	envoyPodEnvVar = "ENVOY_POD_NAME"
diff --git a/adapter/internal/operator/gateway-api/ir/xds.go b/adapter/internal/operator/gateway-api/ir/xds.go
index f9cc35559..1aed17f89 100644
--- a/adapter/internal/operator/gateway-api/ir/xds.go
+++ b/adapter/internal/operator/gateway-api/ir/xds.go
@@ -485,7 +485,7 @@ type HTTPRoute struct {
 }
 
 // UnstructuredRef holds unstructured data for an arbitrary k8s resource introduced by an extension
-// Envoy Gateway does not need to know about the resource types in order to store and pass the data for these objects
+// APK Gateway does not need to know about the resource types in order to store and pass the data for these objects
 // to an extension.
 //
 // +k8s:deepcopy-gen=true
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index db7e35f57..b0400864f 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -202,7 +202,7 @@ func (r *gatewayReconcilerNew) Reconcile(ctx context.Context, req ctrl.Request)
 	return ctrl.Result{}, nil
 }
 
-// managedGatewayClasses returns a list of GatewayClass objects that are managed by the Envoy Gateway Controller.
+// managedGatewayClasses returns a list of GatewayClass objects that are managed by the APK Gateway Controller.
 func (r *gatewayReconcilerNew) managedGatewayClasses(ctx context.Context) ([]*gwapiv1.GatewayClass, error) {
 	var gatewayClasses gwapiv1.GatewayClassList
 	if err := r.client.List(ctx, &gatewayClasses); err != nil {
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
index c31d2dc4e..b2b65c9db 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/helpers.go
@@ -75,7 +75,7 @@ type ObjectKindNamespacedName struct {
 }
 
 // validateParentRefs validates the provided routeParentReferences, returning the
-// referenced Gateways managed by Envoy Gateway. The only supported parentRef
+// referenced Gateways managed by APK Gateway. The only supported parentRef
 // is a Gateway.
 func validateParentRefs(ctx context.Context, client client.Client, namespace string,
 	gatewayClassController gwapiv1.GatewayController,
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
index b0b36db1a..d7d805bc0 100644
--- a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_types.go
@@ -69,8 +69,8 @@ type EnvoyProxySpec struct {
 	// Visit https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/bootstrap/v3/bootstrap.proto#envoy-v3-api-msg-config-bootstrap-v3-bootstrap
 	// to learn more about the syntax.
 	// If set, this is the Bootstrap configuration used for the managed Envoy Proxy fleet instead of the default Bootstrap configuration
-	// set by Envoy Gateway.
-	// Some fields within the Bootstrap that are required to communicate with the xDS Server (Envoy Gateway) and receive xDS resources
+	// set by APK.
+	// Some fields within the Bootstrap that are required to communicate with the xDS Server and receive xDS resources
 	// from it are not configurable and will result in the `EnvoyProxy` resource being rejected.
 	// Backward compatibility across minor versions is not guaranteed.
 	// We strongly recommend using `egctl x translate` to generate a `EnvoyProxy` resource with the `Bootstrap` field set to the default
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
index b3ccdb284..72fcdddbd 100644
--- a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
+++ b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
@@ -62,7 +62,7 @@ type GroupVersionKind struct {
 	Kind    string `json:"kind"`
 }
 
-// ProviderType defines the types of providers supported by Envoy Gateway.
+// ProviderType defines the types of providers supported by APK Gateway.
 //
 // +kubebuilder:validation:Enum=Kubernetes
 type ProviderType string
@@ -303,7 +303,7 @@ type KubernetesServiceSpec struct {
 }
 
 // +k8s:deepcopy-gen=true
-// LogLevel defines a log level for Envoy Gateway and EnvoyProxy system logs.
+// LogLevel defines a log level for APK Gateway and EnvoyProxy system logs.
 // +kubebuilder:validation:Enum=debug;info;error;warn
 type LogLevel string
 
@@ -322,7 +322,7 @@ const (
 )
 
 // +k8s:deepcopy-gen=true
-// XDSTranslatorHook defines the types of hooks that an Envoy Gateway extension may support
+// XDSTranslatorHook defines the types of hooks that an APK Gateway extension may support
 // for the xds-translator
 //
 // +kubebuilder:validation:Enum=VirtualHost;Route;HTTPListener;Translation
@@ -380,7 +380,7 @@ const (
 // +k8s:deepcopy-gen=true
 // KubernetesHorizontalPodAutoscalerSpec defines Kubernetes Horizontal Pod Autoscaler settings of Envoy Proxy Deployment.
 // When HPA is enabled, it is recommended that the value in `KubernetesDeploymentSpec.replicas` be removed, otherwise
-// Envoy Gateway will revert back to this value every time reconciliation occurs.
+// APK Gateway will revert back to this value every time reconciliation occurs.
 // See k8s.io.autoscaling.v2.HorizontalPodAutoScalerSpec.
 //
 // +kubebuilder:validation:XValidation:message="maxReplicas cannot be less than minReplicas",rule="!has(self.minReplicas) || self.maxReplicas >= self.minReplicas"
diff --git a/adapter/internal/operator/gateway-api/version/version.go b/adapter/internal/operator/gateway-api/version/version.go
index 64440dd3a..f320a6c07 100644
--- a/adapter/internal/operator/gateway-api/version/version.go
+++ b/adapter/internal/operator/gateway-api/version/version.go
@@ -73,7 +73,7 @@ func init() {
 	}
 }
 
-// Print shows the versions of the Envoy Gateway.
+// Print shows the versions of the APK Gateway.
 func Print(w io.Writer, format string) error {
 	v := Get()
 	switch format {
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
index b78207444..bcb9f7003 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -25,7 +25,6 @@ package runner
 import (
 	"context"
 	"crypto/tls"
-	"fmt"
 	"net"
 	"time"
 
@@ -107,7 +106,8 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 
 func (r *Runner) serveXdsServer(ctx context.Context) {
 	conf := config.ReadConfigs()
-	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
+	addr := net.JoinHostPort(XdsServerAddress, conf.Deployment.Gateway.AdapterXDSPort)
+	l, err := net.Listen("tcp", addr)
 	if err != nil {
 		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", conf.Deployment.Gateway.AdapterXDSPort)
 		return
diff --git a/adapter/internal/operator/status/conditions.go b/adapter/internal/operator/status/conditions.go
index 0ef2b69b3..f1479569c 100644
--- a/adapter/internal/operator/status/conditions.go
+++ b/adapter/internal/operator/status/conditions.go
@@ -80,11 +80,11 @@ func computeGatewayAcceptedCondition(gw *gwapiv1.Gateway, accepted bool) metav1.
 	case true:
 		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionTrue,
 			string(gwapiv1.GatewayReasonAccepted),
-			"The Gateway has been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+			"The Gateway has been scheduled by APK Gateway", time.Now(), gw.Generation)
 	default:
 		return newCondition(string(gwapiv1.GatewayReasonAccepted), metav1.ConditionFalse,
 			string(gwapiv1.GatewayReasonAccepted),
-			"The Gateway has not been scheduled by Envoy Gateway", time.Now(), gw.Generation)
+			"The Gateway has not been scheduled by APK Gateway", time.Now(), gw.Generation)
 	}
 }
 
diff --git a/adapter/pkg/health/health.go b/adapter/pkg/health/health.go
index 9edaad386..6c3a7eaab 100644
--- a/adapter/pkg/health/health.go
+++ b/adapter/pkg/health/health.go
@@ -58,6 +58,8 @@ type Server struct {
 
 // Check responds the health check client with health status of the Adapter
 func (s Server) Check(ctx context.Context, request *healthservice.HealthCheckRequest) (*healthservice.HealthCheckResponse, error) {
+	// Debug logs were disabled because they were creating so many unuseful logs currently.
+	// If this is wanted in future, then add them back.
 	// logger.LoggerHealth.Debugf("Querying health state for Adapter service \"%s\"", request.Service)
 	// logger.LoggerHealth.Debugf("Internal health state map: %v", serviceHealthStatus)
 
@@ -69,24 +71,24 @@ func (s Server) Check(ctx context.Context, request *healthservice.HealthCheckReq
 		}
 
 		if isHealthy {
-			logger.LoggerHealth.Debug("Responding health state of Adapter as HEALTHY")
+			// logger.LoggerHealth.Debug("Responding health state of Adapter as HEALTHY")
 			return &healthservice.HealthCheckResponse{Status: healthservice.HealthCheckResponse_SERVING}, nil
 		}
-		logger.LoggerHealth.Debug("Responding health state of Adapter as NOT_HEALTHY")
+		// logger.LoggerHealth.Debug("Responding health state of Adapter as NOT_HEALTHY")
 		return &healthservice.HealthCheckResponse{Status: healthservice.HealthCheckResponse_NOT_SERVING}, nil
 	}
 
 	// health of the component of a server
 	if isHealthy, ok := serviceHealthStatus[request.Service]; ok {
 		if isHealthy {
-			logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as HEALTHY", request.Service)
+			// logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as HEALTHY", request.Service)
 			return &healthservice.HealthCheckResponse{Status: healthservice.HealthCheckResponse_SERVING}, nil
 		}
-		logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as NOT_HEALTHY", request.Service)
+		// logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as NOT_HEALTHY", request.Service)
 		return &healthservice.HealthCheckResponse{Status: healthservice.HealthCheckResponse_NOT_SERVING}, nil
 	}
 
 	// no component found
-	logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as UNKNOWN", request.Service)
+	// logger.LoggerHealth.Debugf("Responding health state of Adapter service \"%s\" as UNKNOWN", request.Service)
 	return &healthservice.HealthCheckResponse{Status: healthservice.HealthCheckResponse_UNKNOWN}, nil
 }

From f90ce462f3068690da5183f546b3702ed4a98d05 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Tue, 13 Aug 2024 14:39:00 +0530
Subject: [PATCH 07/40] Add ext-auth filters to routes that referred from APIs

---
 adapter/internal/operator/gateway-api/api.go  | 97 +++++++++++++++++++
 .../operator/gateway-api/constants.go         |  4 +
 .../internal/operator/gateway-api/contexts.go | 32 +++++-
 .../internal/operator/gateway-api/helpers.go  | 22 +++++
 .../kubernetes/proxy/resource.go              |  8 +-
 .../internal/operator/gateway-api/ir/xds.go   |  5 +
 .../provider/kubernetes/controller.go         | 18 ++++
 .../provider/kubernetes/indexers.go           | 40 ++++++++
 .../gateway-api/provider/kubernetes/routes.go | 19 +++-
 .../internal/operator/gateway-api/resource.go | 17 ++++
 .../operator/gateway-api/translator.go        | 11 ++-
 .../gateway-api/translator/basicauth.go       |  6 +-
 .../gateway-api/translator/cluster.go         |  2 +-
 .../gateway-api/translator/extauth.go         | 32 ++++--
 .../operator/gateway-api/translator/oidc.go   |  8 +-
 .../operator/gateway-api/translator/utils.go  | 70 +++++++++++--
 16 files changed, 361 insertions(+), 30 deletions(-)
 create mode 100644 adapter/internal/operator/gateway-api/api.go
 create mode 100644 adapter/internal/operator/gateway-api/constants.go

diff --git a/adapter/internal/operator/gateway-api/api.go b/adapter/internal/operator/gateway-api/api.go
new file mode 100644
index 000000000..2ae268548
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/api.go
@@ -0,0 +1,97 @@
+/*
+ *  Copyright (c) 2024, WSO2 LLC. (http://www.wso2.org) All Rights Reserved.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file contains code derived from Envoy Gateway,
+ *  https://github.com/envoyproxy/gateway
+ *  and is provided here subject to the following:
+ *  Copyright Project Envoy Gateway Authors
+ *
+ */
+
+package gatewayapi
+
+import (
+	"strings"
+
+	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func (t *Translator) ProcessAPIs(apis []*dpv1alpha2.API, httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, httpRouteContexts []*HTTPRouteContext, resources *Resources, xdsIR XdsIRMap) {
+	for _, api := range apis {
+		// For each API find all the related httproutes. If not found any continue.
+		routeNamespacedNames := make([]string,0) 
+		for _, httpRouteProds := range api.Spec.Production {
+			for _, httpRouteRef := range httpRouteProds.RouteRefs {
+				routeNamespacedNames = append(routeNamespacedNames, types.NamespacedName{
+					Namespace: api.GetNamespace(),
+					Name: httpRouteRef,
+				}.String())
+			}
+		}
+		for _, httpRouteSands := range api.Spec.Sandbox {
+			for _, httpRouteRef := range httpRouteSands.RouteRefs {
+				routeNamespacedNames = append(routeNamespacedNames, types.NamespacedName{
+					Namespace: api.GetNamespace(),
+					Name: httpRouteRef,
+				}.String())
+			}
+		}
+		for _, httpRouteContext := range httpRouteContexts {
+			if !Contains(routeNamespacedNames, GetNamespacedName(httpRouteContext)) {
+				continue
+			}
+			prefix := irRoutePrefix(httpRouteContext)
+			parentRefs := GetParentReferences(httpRouteContext)
+			for _, p := range parentRefs {
+				parentRefCtx := GetRouteParentContext(httpRouteContext, p)
+				gtwCtx := parentRefCtx.GetGateway()
+				if gtwCtx == nil {
+					continue
+				}
+				irKey := t.getIRKey(gtwCtx.Gateway)
+				for _, listener := range parentRefCtx.listeners {
+					irListener := xdsIR[irKey].GetHTTPListener(irListenerName(listener))
+					if irListener != nil {
+						for _, r := range irListener.Routes {
+							if strings.HasPrefix(r.Name, prefix) {
+								extAuth := buildExtAuth()
+								r.ExtAuth = extAuth
+							}
+						}
+					}
+				}
+			}
+		}
+		
+	}
+}
+
+func buildExtAuth() *ir.ExtAuth {
+	grpcExtAuthService := ir.GRPCExtAuthService{
+		Destination: ir.RouteDestination{
+			Name: EXT_AUTH_CLUSTER_NAME,
+		},
+	}
+	flag := true
+	extAuth := &ir.ExtAuth{
+		Name: EXT_AUTH_NAME,
+		GRPC: &grpcExtAuthService,
+		UseBootstrapCluster: &flag,
+	}
+	return extAuth
+}
diff --git a/adapter/internal/operator/gateway-api/constants.go b/adapter/internal/operator/gateway-api/constants.go
new file mode 100644
index 000000000..7d1ec6742
--- /dev/null
+++ b/adapter/internal/operator/gateway-api/constants.go
@@ -0,0 +1,4 @@
+package gatewayapi
+
+const EXT_AUTH_CLUSTER_NAME = "ext-authz"
+const EXT_AUTH_NAME = "ext-authz"
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/contexts.go b/adapter/internal/operator/gateway-api/contexts.go
index 40ab07009..0451156b3 100644
--- a/adapter/internal/operator/gateway-api/contexts.go
+++ b/adapter/internal/operator/gateway-api/contexts.go
@@ -57,6 +57,25 @@ func (g *GatewayContext) ResetListeners() {
 	}
 }
 
+
+
+func (g *GatewayContext) attachEnvoyProxy(resources *Resources) {
+	// if g.Spec.Infrastructure != nil && g.Spec.Infrastructure.ParametersRef != nil && !IsMergeGatewaysEnabled(resources) {
+	// 	ref := g.Spec.Infrastructure.ParametersRef
+	// 	if string(ref.Group) == egv1a1.GroupVersion.Group && ref.Kind == egv1a1.KindEnvoyProxy {
+	// 		ep := resources.GetEnvoyProxy(g.Namespace, ref.Name)
+	// 		if ep != nil {
+	// 			g.envoyProxy = ep
+	// 			return
+	// 		}
+	// 	}
+	// 	// not found, fallthrough to use envoyProxy attached to gatewayclass
+	// }
+
+	// g.envoyProxy = resources.EnvoyProxyForGatewayClass
+}
+
+
 // ListenerContext wraps a Listener and provides helper methods for
 // setting conditions and other status information on the associated
 // Gateway, etc.
@@ -379,6 +398,17 @@ type RouteParentContext struct {
 	listeners            []*ListenerContext
 }
 
+// GetGateway returns the GatewayContext if parent resource is a gateway.
+func (r *RouteParentContext) GetGateway() *GatewayContext {
+	if r == nil || len(r.listeners) == 0 {
+		return nil
+	}
+	gwc := &GatewayContext{
+		Gateway: r.listeners[0].gateway,
+	}
+	return gwc
+}
+
 func (r *RouteParentContext) SetListeners(listeners ...*ListenerContext) {
 	r.listeners = append(r.listeners, listeners...)
 }
@@ -450,4 +480,4 @@ func GetBackendRef(b BackendRefContext) *gwapiv1.BackendRef {
 
 func GetFilters(b BackendRefContext) any {
 	return reflect.ValueOf(b).FieldByName("Filters").Interface()
-}
+}
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/helpers.go b/adapter/internal/operator/gateway-api/helpers.go
index 279d8bc43..e8cb6e550 100644
--- a/adapter/internal/operator/gateway-api/helpers.go
+++ b/adapter/internal/operator/gateway-api/helpers.go
@@ -111,6 +111,10 @@ func KindDerefOr(kind *gwapiv1.Kind, defaultKind string) string {
 	return defaultKind
 }
 
+func irListenerName(listener *ListenerContext) string {
+	return fmt.Sprintf("%s/%s/%s", listener.gateway.Namespace, listener.gateway.Name, listener.Name)
+}
+
 // IsRefToGateway returns whether the provided parent ref is a reference
 // to a Gateway with the given namespace/name, irrespective of whether a
 // section/listener name has been specified (i.e. a parent ref to a listener
@@ -374,6 +378,13 @@ func irRoutePrefix(route RouteContext) string {
 	return fmt.Sprintf("%s/%s/%s/", strings.ToLower(string(GetRouteType(route))), route.GetNamespace(), route.GetName())
 }
 
+func GetNamespacedName(route RouteContext) string {
+	return types.NamespacedName{
+		Namespace: route.GetNamespace(),
+		Name: route.GetName(),
+	}.String()
+}
+
 func irRouteName(route RouteContext, ruleIdx, matchIdx int) string {
 	return fmt.Sprintf("%srule/%d/match/%d", irRoutePrefix(route), ruleIdx, matchIdx)
 }
@@ -459,3 +470,14 @@ func listenersWithSameHTTPPort(xdsIR *ir.Xds, listener *ir.HTTPListener) []strin
 	}
 	return res
 }
+
+// contains checks if a specific string exists in the provided slice of strings.
+// It returns true if the string is found, and false otherwise.
+func Contains(slice []string, item string) bool {
+    for _, v := range slice {
+        if v == item {
+            return true
+        }
+    }
+    return false
+}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 55fa4f8cb..930bd8379 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -140,7 +140,13 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 			ports = append(ports, port)
 		}
 	}
-
+	port := corev1.ContainerPort{
+		// hashed container port name including up to the 6 characters of the port name and the maximum of 15 characters.
+		Name:          "admin",
+		ContainerPort: 9000,
+		Protocol:      "TCP",
+	}
+	ports = append(ports, port)
 	if enablePrometheus(infra) {
 		ports = append(ports, corev1.ContainerPort{
 			Name:          "metrics",
diff --git a/adapter/internal/operator/gateway-api/ir/xds.go b/adapter/internal/operator/gateway-api/ir/xds.go
index 1aed17f89..8936fc963 100644
--- a/adapter/internal/operator/gateway-api/ir/xds.go
+++ b/adapter/internal/operator/gateway-api/ir/xds.go
@@ -582,6 +582,10 @@ type BasicAuth struct {
 //
 // +k8s:deepcopy-gen=true
 type ExtAuth struct {
+	// Name is a unique name for an ExtAuth configuration.
+	// The xds translator only generates one external authorization filter for each unique name.
+	Name string `json:"name" yaml:"name"`
+
 	// GRPC defines the gRPC External Authorization service.
 	// Only one of GRPCService or HTTPService may be specified.
 	GRPC *GRPCExtAuthService `json:"grpc,omitempty"`
@@ -602,6 +606,7 @@ type ExtAuth struct {
 	// in HeadersToExtAuth or not.
 	// +optional
 	HeadersToExtAuth []string `json:"headersToExtAuth,omitempty"`
+	UseBootstrapCluster *bool  `json:"useBootstrapCluster,omitempty"`
 }
 
 // HTTPExtAuthService defines the HTTP External Authorization service
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index b0400864f..f0cdff74d 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -52,6 +52,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 )
 
 type gatewayReconcilerNew struct {
@@ -69,6 +70,8 @@ type resourceMappings struct {
 	allAssociatedNamespaces map[string]struct{}
 	// Map for storing backendRefs' NamespaceNames referred by various Route objects.
 	allAssociatedBackendRefs map[gwapiv1.BackendObjectReference]struct{}
+	// Map for storing APIs NamespaceNames
+	allAssociatedAPIs map[*dpv1alpha1.API]struct{}
 	// extensionRefFilters is a map of filters managed by an extension.
 	// The key is the namespaced name of the filter and the value is the
 	// unstructured form of the resource.
@@ -405,6 +408,19 @@ func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.M
 		return err
 	}
 
+	// Watch API CRUDs and process affected Gateways.
+	apiPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &dpv1alpha2.API{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		apiPredicates...,
+	); err != nil {
+		return err
+	}
+	if err := addAPIIndexers(ctx, mgr); err != nil {
+		return err
+	}
+
 	// // Watch GRPCRoute CRUDs and process affected Gateways.
 	// grpcrPredicates := []predicate.Predicate{predicate.GenerationChangedPredicate{}}
 	// if err := c.Watch(
@@ -612,6 +628,8 @@ func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.M
 	// 	}
 	// 	loggers.LoggerAPKOperator.Info("Watching additional resource", "resource", gvk.String())
 	// }
+
+	
 	return nil
 }
 
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
index 620c75089..578170f32 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
@@ -27,6 +27,7 @@ import (
 
 	"github.com/wso2/apk/adapter/internal/loggers"
 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
@@ -39,6 +40,7 @@ const (
 	classGatewayIndex          = "classGatewayIndex"
 	gatewayTLSRouteIndex       = "gatewayTLSRouteIndex"
 	gatewayHTTPRouteIndex      = "gatewayHTTPRouteIndex"
+	httpRouteAPIIndex          = "httpRouteAPIIndex"
 	gatewayGRPCRouteIndex      = "gatewayGRPCRouteIndex"
 	gatewayTCPRouteIndex       = "gatewayTCPRouteIndex"
 	gatewayUDPRouteIndex       = "gatewayUDPRouteIndex"
@@ -83,6 +85,16 @@ func addHTTPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
 	return mgr.GetFieldIndexer().IndexField(ctx, &gwapiv1.HTTPRoute{}, serviceHTTPRouteIndex, serviceHTTPRouteIndexFunc)
 }
 
+// addAPIIndexers adds indexing on API.
+//   - For Service, ServiceImports objects that are referenced in HTTPRoute objects via `.spec.rules.backendRefs`.
+//     This helps in querying for HTTPRoutes that are affected by a particular Service CRUD.
+func addAPIIndexers(ctx context.Context, mgr manager.Manager) error {
+	if err := mgr.GetFieldIndexer().IndexField(ctx, &dpv1alpha2.API{}, httpRouteAPIIndex, httpRouteAPIIndexFunc); err != nil {
+		return err
+	}
+	return nil
+}
+
 func gatewayHTTPRouteIndexFunc(rawObj client.Object) []string {
 	httproute := rawObj.(*gwapiv1.HTTPRoute)
 	var gateways []string
@@ -101,6 +113,34 @@ func gatewayHTTPRouteIndexFunc(rawObj client.Object) []string {
 	return gateways
 }
 
+func httpRouteAPIIndexFunc(rawObj client.Object) []string {
+	api := rawObj.(*dpv1alpha2.API)
+	var httpRoutes []string
+	if len(api.Spec.Production) > 0 {
+		for _, ref := range api.Spec.Production[0].RouteRefs {
+			if ref != "" {
+				httpRoutes = append(httpRoutes,
+					types.NamespacedName{
+						Namespace: api.Namespace,
+						Name:      ref,
+					}.String())
+			}
+		}
+	}
+	if len(api.Spec.Sandbox) > 0 {
+		for _, ref := range api.Spec.Sandbox[0].RouteRefs {
+			if ref != "" {
+				httpRoutes = append(httpRoutes,
+					types.NamespacedName{
+						Namespace: api.Namespace,
+						Name:      ref,
+					}.String())
+			}
+		}
+	}
+	return httpRoutes
+}
+
 func serviceHTTPRouteIndexFunc(rawObj client.Object) []string {
 	httproute := rawObj.(*gwapiv1.HTTPRoute)
 	var backendRefs []string
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
index c63353bf6..ad32f43cc 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -27,6 +27,7 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 )
 
 // processHTTPRoutes finds HTTPRoutes corresponding to a gatewayNamespaceName, further checks for
@@ -183,7 +184,23 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 		// It will be recomputed by the gateway-api layer
 		httpRoute.Status = gwapiv1.HTTPRouteStatus{}
 		resourceTree.HTTPRoutes = append(resourceTree.HTTPRoutes, &httpRoute)
-	}
 
+		// Add APIs to resource tree
+		apiList := &dpv1alpha2.APIList{}
+		if err := r.client.List(ctx, apiList, &client.ListOptions{
+			FieldSelector: fields.OneTermEqualSelector(httpRouteAPIIndex, types.NamespacedName{
+				Namespace: httpRoute.GetNamespace(),
+				Name:      httpRoute.GetName(),
+			}.String()),
+		}); err != nil {
+			loggers.LoggerAPKOperator.Error("Failed to list APIs", err)
+			return err
+		}
+
+		for _, api := range apiList.Items {
+			resourceTree.APIs = append(resourceTree.APIs, &api)
+		}
+	}
+	resourceTree.APIs = gatewayapi.RemoveDuplicates(resourceTree.APIs)
 	return nil
 }
diff --git a/adapter/internal/operator/gateway-api/resource.go b/adapter/internal/operator/gateway-api/resource.go
index 7e407b0d3..600d2d529 100644
--- a/adapter/internal/operator/gateway-api/resource.go
+++ b/adapter/internal/operator/gateway-api/resource.go
@@ -28,6 +28,7 @@ import (
 
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
 	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	"golang.org/x/exp/slices"
 	v1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
@@ -62,6 +63,7 @@ type Resources struct {
 	ConfigMaps          []*v1.ConfigMap               `json:"configMaps,omitempty" yaml:"configMaps,omitempty"`
 	ExtensionRefFilters []unstructured.Unstructured   `json:"extensionRefFilters,omitempty" yaml:"extensionRefFilters,omitempty"`
 	BackendTLSPolicies  []*gwapiv1a2.BackendTLSPolicy `json:"backendTLSPolicies,omitempty" yaml:"backendTLSPolicies,omitempty"`
+	APIs                []*dpv1alpha2.API             `json:"apis,omitempty" yaml:"apis,omitempty"`
 }
 
 func NewResources() *Resources {
@@ -78,6 +80,7 @@ func NewResources() *Resources {
 		Namespaces:          []*v1.Namespace{},
 		ExtensionRefFilters: []unstructured.Unstructured{},
 		BackendTLSPolicies:  []*gwapiv1a2.BackendTLSPolicy{},
+		APIs:                []*dpv1alpha2.API{},
 	}
 }
 
@@ -166,3 +169,17 @@ func (r *Resources) GetEndpointSlicesForBackend(svcNamespace, svcName string, ba
 	}
 	return endpointSlices
 }
+
+// RemoveDuplicates removes duplicate APIs from the list
+func RemoveDuplicates(apis []*dpv1alpha2.API) []*dpv1alpha2.API {
+	uniqueAPIs := make(map[*dpv1alpha2.API]struct{})
+	result := []*dpv1alpha2.API{}
+
+	for _, api := range apis {
+			if _, exists := uniqueAPIs[api]; !exists {
+					uniqueAPIs[api] = struct{}{}
+					result = append(result, api)
+			}
+	}
+	return result
+}
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/translator.go b/adapter/internal/operator/gateway-api/translator.go
index 90b54a421..4fd2cfe3e 100644
--- a/adapter/internal/operator/gateway-api/translator.go
+++ b/adapter/internal/operator/gateway-api/translator.go
@@ -177,11 +177,10 @@ func (t *Translator) Translate(resources *Resources) *TranslateResult {
 	// // Process all relevant UDPRoutes.
 	// udpRoutes := t.ProcessUDPRoutes(resources.UDPRoutes, gateways, resources, xdsIR)
 
-	// Process BackendTrafficPolicies
-	// routes := []RouteContext{}
-	// for _, h := range httpRoutes {
-	// 	routes = append(routes, h)
-	// }
+	routes := []RouteContext{}
+	for _, h := range httpRoutes {
+		routes = append(routes, h)
+	}
 	// for _, g := range grpcRoutes {
 	// 	routes = append(routes, g)
 	// }
@@ -203,6 +202,8 @@ func (t *Translator) Translate(resources *Resources) *TranslateResult {
 	// securityPolicies := t.ProcessSecurityPolicies(
 	// 	resources.SecurityPolicies, gateways, routes, resources, xdsIR)
 
+	t.ProcessAPIs(resources.APIs, resources.HTTPRoutes, gateways, httpRoutes, resources, xdsIR)
+
 	// Sort xdsIR based on the Gateway API spec
 	sortXdsIRMap(xdsIR)
 
diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
index 5fd4932f9..4d88a2790 100644
--- a/adapter/internal/operator/gateway-api/translator/basicauth.go
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -145,5 +145,9 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 	if irRoute.BasicAuth == nil {
 		return nil
 	}
-	return enableFilterOnRoute(basicAuthFilter, route, irRoute)
+	filterName := basicAuthFilterName(irRoute)
+	if err := enableFilterOnRoute(route, filterName); err != nil {
+		return err
+	}
+	return nil
 }
diff --git a/adapter/internal/operator/gateway-api/translator/cluster.go b/adapter/internal/operator/gateway-api/translator/cluster.go
index fe29398cf..f4fc1f270 100644
--- a/adapter/internal/operator/gateway-api/translator/cluster.go
+++ b/adapter/internal/operator/gateway-api/translator/cluster.go
@@ -387,7 +387,7 @@ func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.Destin
 						},
 					},
 				},
-			}
+			}	
 		}
 
 		for _, irEp := range ds.Endpoints {
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index c50c584cf..b11f20a0b 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -71,7 +71,14 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 			continue
 		}
 
-		filter, err := buildHCMExtAuthFilter(route)
+		// Only generates one OAuth2 Envoy filter for each unique name.
+		// For example, if there are two routes under the same gateway with the
+		// same OIDC config, only one OAuth2 filter will be generated.
+		if hcmContainsFilter(mgr, extAuthFilterName(route.ExtAuth)) {
+			continue
+		}
+
+		filter, err := buildHCMExtAuthFilter(route.ExtAuth)
 		if err != nil {
 			errs = errors.Join(errs, err)
 			continue
@@ -84,8 +91,8 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 }
 
 // buildHCMExtAuthFilter returns an ext_authz HTTP filter from the provided IR HTTPRoute.
-func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
-	extAuthProto := extAuthConfig(route.ExtAuth)
+func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
+	extAuthProto := extAuthConfig(extAuth)
 	if err := extAuthProto.ValidateAll(); err != nil {
 		return nil, err
 	}
@@ -96,7 +103,7 @@ func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name:     extAuthFilterName(route),
+		Name:     extAuthFilterName(extAuth),
 		Disabled: true,
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
@@ -104,8 +111,8 @@ func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
 	}, nil
 }
 
-func extAuthFilterName(route *ir.HTTPRoute) string {
-	return perRouteFilterName(extAuthFilter, route.Name)
+func extAuthFilterName(extAuth *ir.ExtAuth) string {
+	return perRouteFilterName(extAuthFilter, extAuth.Name)
 }
 
 func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
@@ -141,7 +148,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 				},
 				Timeout: &duration.Duration{
 					Seconds: defaultExtServiceRequestTimeout,
-				},
+				},	
 			},
 		}
 	}
@@ -229,7 +236,10 @@ func (*extAuth) patchResources(tCtx *types.ResourceVersionTable,
 
 	var errs error
 	for _, route := range routes {
-		if !routeContainsExtAuth(route) {
+		if !routeContainsExtAuth(route)  {
+			continue
+		}
+		if route.ExtAuth.UseBootstrapCluster != nil && *route.ExtAuth.UseBootstrapCluster {
 			continue
 		}
 		if route.ExtAuth.HTTP != nil {
@@ -296,5 +306,9 @@ func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	if irRoute.ExtAuth == nil {
 		return nil
 	}
-	return enableFilterOnRoute(extAuthFilter, route, irRoute)
+	// filterName := extAuthFilterName(irRoute.ExtAuth)
+	if err := enableExtAuthFilterOnRoute(route, extAuthFilter); err != nil {
+		return err
+	}
+	return nil
 }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
index 08d87017f..07265ef72 100644
--- a/adapter/internal/operator/gateway-api/translator/oidc.go
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -112,7 +112,7 @@ func buildHCMOAuth2Filter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
 }
 
 func oauth2FilterName(route *ir.HTTPRoute) string {
-	return fmt.Sprintf("%s_%s", oauth2Filter, route.Name)
+	return perRouteFilterName(oauth2Filter, route.Name)
 }
 
 func oauth2Config(route *ir.HTTPRoute) (*oauth2v3.OAuth2, error) {
@@ -356,7 +356,11 @@ func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		return nil
 	}
 
-	return enableFilterOnRoute(oauth2Filter, route, irRoute)
+	filterName := oauth2FilterName(irRoute)
+	if err := enableFilterOnRoute(route, filterName); err != nil {
+		return err
+	}
+	return nil
 }
 
 // buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle
diff --git a/adapter/internal/operator/gateway-api/translator/utils.go b/adapter/internal/operator/gateway-api/translator/utils.go
index 90f1d3882..83b0b7b41 100644
--- a/adapter/internal/operator/gateway-api/translator/utils.go
+++ b/adapter/internal/operator/gateway-api/translator/utils.go
@@ -31,8 +31,23 @@ import (
 	"strings"
 
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
-	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+	extAuthService "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
 	"google.golang.org/protobuf/types/known/anypb"
+	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
+)
+
+// Context Extensions which are set in ExtAuthzPerRoute Config
+// These values are shared between the adapter and enforcer, hence if it is required to change
+// these values, modifications should be done in the both adapter and enforcer.
+const (
+	pathContextExtension            string = "path"
+	vHostContextExtension           string = "vHost"
+	basePathContextExtension        string = "basePath"
+	methodContextExtension          string = "method"
+	apiVersionContextExtension      string = "version"
+	apiNameContextExtension         string = "name"
+	clusterNameContextExtension     string = "clusterName"
+	retryPolicyRetriableStatusCodes string = "retriable-status-codes"
 )
 
 const (
@@ -96,21 +111,17 @@ func clusterName(host string, port uint32) string {
 }
 
 // enableFilterOnRoute enables a filterType on the provided route.
-func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HTTPRoute) error {
+func enableFilterOnRoute(route *routev3.Route, filterName string) error {
 	if route == nil {
 		return errors.New("xds route is nil")
 	}
-	if irRoute == nil {
-		return errors.New("ir route is nil")
-	}
 
-	filterName := perRouteFilterName(filterType, irRoute.Name)
 	filterCfg := route.GetTypedPerFilterConfig()
 	if _, ok := filterCfg[filterName]; ok {
 		// This should not happen since this is the only place where the filter
 		// config is added in a route.
 		return fmt.Errorf("route already contains filter config: %s, %+v",
-			filterType, route)
+			filterName, route)
 	}
 
 	// Enable the corresponding filter for this route.
@@ -120,16 +131,57 @@ func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HT
 	if err != nil {
 		return err
 	}
-
 	if filterCfg == nil {
 		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 	}
-
 	route.TypedPerFilterConfig[filterName] = routeCfgAny
+	return nil
+}
 
+// enableFilterOnRoute enables a filterType on the provided route.
+func enableExtAuthFilterOnRoute(route *routev3.Route, filterName string) error {
+	if route == nil {
+		return errors.New("xds route is nil")
+	}
+
+	filterCfg := route.GetTypedPerFilterConfig()
+	if _, ok := filterCfg[filterName]; ok {
+		// This should not happen since this is the only place where the filter
+		// config is added in a route.
+		return fmt.Errorf("route already contains filter config: %s, %+v",
+			filterName, route)
+	}
+	contextExtensions := make(map[string]string)
+	extAuthPerFilterConfig := &extAuthService.ExtAuthzPerRoute{
+		Override: &extAuthService.ExtAuthzPerRoute_CheckSettings{
+			CheckSettings: &extAuthService.CheckSettings{
+				ContextExtensions: contextExtensions,
+				// negation is performing to match the envoy config name (disable_request_body_buffering)
+				// DisableRequestBodyBuffering: !params.passRequestPayloadToEnforcer,
+			},
+		},
+	}
+	// Enable the corresponding filter for this route.
+	routeCfgAny, err := anypb.New(extAuthPerFilterConfig)
+	if err != nil {
+		return err
+	}
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	}
+	route.TypedPerFilterConfig[filterName] = routeCfgAny
 	return nil
 }
 
 func perRouteFilterName(filterType, routeName string) string {
 	return fmt.Sprintf("%s_%s", filterType, routeName)
 }
+
+func hcmContainsFilter(mgr *hcmv3.HttpConnectionManager, filterName string) bool {
+	for _, existingFilter := range mgr.HttpFilters {
+		if existingFilter.Name == filterName {
+			return true
+		}
+	}
+	return false
+}

From c2bdf1aa22de51894f4474a9017e8cd97a2e226a Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Tue, 13 Aug 2024 14:39:30 +0530
Subject: [PATCH 08/40] draft commit with helper changes

---
 adapter/build.gradle           |     4 +-
 adapter/down.sh                |     3 +
 adapter/dup.sh                 |     2 +
 adapter/notes.md               |    39 +
 adapter/test copy.json         |  3124 ++++++++
 adapter/test.json              | 12500 +++++++++++++++++++++++++++++++
 adapter/test.yaml              |    92 +
 common-controller/build.gradle |     4 +-
 common-controller/go.mod       |     9 +-
 common-controller/go.sum       |    22 +-
 10 files changed, 15778 insertions(+), 21 deletions(-)
 create mode 100755 adapter/down.sh
 create mode 100755 adapter/dup.sh
 create mode 100644 adapter/notes.md
 create mode 100644 adapter/test copy.json
 create mode 100644 adapter/test.json
 create mode 100644 adapter/test.yaml

diff --git a/adapter/build.gradle b/adapter/build.gradle
index e3b674c40..d443b792d 100644
--- a/adapter/build.gradle
+++ b/adapter/build.gradle
@@ -68,8 +68,8 @@ tasks.named('go_revive_run').configure {
 }
 
 tasks.named('go_build').configure {
-    dependsOn go_revive_run
-    dependsOn go_vet
+    // dependsOn go_revive_run
+    // dependsOn go_vet
     println("Running go build")
     finalizedBy docker_build
 }
diff --git a/adapter/down.sh b/adapter/down.sh
new file mode 100755
index 000000000..2f52ab262
--- /dev/null
+++ b/adapter/down.sh
@@ -0,0 +1,3 @@
+kubectl scale deployment --replicas=0  -n apk apk-test-wso2-apk-adapter-deployment
+./gradlew build
+watch -n 1 minikube image rm apk-adapter:1.1.0-SNAPSHOT
\ No newline at end of file
diff --git a/adapter/dup.sh b/adapter/dup.sh
new file mode 100755
index 000000000..1b7d8944c
--- /dev/null
+++ b/adapter/dup.sh
@@ -0,0 +1,2 @@
+minikube image load apk-adapter:1.1.0-SNAPSHOT
+kubectl scale deployment --replicas=1 -n apk apk-test-wso2-apk-adapter-deployment
diff --git a/adapter/notes.md b/adapter/notes.md
new file mode 100644
index 000000000..2fd1ecb7a
--- /dev/null
+++ b/adapter/notes.md
@@ -0,0 +1,39 @@
+func getHTTPFilters(globalLuaScript string) []*hcmv3.HttpFilter {
+
+ r.ProviderResources.GatewayAPIResources.Subscribe(ctx),
+ 
+  buildXdsTCPListener(name, address string, port uint32, k
+  
+func (t *Translator) addXdsHTTPFilterChain(xdsListener *listenerv3.Listener,
+
+
+func (t *Translator) buildExtAuth(policy *egv1a1.SecurityPolicy, resources *Resources, envoyProxy *egv1a1.EnvoyProxy) (*ir.ExtAuth, error) {
+	// create a function like this and hard code the enforcer cluster and add this to the ir.httproute
+	
+irRoute := &ir.HTTPRoute{
+			Name: irRouteName(httpRoute, ruleIdx, matchIdx),
+		}
+		
+		
+Create a method name processAPI 
+in this function pass 
+securityPolicies []*API,
+	gateways []*GatewayContext,
+	routes []RouteContext,
+	resources *Resources,
+	xdsIR XdsIRMap,
+	
+
+loop through all targeted httproute refs in each API. find the correct irRoutes using this approach 
+
+irListener := xdsIR[irKey].GetHTTPListener(irListenerName(listener))
+			if irListener != nil {
+				for _, r := range irListener.Routes {
+					if strings.HasPrefix(r.Name, prefix) {
+
+now add the extAuth to all the matching irRoutes
+
+
+func enableFilterOnRoute(route *routev3.Route, filterName string) error {
+
+k delete httproute apk-test-wso2-apk-authentication-endpoint-ds-httproute apk-test-wso2-apk-commonoauth-ds-httproute apk-test-wso2-apk-config-deploy-api-route apk-test-wso2-apk-jwks-endpoint-ds-httproute apk-test-wso2-apk-dcr-ds-httproute apk-test-wso2-apk-oauth-ds-httproute -n apk
diff --git a/adapter/test copy.json b/adapter/test copy.json
new file mode 100644
index 000000000..e8740719b
--- /dev/null
+++ b/adapter/test copy.json	
@@ -0,0 +1,3124 @@
+{
+ "configs": [
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
+   "bootstrap": {
+    "node": {
+     "user_agent_name": "envoy",
+     "user_agent_build_version": {
+      "version": {
+       "major_number": 1,
+       "minor_number": 29,
+       "patch": 3
+      },
+      "metadata": {
+       "build.type": "RELEASE",
+       "ssl.version": "BoringSSL",
+       "revision.status": "Clean",
+       "revision.sha": "10e1e425fd84cc2cde985179655da08f68c9cb30"
+      }
+     },
+     "extensions": [
+      {
+       "name": "envoy.udp_packet_writer.default",
+       "category": "envoy.udp_packet_writer",
+       "type_urls": [
+        "envoy.extensions.udp_packet_writer.v3.UdpDefaultWriterFactory"
+       ]
+      },
+      {
+       "name": "envoy.udp_packet_writer.gso",
+       "category": "envoy.udp_packet_writer",
+       "type_urls": [
+        "envoy.extensions.udp_packet_writer.v3.UdpGsoBatchWriterFactory"
+       ]
+      },
+      {
+       "name": "envoy.route.early_data_policy.default",
+       "category": "envoy.route.early_data_policy",
+       "type_urls": [
+        "envoy.extensions.early_data.v3.DefaultEarlyDataPolicy"
+       ]
+      },
+      {
+       "name": "envoy.bandwidth_limit",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.buffer",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.cors",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.csrf",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.ext_authz",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.ext_proc",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.fault",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.filters.http.adaptive_concurrency",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.adaptive_concurrency.v3.AdaptiveConcurrency"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.admission_control",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.alternate_protocols_cache",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.alternate_protocols_cache.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.aws_lambda",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.aws_lambda.v3.Config",
+        "envoy.extensions.filters.http.aws_lambda.v3.PerRouteConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.aws_request_signing",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigning",
+        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigningPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.bandwidth_limit",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.bandwidth_limit.v3.BandwidthLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.basic_auth",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.basic_auth.v3.BasicAuth"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.buffer",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.buffer.v3.Buffer",
+        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.cache",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.cache.v3.CacheConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.cdn_loop",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.cdn_loop.v3.CdnLoopConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.composite",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.composite.v3.Composite"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.compressor",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.compressor.v3.Compressor",
+        "envoy.extensions.filters.http.compressor.v3.CompressorPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.connect_grpc_bridge",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.cors",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.cors.v3.Cors",
+        "envoy.extensions.filters.http.cors.v3.CorsPolicy"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.csrf",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.csrf.v3.CsrfPolicy"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.custom_response",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.custom_response.v3.CustomResponse"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.decompressor",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.decompressor.v3.Decompressor"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.dynamic_forward_proxy",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig",
+        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.ext_authz",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.ext_proc",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.ext_proc.v3.ExtProcPerRoute",
+        "envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.fault",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.fault.v3.HTTPFault"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.file_system_buffer",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.file_system_buffer.v3.FileSystemBufferFilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.gcp_authn",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.geoip",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.geoip.v3.Geoip"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_field_extraction",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_field_extraction.v3.GrpcFieldExtractionConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_http1_bridge",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_http1_reverse_bridge",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig",
+        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_json_transcoder",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_stats",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_stats.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.grpc_web",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.header_mutation",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
+        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.header_to_metadata",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.header_to_metadata.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.health_check",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.health_check.v3.HealthCheck"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.ip_tagging",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.ip_tagging.v3.IPTagging"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.json_to_metadata",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.json_to_metadata.v3.JsonToMetadata"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.jwt_authn",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication",
+        "envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.local_ratelimit",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.lua",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.lua.v3.Lua",
+        "envoy.extensions.filters.http.lua.v3.LuaPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.match_delegate",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.common.matching.v3.ExtensionWithMatcher",
+        "envoy.extensions.common.matching.v3.ExtensionWithMatcherPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.oauth2",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.oauth2.v3.OAuth2"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.on_demand",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.on_demand.v3.OnDemand",
+        "envoy.extensions.filters.http.on_demand.v3.PerRouteConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.original_src",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.original_src.v3.OriginalSrc"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.rate_limit_quota",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaFilterConfig",
+        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.ratelimit",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+        "envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.rbac",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.rbac.v3.RBAC",
+        "envoy.extensions.filters.http.rbac.v3.RBACPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.router",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.router.v3.Router"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.set_filter_state",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.set_filter_state.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.set_metadata",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.set_metadata.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.stateful_session",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.stateful_session.v3.StatefulSession",
+        "envoy.extensions.filters.http.stateful_session.v3.StatefulSessionPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.tap",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.tap.v3.Tap"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.wasm",
+       "category": "envoy.filters.http",
+       "type_urls": [
+        "envoy.extensions.filters.http.wasm.v3.Wasm"
+       ]
+      },
+      {
+       "name": "envoy.geoip",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.grpc_http1_bridge",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.grpc_json_transcoder",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.grpc_web",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.health_check",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.ip_tagging",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.local_rate_limit",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.lua",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.rate_limit",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.router",
+       "category": "envoy.filters.http"
+      },
+      {
+       "name": "envoy.config.validators.minimum_clusters",
+       "category": "envoy.config.validators"
+      },
+      {
+       "name": "envoy.config.validators.minimum_clusters_validator",
+       "category": "envoy.config.validators",
+       "type_urls": [
+        "envoy.extensions.config.validators.minimum_clusters.v3.MinimumClustersValidator"
+       ]
+      },
+      {
+       "name": "envoy.matching.matchers.cel_matcher",
+       "category": "envoy.matching.input_matchers",
+       "type_urls": [
+        "xds.type.matcher.v3.CelMatcher"
+       ]
+      },
+      {
+       "name": "envoy.matching.matchers.consistent_hashing",
+       "category": "envoy.matching.input_matchers",
+       "type_urls": [
+        "envoy.extensions.matching.input_matchers.consistent_hashing.v3.ConsistentHashing"
+       ]
+      },
+      {
+       "name": "envoy.matching.matchers.ip",
+       "category": "envoy.matching.input_matchers",
+       "type_urls": [
+        "envoy.extensions.matching.input_matchers.ip.v3.Ip"
+       ]
+      },
+      {
+       "name": "envoy.matching.matchers.runtime_fraction",
+       "category": "envoy.matching.input_matchers",
+       "type_urls": [
+        "envoy.extensions.matching.input_matchers.runtime_fraction.v3.RuntimeFraction"
+       ]
+      },
+      {
+       "name": "envoy.config_mux.delta_grpc_mux_factory",
+       "category": "envoy.config_mux"
+      },
+      {
+       "name": "envoy.config_mux.grpc_mux_factory",
+       "category": "envoy.config_mux"
+      },
+      {
+       "name": "envoy.config_mux.new_grpc_mux_factory",
+       "category": "envoy.config_mux"
+      },
+      {
+       "name": "envoy.config_mux.sotw_grpc_mux_factory",
+       "category": "envoy.config_mux"
+      },
+      {
+       "name": "envoy.filters.listener.original_dst.local_ip",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.filters.listener.original_dst.remote_ip",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.network.application_protocols",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.network.transport_socket.original_dst_address",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.network.upstream_server_name",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.network.upstream_subject_alt_names",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.string",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.tcp_proxy.cluster",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.tcp_proxy.disable_tunneling",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.upstream.dynamic_host",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.upstream.dynamic_port",
+       "category": "filter_state.object"
+      },
+      {
+       "name": "envoy.watchdog.abort_action",
+       "category": "envoy.guarddog_actions",
+       "type_urls": [
+        "envoy.watchdog.v3.AbortActionConfig"
+       ]
+      },
+      {
+       "name": "envoy.watchdog.profile_action",
+       "category": "envoy.guarddog_actions",
+       "type_urls": [
+        "envoy.extensions.watchdog.profile_action.v3.ProfileActionConfig"
+       ]
+      },
+      {
+       "name": "envoy.dog_statsd",
+       "category": "envoy.stats_sinks"
+      },
+      {
+       "name": "envoy.graphite_statsd",
+       "category": "envoy.stats_sinks"
+      },
+      {
+       "name": "envoy.metrics_service",
+       "category": "envoy.stats_sinks"
+      },
+      {
+       "name": "envoy.open_telemetry_stat_sink",
+       "category": "envoy.stats_sinks"
+      },
+      {
+       "name": "envoy.stat_sinks.dog_statsd",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.config.metrics.v3.DogStatsdSink"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.graphite_statsd",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.extensions.stat_sinks.graphite_statsd.v3.GraphiteStatsdSink"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.hystrix",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.config.metrics.v3.HystrixSink"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.metrics_service",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.config.metrics.v3.MetricsServiceConfig"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.open_telemetry",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.statsd",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.config.metrics.v3.StatsdSink"
+       ]
+      },
+      {
+       "name": "envoy.stat_sinks.wasm",
+       "category": "envoy.stats_sinks",
+       "type_urls": [
+        "envoy.extensions.stat_sinks.wasm.v3.Wasm"
+       ]
+      },
+      {
+       "name": "envoy.statsd",
+       "category": "envoy.stats_sinks"
+      },
+      {
+       "name": "envoy.health_check.event_sink.file",
+       "category": "envoy.health_check.event_sinks",
+       "type_urls": [
+        "envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink"
+       ]
+      },
+      {
+       "name": "default",
+       "category": "network.connection.client"
+      },
+      {
+       "name": "envoy_internal",
+       "category": "network.connection.client"
+      },
+      {
+       "name": "envoy.matching.common_inputs.environment_variable",
+       "category": "envoy.matching.common_inputs",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.environment_variable.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.extensions.http.custom_response.local_response_policy",
+       "category": "envoy.http.custom_response",
+       "type_urls": [
+        "envoy.extensions.http.custom_response.local_response_policy.v3.LocalResponsePolicy"
+       ]
+      },
+      {
+       "name": "envoy.extensions.http.custom_response.redirect_policy",
+       "category": "envoy.http.custom_response",
+       "type_urls": [
+        "envoy.extensions.http.custom_response.redirect_policy.v3.RedirectPolicy"
+       ]
+      },
+      {
+       "name": "envoy.retry_priorities.previous_priorities",
+       "category": "envoy.retry_priorities",
+       "type_urls": [
+        "envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.dubbo.router",
+       "category": "envoy.dubbo_proxy.filters",
+       "type_urls": [
+        "envoy.extensions.filters.network.dubbo_proxy.router.v3.Router"
+       ]
+      },
+      {
+       "name": "envoy.health_checkers.grpc",
+       "category": "envoy.health_checkers",
+       "type_urls": [
+        "envoy.config.core.v3.HealthCheck.GrpcHealthCheck"
+       ]
+      },
+      {
+       "name": "envoy.health_checkers.http",
+       "category": "envoy.health_checkers",
+       "type_urls": [
+        "envoy.config.core.v3.HealthCheck.HttpHealthCheck"
+       ]
+      },
+      {
+       "name": "envoy.health_checkers.redis",
+       "category": "envoy.health_checkers",
+       "type_urls": [
+        "envoy.extensions.health_checkers.redis.v3.Redis"
+       ]
+      },
+      {
+       "name": "envoy.health_checkers.tcp",
+       "category": "envoy.health_checkers",
+       "type_urls": [
+        "envoy.config.core.v3.HealthCheck.TcpHealthCheck"
+       ]
+      },
+      {
+       "name": "envoy.health_checkers.thrift",
+       "category": "envoy.health_checkers",
+       "type_urls": [
+        "envoy.extensions.health_checkers.thrift.v3.Thrift"
+       ]
+      },
+      {
+       "name": "envoy.extensions.http.cache.file_system_http_cache",
+       "category": "envoy.http.cache",
+       "type_urls": [
+        "envoy.extensions.http.cache.file_system_http_cache.v3.FileSystemHttpCacheConfig"
+       ]
+      },
+      {
+       "name": "envoy.extensions.http.cache.simple",
+       "category": "envoy.http.cache",
+       "type_urls": [
+        "envoy.extensions.http.cache.simple_http_cache.v3.SimpleHttpCacheConfig"
+       ]
+      },
+      {
+       "name": "envoy.grpc_credentials.aws_iam",
+       "category": "envoy.grpc_credentials"
+      },
+      {
+       "name": "envoy.grpc_credentials.default",
+       "category": "envoy.grpc_credentials"
+      },
+      {
+       "name": "envoy.grpc_credentials.file_based_metadata",
+       "category": "envoy.grpc_credentials"
+      },
+      {
+       "name": "envoy.bootstrap.internal_listener",
+       "category": "envoy.bootstrap",
+       "type_urls": [
+        "envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
+       ]
+      },
+      {
+       "name": "envoy.bootstrap.wasm",
+       "category": "envoy.bootstrap",
+       "type_urls": [
+        "envoy.extensions.wasm.v3.WasmService"
+       ]
+      },
+      {
+       "name": "envoy.extensions.network.socket_interface.default_socket_interface",
+       "category": "envoy.bootstrap",
+       "type_urls": [
+        "envoy.extensions.network.socket_interface.v3.DefaultSocketInterface"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.http_inspector",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.http_inspector.v3.HttpInspector"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.local_ratelimit",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.original_dst",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.original_src",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.original_src.v3.OriginalSrc"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.proxy_protocol",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
+       ]
+      },
+      {
+       "name": "envoy.filters.listener.tls_inspector",
+       "category": "envoy.filters.listener",
+       "type_urls": [
+        "envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+       ]
+      },
+      {
+       "name": "envoy.listener.http_inspector",
+       "category": "envoy.filters.listener"
+      },
+      {
+       "name": "envoy.listener.original_dst",
+       "category": "envoy.filters.listener"
+      },
+      {
+       "name": "envoy.listener.original_src",
+       "category": "envoy.filters.listener"
+      },
+      {
+       "name": "envoy.listener.proxy_protocol",
+       "category": "envoy.filters.listener"
+      },
+      {
+       "name": "envoy.listener.tls_inspector",
+       "category": "envoy.filters.listener"
+      },
+      {
+       "name": "envoy.rate_limit_descriptors.expr",
+       "category": "envoy.rate_limit_descriptors",
+       "type_urls": [
+        "envoy.extensions.rate_limit_descriptors.expr.v3.Descriptor"
+       ]
+      },
+      {
+       "name": "auto",
+       "category": "envoy.thrift_proxy.transports"
+      },
+      {
+       "name": "framed",
+       "category": "envoy.thrift_proxy.transports"
+      },
+      {
+       "name": "header",
+       "category": "envoy.thrift_proxy.transports"
+      },
+      {
+       "name": "unframed",
+       "category": "envoy.thrift_proxy.transports"
+      },
+      {
+       "name": "envoy.http.header_validators.envoy_default",
+       "category": "envoy.http.header_validators",
+       "type_urls": [
+        "envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig"
+       ]
+      },
+      {
+       "name": "envoy.wasm.runtime.null",
+       "category": "envoy.wasm.runtime"
+      },
+      {
+       "name": "envoy.wasm.runtime.v8",
+       "category": "envoy.wasm.runtime"
+      },
+      {
+       "name": "envoy.http.stateful_header_formatters.preserve_case",
+       "category": "envoy.http.stateful_header_formatters",
+       "type_urls": [
+        "envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig"
+       ]
+      },
+      {
+       "name": "preserve_case",
+       "category": "envoy.http.stateful_header_formatters"
+      },
+      {
+       "name": "envoy.regex_engines.google_re2",
+       "category": "envoy.regex_engines",
+       "type_urls": [
+        "envoy.extensions.regex_engines.v3.GoogleRE2"
+       ]
+      },
+      {
+       "name": "envoy.config_subscription.ads",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.ads_collection",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.aggregated_grpc_collection",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.delta_grpc",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.delta_grpc_collection",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.filesystem",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.filesystem_collection",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.grpc",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.config_subscription.rest",
+       "category": "envoy.config_subscription"
+      },
+      {
+       "name": "envoy.quic.deterministic_connection_id_generator",
+       "category": "envoy.quic.connection_id_generator",
+       "type_urls": [
+        "envoy.extensions.quic.connection_id_generator.v3.DeterministicConnectionIdGeneratorConfig"
+       ]
+      },
+      {
+       "name": "quic.http_server_connection.default",
+       "category": "quic.http_server_connection"
+      },
+      {
+       "name": "envoy.retry_host_predicates.omit_canary_hosts",
+       "category": "envoy.retry_host_predicates",
+       "type_urls": [
+        "envoy.extensions.retry.host.omit_canary_hosts.v3.OmitCanaryHostsPredicate"
+       ]
+      },
+      {
+       "name": "envoy.retry_host_predicates.omit_host_metadata",
+       "category": "envoy.retry_host_predicates",
+       "type_urls": [
+        "envoy.extensions.retry.host.omit_host_metadata.v3.OmitHostMetadataConfig"
+       ]
+      },
+      {
+       "name": "envoy.retry_host_predicates.previous_hosts",
+       "category": "envoy.retry_host_predicates",
+       "type_urls": [
+        "envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
+       ]
+      },
+      {
+       "name": "envoy.path.match.uri_template.uri_template_matcher",
+       "category": "envoy.path.match",
+       "type_urls": [
+        "envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig"
+       ]
+      },
+      {
+       "name": "envoy.matching.custom_matchers.trie_matcher",
+       "category": "envoy.matching.network.custom_matchers",
+       "type_urls": [
+        "xds.type.matcher.v3.IPMatcher"
+       ]
+      },
+      {
+       "name": "envoy.compression.brotli.compressor",
+       "category": "envoy.compression.compressor",
+       "type_urls": [
+        "envoy.extensions.compression.brotli.compressor.v3.Brotli"
+       ]
+      },
+      {
+       "name": "envoy.compression.gzip.compressor",
+       "category": "envoy.compression.compressor",
+       "type_urls": [
+        "envoy.extensions.compression.gzip.compressor.v3.Gzip"
+       ]
+      },
+      {
+       "name": "envoy.compression.zstd.compressor",
+       "category": "envoy.compression.compressor",
+       "type_urls": [
+        "envoy.extensions.compression.zstd.compressor.v3.Zstd"
+       ]
+      },
+      {
+       "name": "envoy.http.early_header_mutation.header_mutation",
+       "category": "envoy.http.early_header_mutation",
+       "type_urls": [
+        "envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation"
+       ]
+      },
+      {
+       "name": "envoy.ip",
+       "category": "envoy.resolvers"
+      },
+      {
+       "name": "envoy.matching.actions.format_string",
+       "category": "envoy.matching.action",
+       "type_urls": [
+        "envoy.config.core.v3.SubstitutionFormatString"
+       ]
+      },
+      {
+       "name": "filter-chain-name",
+       "category": "envoy.matching.action",
+       "type_urls": [
+        "google.protobuf.StringValue"
+       ]
+      },
+      {
+       "name": "envoy.filters.udp.session.dynamic_forward_proxy",
+       "category": "envoy.filters.udp.session",
+       "type_urls": [
+        "envoy.extensions.filters.udp.udp_proxy.session.dynamic_forward_proxy.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.udp.session.http_capsule",
+       "category": "envoy.filters.udp.session",
+       "type_urls": [
+        "envoy.extensions.filters.udp.udp_proxy.session.http_capsule.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.connection_handler.default",
+       "category": "envoy.connection_handler"
+      },
+      {
+       "name": "envoy.formatter.cel",
+       "category": "envoy.formatter",
+       "type_urls": [
+        "envoy.extensions.formatter.cel.v3.Cel"
+       ]
+      },
+      {
+       "name": "envoy.formatter.metadata",
+       "category": "envoy.formatter",
+       "type_urls": [
+        "envoy.extensions.formatter.metadata.v3.Metadata"
+       ]
+      },
+      {
+       "name": "envoy.formatter.req_without_query",
+       "category": "envoy.formatter",
+       "type_urls": [
+        "envoy.extensions.formatter.req_without_query.v3.ReqWithoutQuery"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.file",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.file.v3.FileAccessLog"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.http_grpc",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.open_telemetry",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.stderr",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.stream.v3.StderrAccessLog"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.stdout",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.stream.v3.StdoutAccessLog"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.tcp_grpc",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig"
+       ]
+      },
+      {
+       "name": "envoy.access_loggers.wasm",
+       "category": "envoy.access_loggers",
+       "type_urls": [
+        "envoy.extensions.access_loggers.wasm.v3.WasmAccessLog"
+       ]
+      },
+      {
+       "name": "envoy.file_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.http_grpc_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.open_telemetry_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.stderr_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.stdout_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.tcp_grpc_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.wasm_access_log",
+       "category": "envoy.access_loggers"
+      },
+      {
+       "name": "envoy.listener_manager_impl.default",
+       "category": "envoy.listener_manager_impl",
+       "type_urls": [
+        "envoy.config.listener.v3.ListenerManager"
+       ]
+      },
+      {
+       "name": "envoy.listener_manager_impl.validation",
+       "category": "envoy.listener_manager_impl",
+       "type_urls": [
+        "envoy.config.listener.v3.ValidationListenerManager"
+       ]
+      },
+      {
+       "name": "envoy.dynamic.ot",
+       "category": "envoy.tracers"
+      },
+      {
+       "name": "envoy.tracers.datadog",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.DatadogConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.dynamic_ot",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.DynamicOtConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.opencensus",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.OpenCensusConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.opentelemetry",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.OpenTelemetryConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.skywalking",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.SkyWalkingConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.xray",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.XRayConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.zipkin",
+       "category": "envoy.tracers",
+       "type_urls": [
+        "envoy.config.trace.v3.ZipkinConfig"
+       ]
+      },
+      {
+       "name": "envoy.zipkin",
+       "category": "envoy.tracers"
+      },
+      {
+       "name": "envoy.http.stateful_session.cookie",
+       "category": "envoy.http.stateful_session",
+       "type_urls": [
+        "envoy.extensions.http.stateful_session.cookie.v3.CookieBasedSessionState"
+       ]
+      },
+      {
+       "name": "envoy.http.stateful_session.header",
+       "category": "envoy.http.stateful_session",
+       "type_urls": [
+        "envoy.extensions.http.stateful_session.header.v3.HeaderBasedSessionState"
+       ]
+      },
+      {
+       "name": "envoy.echo",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.ext_authz",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.filters.network.connection_limit",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.direct_response",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.direct_response.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.dubbo_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.dubbo_proxy.v3.DubboProxy"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.echo",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.echo.v3.Echo"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.ext_authz",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.ext_authz.v3.ExtAuthz"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.http_connection_manager",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.local_ratelimit",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.local_ratelimit.v3.LocalRateLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.mongo_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.ratelimit",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.ratelimit.v3.RateLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.rbac",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.rbac.v3.RBAC"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.redis_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.redis_proxy.v3.RedisProxy"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.set_filter_state",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.set_filter_state.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.sni_cluster",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.sni_dynamic_forward_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.tcp_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.thrift_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.thrift_proxy.v3.ThriftProxy"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.wasm",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.wasm.v3.Wasm"
+       ]
+      },
+      {
+       "name": "envoy.filters.network.zookeeper_proxy",
+       "category": "envoy.filters.network",
+       "type_urls": [
+        "envoy.extensions.filters.network.zookeeper_proxy.v3.ZooKeeperProxy"
+       ]
+      },
+      {
+       "name": "envoy.http_connection_manager",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.mongo_proxy",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.ratelimit",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.redis_proxy",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.tcp_proxy",
+       "category": "envoy.filters.network"
+      },
+      {
+       "name": "envoy.key_value.file_based",
+       "category": "envoy.common.key_value",
+       "type_urls": [
+        "envoy.extensions.key_value.file_based.v3.FileBasedKeyValueStoreConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.udp.dns_filter",
+       "category": "envoy.filters.udp_listener",
+       "type_urls": [
+        "envoy.extensions.filters.udp.dns_filter.v3.DnsFilterConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.udp_listener.udp_proxy",
+       "category": "envoy.filters.udp_listener",
+       "type_urls": [
+        "envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.application_protocol",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.destination_ip",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.destination_port",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.direct_source_ip",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.dns_san",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.filter_state",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.FilterStateInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.server_name",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_ip",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_port",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_type",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.subject",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.transport_protocol",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.uri_san",
+       "category": "envoy.matching.network.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
+       ]
+      },
+      {
+       "name": "envoy.tracers.opentelemetry.resource_detectors.dynatrace",
+       "category": "envoy.tracers.opentelemetry.resource_detectors",
+       "type_urls": [
+        "envoy.extensions.tracers.opentelemetry.resource_detectors.v3.DynatraceResourceDetectorConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.opentelemetry.resource_detectors.environment",
+       "category": "envoy.tracers.opentelemetry.resource_detectors",
+       "type_urls": [
+        "envoy.extensions.tracers.opentelemetry.resource_detectors.v3.EnvironmentResourceDetectorConfig"
+       ]
+      },
+      {
+       "name": "envoy.resource_monitors.fixed_heap",
+       "category": "envoy.resource_monitors",
+       "type_urls": [
+        "envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig"
+       ]
+      },
+      {
+       "name": "envoy.resource_monitors.injected_resource",
+       "category": "envoy.resource_monitors",
+       "type_urls": [
+        "envoy.extensions.resource_monitors.injected_resource.v3.InjectedResourceConfig"
+       ]
+      },
+      {
+       "name": "envoy.geoip_providers.maxmind",
+       "category": "envoy.geoip_providers",
+       "type_urls": [
+        "envoy.extensions.geoip_providers.maxmind.v3.MaxMindConfig"
+       ]
+      },
+      {
+       "name": "envoy.compression.brotli.decompressor",
+       "category": "envoy.compression.decompressor",
+       "type_urls": [
+        "envoy.extensions.compression.brotli.decompressor.v3.Brotli"
+       ]
+      },
+      {
+       "name": "envoy.compression.gzip.decompressor",
+       "category": "envoy.compression.decompressor",
+       "type_urls": [
+        "envoy.extensions.compression.gzip.decompressor.v3.Gzip"
+       ]
+      },
+      {
+       "name": "envoy.compression.zstd.decompressor",
+       "category": "envoy.compression.decompressor",
+       "type_urls": [
+        "envoy.extensions.compression.zstd.decompressor.v3.Zstd"
+       ]
+      },
+      {
+       "name": "auto",
+       "category": "envoy.thrift_proxy.protocols"
+      },
+      {
+       "name": "binary",
+       "category": "envoy.thrift_proxy.protocols"
+      },
+      {
+       "name": "binary/non-strict",
+       "category": "envoy.thrift_proxy.protocols"
+      },
+      {
+       "name": "compact",
+       "category": "envoy.thrift_proxy.protocols"
+      },
+      {
+       "name": "twitter",
+       "category": "envoy.thrift_proxy.protocols"
+      },
+      {
+       "name": "envoy.tls.cert_validator.default",
+       "category": "envoy.tls.cert_validator"
+      },
+      {
+       "name": "envoy.tls.cert_validator.spiffe",
+       "category": "envoy.tls.cert_validator"
+      },
+      {
+       "name": "envoy.network.dns_resolver.cares",
+       "category": "envoy.network.dns_resolver",
+       "type_urls": [
+        "envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig"
+       ]
+      },
+      {
+       "name": "envoy.network.dns_resolver.getaddrinfo",
+       "category": "envoy.network.dns_resolver",
+       "type_urls": [
+        "envoy.extensions.network.dns_resolver.getaddrinfo.v3.GetAddrInfoDnsResolverConfig"
+       ]
+      },
+      {
+       "name": "envoy.request_id.uuid",
+       "category": "envoy.request_id",
+       "type_urls": [
+        "envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig"
+       ]
+      },
+      {
+       "name": "envoy.quic.proof_source.filter_chain",
+       "category": "envoy.quic.proof_source",
+       "type_urls": [
+        "envoy.extensions.quic.proof_source.v3.ProofSourceConfig"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.cluster_provided",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.least_request",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.maglev",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.maglev.v3.Maglev"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.random",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.random.v3.Random"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.ring_hash",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.round_robin",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin"
+       ]
+      },
+      {
+       "name": "envoy.load_balancing_policies.subset",
+       "category": "envoy.load_balancing_policies",
+       "type_urls": [
+        "envoy.extensions.load_balancing_policies.subset.v3.Subset"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.alts",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.alts.v3.Alts"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.http_11_proxy",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.internal_upstream",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.quic",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.quic.v3.QuicUpstreamTransport"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.raw_buffer",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.starttls",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tap",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tap.v3.Tap"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tcp_stats",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tls",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.upstream_proxy_protocol",
+       "category": "envoy.transport_sockets.upstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport"
+       ]
+      },
+      {
+       "name": "raw_buffer",
+       "category": "envoy.transport_sockets.upstream"
+      },
+      {
+       "name": "starttls",
+       "category": "envoy.transport_sockets.upstream"
+      },
+      {
+       "name": "tls",
+       "category": "envoy.transport_sockets.upstream"
+      },
+      {
+       "name": "envoy.internal_redirect_predicates.allow_listed_routes",
+       "category": "envoy.internal_redirect_predicates",
+       "type_urls": [
+        "envoy.extensions.internal_redirect.allow_listed_routes.v3.AllowListedRoutesConfig"
+       ]
+      },
+      {
+       "name": "envoy.internal_redirect_predicates.previous_routes",
+       "category": "envoy.internal_redirect_predicates",
+       "type_urls": [
+        "envoy.extensions.internal_redirect.previous_routes.v3.PreviousRoutesConfig"
+       ]
+      },
+      {
+       "name": "envoy.internal_redirect_predicates.safe_cross_scheme",
+       "category": "envoy.internal_redirect_predicates",
+       "type_urls": [
+        "envoy.extensions.internal_redirect.safe_cross_scheme.v3.SafeCrossSchemeConfig"
+       ]
+      },
+      {
+       "name": "envoy.cluster.eds",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.cluster.logical_dns",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.cluster.original_dst",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.cluster.static",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.cluster.strict_dns",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.clusters.aggregate",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.clusters.dynamic_forward_proxy",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.clusters.redis",
+       "category": "envoy.clusters"
+      },
+      {
+       "name": "envoy.buffer",
+       "category": "envoy.filters.http.upstream"
+      },
+      {
+       "name": "envoy.filters.http.admission_control",
+       "category": "envoy.filters.http.upstream",
+       "type_urls": [
+        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.buffer",
+       "category": "envoy.filters.http.upstream",
+       "type_urls": [
+        "envoy.extensions.filters.http.buffer.v3.Buffer",
+        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.header_mutation",
+       "category": "envoy.filters.http.upstream",
+       "type_urls": [
+        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
+        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
+       ]
+      },
+      {
+       "name": "envoy.filters.http.upstream_codec",
+       "category": "envoy.filters.http.upstream",
+       "type_urls": [
+        "envoy.extensions.filters.http.upstream_codec.v3.UpstreamCodec"
+       ]
+      },
+      {
+       "name": "envoy.filters.thrift.header_to_metadata",
+       "category": "envoy.thrift_proxy.filters",
+       "type_urls": [
+        "envoy.extensions.filters.network.thrift_proxy.filters.header_to_metadata.v3.HeaderToMetadata"
+       ]
+      },
+      {
+       "name": "envoy.filters.thrift.payload_to_metadata",
+       "category": "envoy.thrift_proxy.filters",
+       "type_urls": [
+        "envoy.extensions.filters.network.thrift_proxy.filters.payload_to_metadata.v3.PayloadToMetadata"
+       ]
+      },
+      {
+       "name": "envoy.filters.thrift.rate_limit",
+       "category": "envoy.thrift_proxy.filters",
+       "type_urls": [
+        "envoy.extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit"
+       ]
+      },
+      {
+       "name": "envoy.filters.thrift.router",
+       "category": "envoy.thrift_proxy.filters",
+       "type_urls": [
+        "envoy.extensions.filters.network.thrift_proxy.router.v3.Router"
+       ]
+      },
+      {
+       "name": "envoy.http.original_ip_detection.custom_header",
+       "category": "envoy.http.original_ip_detection",
+       "type_urls": [
+        "envoy.extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig"
+       ]
+      },
+      {
+       "name": "envoy.http.original_ip_detection.xff",
+       "category": "envoy.http.original_ip_detection",
+       "type_urls": [
+        "envoy.extensions.http.original_ip_detection.xff.v3.XffConfig"
+       ]
+      },
+      {
+       "name": "envoy.tracers.opentelemetry.samplers.always_on",
+       "category": "envoy.tracers.opentelemetry.samplers",
+       "type_urls": [
+        "envoy.extensions.tracers.opentelemetry.samplers.v3.AlwaysOnSamplerConfig"
+       ]
+      },
+      {
+       "name": "envoy.router.cluster_specifier_plugin.lua",
+       "category": "envoy.router.cluster_specifier_plugin",
+       "type_urls": [
+        "envoy.extensions.router.cluster_specifiers.lua.v3.LuaConfig"
+       ]
+      },
+      {
+       "name": "envoy.filters.connection_pools.tcp.generic",
+       "category": "envoy.upstreams",
+       "type_urls": [
+        "envoy.extensions.upstreams.tcp.generic.v3.GenericConnectionPoolProto"
+       ]
+      },
+      {
+       "name": "envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+       "category": "envoy.upstream_options",
+       "type_urls": [
+        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+       ]
+      },
+      {
+       "name": "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions",
+       "category": "envoy.upstream_options",
+       "type_urls": [
+        "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions"
+       ]
+      },
+      {
+       "name": "envoy.upstreams.http.http_protocol_options",
+       "category": "envoy.upstream_options"
+      },
+      {
+       "name": "envoy.upstreams.tcp.tcp_protocol_options",
+       "category": "envoy.upstream_options"
+      },
+      {
+       "name": "dubbo.hessian2",
+       "category": "envoy.dubbo_proxy.serializers"
+      },
+      {
+       "name": "envoy.access_loggers.extension_filters.cel",
+       "category": "envoy.access_loggers.extension_filters",
+       "type_urls": [
+        "envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter"
+       ]
+      },
+      {
+       "name": "envoy.quic.crypto_stream.server.quiche",
+       "category": "envoy.quic.server.crypto_stream",
+       "type_urls": [
+        "envoy.extensions.quic.crypto_stream.v3.CryptoServerStreamConfig"
+       ]
+      },
+      {
+       "name": "envoy.rbac.matchers.upstream_ip_port",
+       "category": "envoy.rbac.matchers",
+       "type_urls": [
+        "envoy.extensions.rbac.matchers.upstream_ip_port.v3.UpstreamIpPortMatcher"
+       ]
+      },
+      {
+       "name": "envoy.upstream.local_address_selector.default_local_address_selector",
+       "category": "envoy.upstream.local_address_selector",
+       "type_urls": [
+        "envoy.config.upstream.local_address_selector.v3.DefaultLocalAddressSelector"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.cel_data_input",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "xds.type.matcher.v3.HttpAttributesCelMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.destination_ip",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.destination_port",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.direct_source_ip",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.dns_san",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.request_headers",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpRequestHeaderMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.request_trailers",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpRequestTrailerMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.response_headers",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpResponseHeaderMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.response_trailers",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpResponseTrailerMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.server_name",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_ip",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_port",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.source_type",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.status_code_class_input",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpResponseStatusCodeClassMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.status_code_input",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpResponseStatusCodeMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.subject",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
+       ]
+      },
+      {
+       "name": "envoy.matching.inputs.uri_san",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
+       ]
+      },
+      {
+       "name": "query_params",
+       "category": "envoy.matching.http.input",
+       "type_urls": [
+        "envoy.type.matcher.v3.HttpRequestQueryParamMatchInput"
+       ]
+      },
+      {
+       "name": "envoy.path.rewrite.uri_template.uri_template_rewriter",
+       "category": "envoy.path.rewrite",
+       "type_urls": [
+        "envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.alts",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.alts.v3.Alts"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.quic",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.raw_buffer",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.starttls",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tap",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tap.v3.Tap"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tcp_stats",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
+       ]
+      },
+      {
+       "name": "envoy.transport_sockets.tls",
+       "category": "envoy.transport_sockets.downstream",
+       "type_urls": [
+        "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext"
+       ]
+      },
+      {
+       "name": "raw_buffer",
+       "category": "envoy.transport_sockets.downstream"
+      },
+      {
+       "name": "starttls",
+       "category": "envoy.transport_sockets.downstream"
+      },
+      {
+       "name": "tls",
+       "category": "envoy.transport_sockets.downstream"
+      },
+      {
+       "name": "dubbo",
+       "category": "envoy.dubbo_proxy.protocols"
+      },
+      {
+       "name": "quic.server_preferred_address.fixed",
+       "category": "envoy.quic.server_preferred_address",
+       "type_urls": [
+        "envoy.extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig"
+       ]
+      },
+      {
+       "name": "envoy.matching.custom_matchers.trie_matcher",
+       "category": "envoy.matching.http.custom_matchers",
+       "type_urls": [
+        "xds.type.matcher.v3.IPMatcher"
+       ]
+      }
+     ]
+    },
+    "static_resources": {
+     "listeners": [
+      {
+       "name": "envoy-gateway-proxy-ready-0.0.0.0-19001",
+       "address": {
+        "socket_address": {
+         "address": "0.0.0.0",
+         "port_value": 19001
+        }
+       },
+       "filter_chains": [
+        {
+         "filters": [
+          {
+           "name": "envoy.filters.network.http_connection_manager",
+           "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+            "stat_prefix": "eg-ready-http",
+            "route_config": {
+             "name": "local_route"
+            },
+            "http_filters": [
+             {
+              "name": "envoy.filters.http.health_check",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck",
+               "pass_through_mode": false,
+               "headers": [
+                {
+                 "name": ":path",
+                 "string_match": {
+                  "exact": "/ready"
+                 }
+                }
+               ]
+              }
+             },
+             {
+              "name": "envoy.filters.http.ext_authz",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+               "grpc_service": {
+                "envoy_grpc": {
+                 "cluster_name": "ext-authz"
+                }
+               },
+               "clear_route_cache": true,
+               "include_peer_certificate": true,
+               "transport_api_version": "V3"
+              }
+             },
+             {
+              "name": "envoy.filters.http.router",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+              }
+             }
+            ]
+           }
+          }
+         ]
+        }
+       ]
+      }
+     ],
+     "clusters": [
+      {
+       "name": "xds_cluster",
+       "type": "STRICT_DNS",
+       "connect_timeout": "10s",
+       "transport_socket": {
+        "name": "envoy.transport_sockets.tls",
+        "typed_config": {
+         "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+         "common_tls_context": {
+          "tls_params": {
+           "tls_maximum_protocol_version": "TLSv1_3"
+          },
+          "tls_certificates": [
+           {
+            "certificate_chain": {
+             "filename": "/home/wso2/security/keystore/router.crt"
+            },
+            "private_key": {
+             "filename": "[redacted]"
+            }
+           }
+          ],
+          "validation_context": {
+           "trusted_ca": {
+            "filename": "/home/wso2/security/truststore/adapter.crt"
+           }
+          }
+         }
+        }
+       },
+       "load_assignment": {
+        "cluster_name": "xds_cluster",
+        "endpoints": [
+         {
+          "lb_endpoints": [
+           {
+            "endpoint": {
+             "address": {
+              "socket_address": {
+               "address": "apk-test-wso2-apk-adapter-service.apk.svc",
+               "port_value": 18000
+              }
+             }
+            },
+            "load_balancing_weight": 1
+           }
+          ],
+          "load_balancing_weight": 1
+         }
+        ]
+       },
+       "typed_extension_protocol_options": {
+        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+         "explicit_http_config": {
+          "http2_protocol_options": {
+           "connection_keepalive": {
+            "interval": "30s",
+            "timeout": "5s"
+           }
+          }
+         }
+        }
+       }
+      },
+      {
+       "name": "ext-authz",
+       "type": "STRICT_DNS",
+       "connect_timeout": "20s",
+       "transport_socket": {
+        "name": "envoy.transport_sockets.tls",
+        "typed_config": {
+         "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+         "common_tls_context": {
+          "tls_params": {
+           "tls_minimum_protocol_version": "TLSv1_2",
+           "tls_maximum_protocol_version": "TLSv1_2"
+          },
+          "tls_certificates": [
+           {
+            "certificate_chain": {
+             "filename": "/home/wso2/security/keystore/router.crt"
+            },
+            "private_key": {
+             "filename": "[redacted]"
+            }
+           }
+          ],
+          "validation_context": {
+           "trusted_ca": {
+            "filename": "/home/wso2/security/truststore/enforcer.crt"
+           }
+          }
+         }
+        }
+       },
+       "load_assignment": {
+        "cluster_name": "ext-authz",
+        "endpoints": [
+         {
+          "lb_endpoints": [
+           {
+            "endpoint": {
+             "address": {
+              "socket_address": {
+               "address": "enforcer",
+               "port_value": 8081
+              }
+             }
+            }
+           }
+          ]
+         }
+        ]
+       },
+       "typed_extension_protocol_options": {
+        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+         "explicit_http_config": {
+          "http2_protocol_options": {}
+         }
+        }
+       }
+      }
+     ]
+    },
+    "dynamic_resources": {
+     "lds_config": {
+      "ads": {},
+      "resource_api_version": "V3"
+     },
+     "cds_config": {
+      "ads": {},
+      "resource_api_version": "V3"
+     },
+     "ads_config": {
+      "api_type": "DELTA_GRPC",
+      "grpc_services": [
+       {
+        "envoy_grpc": {
+         "cluster_name": "xds_cluster"
+        }
+       }
+      ],
+      "set_node_on_first_message_only": true,
+      "transport_api_version": "V3"
+     }
+    },
+    "admin": {
+     "address": {
+      "socket_address": {
+       "address": "0.0.0.0",
+       "port_value": 19000
+      }
+     },
+     "access_log": [
+      {
+       "name": "envoy.access_loggers.file",
+       "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+        "path": "/dev/null"
+       }
+      }
+     ]
+    },
+    "layered_runtime": {
+     "layers": [
+      {
+       "name": "global_config",
+       "static_layer": {
+        "envoy.restart_features.use_eds_cache_for_ads": true,
+        "re2.max_program_size.error_level": "4294967295",
+        "re2.max_program_size.warn_level": 1000
+       }
+      }
+     ]
+    }
+   },
+   "last_updated": "2024-08-06T09:04:42.710Z"
+  },
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.ClustersConfigDump",
+   "static_clusters": [
+    {
+     "cluster": {
+      "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
+      "name": "ext-authz",
+      "type": "STRICT_DNS",
+      "connect_timeout": "20s",
+      "transport_socket": {
+       "name": "envoy.transport_sockets.tls",
+       "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+        "common_tls_context": {
+         "tls_params": {
+          "tls_minimum_protocol_version": "TLSv1_2",
+          "tls_maximum_protocol_version": "TLSv1_2"
+         },
+         "tls_certificates": [
+          {
+           "certificate_chain": {
+            "filename": "/home/wso2/security/keystore/router.crt"
+           },
+           "private_key": {
+            "filename": "[redacted]"
+           }
+          }
+         ],
+         "validation_context": {
+          "trusted_ca": {
+           "filename": "/home/wso2/security/truststore/enforcer.crt"
+          }
+         }
+        }
+       }
+      },
+      "load_assignment": {
+       "cluster_name": "ext-authz",
+       "endpoints": [
+        {
+         "lb_endpoints": [
+          {
+           "endpoint": {
+            "address": {
+             "socket_address": {
+              "address": "enforcer",
+              "port_value": 8081
+             }
+            }
+           }
+          }
+         ]
+        }
+       ]
+      },
+      "typed_extension_protocol_options": {
+       "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+        "explicit_http_config": {
+         "http2_protocol_options": {}
+        }
+       }
+      }
+     },
+     "last_updated": "2024-08-06T09:04:42.743Z"
+    },
+    {
+     "cluster": {
+      "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
+      "name": "xds_cluster",
+      "type": "STRICT_DNS",
+      "connect_timeout": "10s",
+      "transport_socket": {
+       "name": "envoy.transport_sockets.tls",
+       "typed_config": {
+        "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+        "common_tls_context": {
+         "tls_params": {
+          "tls_maximum_protocol_version": "TLSv1_3"
+         },
+         "tls_certificates": [
+          {
+           "certificate_chain": {
+            "filename": "/home/wso2/security/keystore/router.crt"
+           },
+           "private_key": {
+            "filename": "[redacted]"
+           }
+          }
+         ],
+         "validation_context": {
+          "trusted_ca": {
+           "filename": "/home/wso2/security/truststore/adapter.crt"
+          }
+         }
+        }
+       }
+      },
+      "load_assignment": {
+       "cluster_name": "xds_cluster",
+       "endpoints": [
+        {
+         "lb_endpoints": [
+          {
+           "endpoint": {
+            "address": {
+             "socket_address": {
+              "address": "apk-test-wso2-apk-adapter-service.apk.svc",
+              "port_value": 18000
+             }
+            }
+           },
+           "load_balancing_weight": 1
+          }
+         ],
+         "load_balancing_weight": 1
+        }
+       ]
+      },
+      "typed_extension_protocol_options": {
+       "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
+        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+        "explicit_http_config": {
+         "http2_protocol_options": {
+          "connection_keepalive": {
+           "interval": "30s",
+           "timeout": "5s"
+          }
+         }
+        }
+       }
+      }
+     },
+     "last_updated": "2024-08-06T09:04:42.741Z"
+    }
+   ]
+  },
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.ListenersConfigDump",
+   "version_info": "5",
+   "static_listeners": [
+    {
+     "listener": {
+      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
+      "name": "envoy-gateway-proxy-ready-0.0.0.0-19001",
+      "address": {
+       "socket_address": {
+        "address": "0.0.0.0",
+        "port_value": 19001
+       }
+      },
+      "filter_chains": [
+       {
+        "filters": [
+         {
+          "name": "envoy.filters.network.http_connection_manager",
+          "typed_config": {
+           "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+           "stat_prefix": "eg-ready-http",
+           "route_config": {
+            "name": "local_route"
+           },
+           "http_filters": [
+            {
+             "name": "envoy.filters.http.health_check",
+             "typed_config": {
+              "@type": "type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck",
+              "pass_through_mode": false,
+              "headers": [
+               {
+                "name": ":path",
+                "string_match": {
+                 "exact": "/ready"
+                }
+               }
+              ]
+             }
+            },
+            {
+             "name": "envoy.filters.http.ext_authz",
+             "typed_config": {
+              "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+              "grpc_service": {
+               "envoy_grpc": {
+                "cluster_name": "ext-authz"
+               }
+              },
+              "clear_route_cache": true,
+              "include_peer_certificate": true,
+              "transport_api_version": "V3"
+             }
+            },
+            {
+             "name": "envoy.filters.http.router",
+             "typed_config": {
+              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
+             }
+            }
+           ]
+          }
+         }
+        ]
+       }
+      ]
+     },
+     "last_updated": "2024-08-06T09:04:42.751Z"
+    }
+   ],
+   "dynamic_listeners": [
+    {
+     "name": "apk/wso2-apk-default/httpslistener",
+     "active_state": {
+      "version_info": "cc013422ba77df5c71d81a6c95fdae89f4a05971ab20b067808d0272bd13a1eb",
+      "listener": {
+       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
+       "name": "apk/wso2-apk-default/httpslistener",
+       "address": {
+        "socket_address": {
+         "address": "0.0.0.0",
+         "port_value": 9095
+        }
+       },
+       "filter_chains": [
+        {
+         "filter_chain_match": {
+          "server_names": [
+           "api.am.wso2.com"
+          ]
+         },
+         "filters": [
+          {
+           "name": "envoy.filters.network.http_connection_manager",
+           "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+            "stat_prefix": "https",
+            "rds": {
+             "config_source": {
+              "ads": {},
+              "resource_api_version": "V3"
+             },
+             "route_config_name": "apk/wso2-apk-default/httpslistener"
+            },
+            "http_filters": [
+             {
+              "name": "envoy.filters.http.router",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+               "suppress_envoy_headers": true
+              }
+             }
+            ],
+            "http2_protocol_options": {
+             "max_concurrent_streams": 100,
+             "initial_stream_window_size": 65536,
+             "initial_connection_window_size": 1048576
+            },
+            "access_log": [
+             {
+              "name": "envoy.access_loggers.file",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+               "path": "/dev/stdout",
+               "log_format": {
+                "text_format_source": {
+                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+                }
+               }
+              }
+             }
+            ],
+            "use_remote_address": true,
+            "normalize_path": true,
+            "merge_slashes": true,
+            "server_header_transformation": "PASS_THROUGH",
+            "common_http_protocol_options": {
+             "headers_with_underscores_action": "REJECT_REQUEST"
+            }
+           }
+          }
+         ],
+         "transport_socket": {
+          "name": "envoy.transport_sockets.tls",
+          "typed_config": {
+           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+           "common_tls_context": {
+            "alpn_protocols": [
+             "h2",
+             "http/1.1"
+            ],
+            "tls_certificate_sds_secret_configs": [
+             {
+              "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
+              "sds_config": {
+               "ads": {},
+               "resource_api_version": "V3"
+              }
+             }
+            ]
+           }
+          }
+         }
+        },
+        {
+         "filter_chain_match": {
+          "server_names": [
+           "idp.am.wso2.com"
+          ]
+         },
+         "filters": [
+          {
+           "name": "envoy.filters.network.http_connection_manager",
+           "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+            "stat_prefix": "https",
+            "rds": {
+             "config_source": {
+              "ads": {},
+              "resource_api_version": "V3"
+             },
+             "route_config_name": "apk/wso2-apk-default/idplistener"
+            },
+            "http_filters": [
+             {
+              "name": "envoy.filters.http.router",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+               "suppress_envoy_headers": true
+              }
+             }
+            ],
+            "http2_protocol_options": {
+             "max_concurrent_streams": 100,
+             "initial_stream_window_size": 65536,
+             "initial_connection_window_size": 1048576
+            },
+            "access_log": [
+             {
+              "name": "envoy.access_loggers.file",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+               "path": "/dev/stdout",
+               "log_format": {
+                "text_format_source": {
+                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+                }
+               }
+              }
+             }
+            ],
+            "use_remote_address": true,
+            "normalize_path": true,
+            "merge_slashes": true,
+            "server_header_transformation": "PASS_THROUGH",
+            "common_http_protocol_options": {
+             "headers_with_underscores_action": "REJECT_REQUEST"
+            }
+           }
+          }
+         ],
+         "transport_socket": {
+          "name": "envoy.transport_sockets.tls",
+          "typed_config": {
+           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+           "common_tls_context": {
+            "alpn_protocols": [
+             "h2",
+             "http/1.1"
+            ],
+            "tls_certificate_sds_secret_configs": [
+             {
+              "name": "apk/apk-test-wso2-apk-idp-listener-cert",
+              "sds_config": {
+               "ads": {},
+               "resource_api_version": "V3"
+              }
+             }
+            ]
+           }
+          }
+         }
+        },
+        {
+         "filter_chain_match": {
+          "server_names": [
+           "*.gw.wso2.com"
+          ]
+         },
+         "filters": [
+          {
+           "name": "envoy.filters.network.http_connection_manager",
+           "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+            "stat_prefix": "https",
+            "rds": {
+             "config_source": {
+              "ads": {},
+              "resource_api_version": "V3"
+             },
+             "route_config_name": "apk/wso2-apk-default/gatewaylistener"
+            },
+            "http_filters": [
+             {
+              "name": "envoy.filters.http.router",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+               "suppress_envoy_headers": true
+              }
+             }
+            ],
+            "http2_protocol_options": {
+             "max_concurrent_streams": 100,
+             "initial_stream_window_size": 65536,
+             "initial_connection_window_size": 1048576
+            },
+            "access_log": [
+             {
+              "name": "envoy.access_loggers.file",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+               "path": "/dev/stdout",
+               "log_format": {
+                "text_format_source": {
+                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+                }
+               }
+              }
+             }
+            ],
+            "use_remote_address": true,
+            "normalize_path": true,
+            "merge_slashes": true,
+            "server_header_transformation": "PASS_THROUGH",
+            "common_http_protocol_options": {
+             "headers_with_underscores_action": "REJECT_REQUEST"
+            }
+           }
+          }
+         ],
+         "transport_socket": {
+          "name": "envoy.transport_sockets.tls",
+          "typed_config": {
+           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+           "common_tls_context": {
+            "alpn_protocols": [
+             "h2",
+             "http/1.1"
+            ],
+            "tls_certificate_sds_secret_configs": [
+             {
+              "name": "apk/apk-test-wso2-apk-gw-listener-cert",
+              "sds_config": {
+               "ads": {},
+               "resource_api_version": "V3"
+              }
+             }
+            ]
+           }
+          }
+         }
+        },
+        {
+         "filter_chain_match": {
+          "server_names": [
+           "localhost"
+          ]
+         },
+         "filters": [
+          {
+           "name": "envoy.filters.network.http_connection_manager",
+           "typed_config": {
+            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+            "stat_prefix": "https",
+            "rds": {
+             "config_source": {
+              "ads": {},
+              "resource_api_version": "V3"
+             },
+             "route_config_name": "apk/wso2-apk-default/systemlistener"
+            },
+            "http_filters": [
+             {
+              "name": "envoy.filters.http.router",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+               "suppress_envoy_headers": true
+              }
+             }
+            ],
+            "http2_protocol_options": {
+             "max_concurrent_streams": 100,
+             "initial_stream_window_size": 65536,
+             "initial_connection_window_size": 1048576
+            },
+            "access_log": [
+             {
+              "name": "envoy.access_loggers.file",
+              "typed_config": {
+               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+               "path": "/dev/stdout",
+               "log_format": {
+                "text_format_source": {
+                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+                }
+               }
+              }
+             }
+            ],
+            "use_remote_address": true,
+            "normalize_path": true,
+            "merge_slashes": true,
+            "server_header_transformation": "PASS_THROUGH",
+            "common_http_protocol_options": {
+             "headers_with_underscores_action": "REJECT_REQUEST"
+            }
+           }
+          }
+         ],
+         "transport_socket": {
+          "name": "envoy.transport_sockets.tls",
+          "typed_config": {
+           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+           "common_tls_context": {
+            "alpn_protocols": [
+             "h2",
+             "http/1.1"
+            ],
+            "tls_certificate_sds_secret_configs": [
+             {
+              "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
+              "sds_config": {
+               "ads": {},
+               "resource_api_version": "V3"
+              }
+             }
+            ]
+           }
+          }
+         }
+        }
+       ],
+       "per_connection_buffer_limit_bytes": 32768,
+       "drain_type": "MODIFY_ONLY",
+       "listener_filters": [
+        {
+         "name": "envoy.filters.listener.tls_inspector",
+         "typed_config": {
+          "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+         }
+        }
+       ],
+       "access_log": [
+        {
+         "name": "envoy.access_loggers.file",
+         "filter": {
+          "response_flag_filter": {
+           "flags": [
+            "NR"
+           ]
+          }
+         },
+         "typed_config": {
+          "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
+          "path": "/dev/stdout",
+          "log_format": {
+           "text_format_source": {
+            "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
+           }
+          }
+         }
+        }
+       ]
+      },
+      "last_updated": "2024-08-06T09:04:43.009Z"
+     }
+    }
+   ]
+  },
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.ScopedRoutesConfigDump"
+  },
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.RoutesConfigDump",
+   "static_route_configs": [
+    {
+     "route_config": {
+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+      "name": "local_route"
+     },
+     "last_updated": "2024-08-06T09:04:42.748Z"
+    }
+   ],
+   "dynamic_route_configs": [
+    {
+     "version_info": "c1f165726a912d0509c252f8cc3ba51a91cd868e9a5916f7b8f5828de40bf93d",
+     "route_config": {
+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+      "name": "apk/wso2-apk-default/gatewaylistener",
+      "ignore_port_in_host_matching": true
+     },
+     "last_updated": "2024-08-06T09:04:43.025Z"
+    },
+    {
+     "version_info": "d42228dc46536b9cb20a0cae5aa5d50cb8468d881e370edf03c32102d1840ee0",
+     "route_config": {
+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+      "name": "apk/wso2-apk-default/idplistener",
+      "ignore_port_in_host_matching": true
+     },
+     "last_updated": "2024-08-06T09:04:55.996Z"
+    },
+    {
+     "version_info": "30b81ac246bad08d475bc9861b713a3931f840f866928e00d4fab88d1e88d24a",
+     "route_config": {
+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+      "name": "apk/wso2-apk-default/systemlistener",
+      "ignore_port_in_host_matching": true
+     },
+     "last_updated": "2024-08-06T09:04:43.025Z"
+    },
+    {
+     "version_info": "848bfb9ec8df544d9ba0ef09b486cb9f8090f39c85673ba13b933b8dd7e5748d",
+     "route_config": {
+      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+      "name": "apk/wso2-apk-default/httpslistener",
+      "ignore_port_in_host_matching": true
+     },
+     "last_updated": "2024-08-06T09:04:58.920Z"
+    }
+   ]
+  },
+  {
+   "@type": "type.googleapis.com/envoy.admin.v3.SecretsConfigDump",
+   "dynamic_active_secrets": [
+    {
+     "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
+     "version_info": "43f7018cc982d6d0a68c3d5a964fdcdb069599bea023db427dc3492677629b21",
+     "last_updated": "2024-08-06T09:04:43.029Z",
+     "secret": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
+      "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
+      "tls_certificate": {
+       "certificate_chain": {
+        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM4ekNDQWR1Z0F3SUJBZ0lSQU1XVVRqdzZ6WEMvemRuZzRJYithYWt3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNRngvL01rWmRLcGJSTWJVeXc2CjdGeCs0bnUvdnpIaHYrcjVxZThnMGZPZ1E2K2xGY09MQkoybmowQ2tsY1BseGtYWEo1R0Y0eU81eWZxNHNZbE4KUXYzeHZqY1l2RFU4a05ReVlSejVTK0Joenh4ZW5zaHVGZkdTQ3JLUkZLTDdyOFFHeEx5dXdvQkpNcGI2cmxtTAo0SksvQlZmbjRMdXBBNkZnemlpRExscEs1L2Z1QnJ2MjhLMzhIeGVONkpldUR6MURONUU3c3h3ZVVDMWFWenZ5CnRTTk9ZeHBGNE8rcGhycUdpUjdyUXJsc2FuNk9CbUE5cVBFUGVpZk5xZFp3SEdmM01GZ1lGc04vVTJKQVdjU0cKLzRqQktCYmJTWDVGUWJzeUQvdHRFLzJ3WElRZWVKMlJoN1RCSjVTaTYzVFBPRCs0MDZjMFltakxuemJ0cXY4MQpIYlVDQXdFQUFhTmFNRmd3RGdZRFZSMFBBUUgvQkFRREFnV2dNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqCkJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkxMUNXandjd0Z3WURWUjBSQVFIL0JBMHdDNElKYkc5allXeG8KYjNOME1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQmNkZzlIKzFMNVhqYWkvanhjbGVHOTE3Y09PSFJNUnVUegp1dk9wckF3MGpTbmVCcWF0T1daZis1cjNaUkhLMm9pRlZnS01SZS9MeURKWlA1YzVUd3BUbTJvNmREYU1NSHgyCm9majFqNWxIbEZReWNxZ2REb1o1YU9Kdkl3bU9yUUxITkJWcFBJQXdEaHZnSzFTNkZyZEh3OUVFWFVtUnlJeE8KRkRyMHlnU0ZCdGxKVzljS05UWHJCM1ZLRFZRRmd5YURuOTRKWG5hM1EwaXlwbGJQb09Tb01kU2dRVFkxV2sxRAo2cC9SUjM3Y0RiNklKRlVOL2hhZzlOKzdhNW03d2tkQ25TNU1uU1BpR3dDeGROMVBRL0Z1UUdRMDZoZjNnYnZGCnAxNHVFcXZWOGtmOFM1RmFPbzBJUEwyTDdpdFlQZTFRZFNPOTE3QU1OMk5HTEYwaUdrenoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+       },
+       "private_key": {
+        "inline_bytes": "W3JlZGFjdGVkXQ=="
+       }
+      }
+     }
+    },
+    {
+     "name": "apk/apk-test-wso2-apk-gw-listener-cert",
+     "version_info": "483266b548c2544528a6d86fe1f798455d822d617f26a12fefb65a118a04b08e",
+     "last_updated": "2024-08-06T09:04:43.031Z",
+     "secret": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
+      "name": "apk/apk-test-wso2-apk-gw-listener-cert",
+      "tls_certificate": {
+       "certificate_chain": {
+        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJakNDQWdxZ0F3SUJBZ0lSQU1zUnY2dEErVlNTV0NReWUyRjVpamN3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFPcWEvdnQ0UkVKWm94eExSeVJGCkF5YVIyUDdWR0srdXlqMzN4NUZ6QXl2cEdSMlRiQkg4dFFLcHlGNzJqU3pSVVhGSVRGYUJ4bDMwcTQ3WUJjN2MKTXNpQzJBYlNENWtxNS9NdzZrNVovUHduU09qQnFiY1Z4d1hqMHpZWDM0TldDR0pWdXBNaS95eG9sbllFSjdTdgo4S3E3Z3BRNGFuNU9EdURWbWVaWi9GOG93QU9IQU9sS3cyQVNPL0RyWHBhK0c1WmFab3Q0TEFkYVhZZys0SEpnCnpvQUtZcHpwR0ljaWh4eVhkQTd4TGRlWGVTR3ZKTFBESjNhS1FRcmVzVEl0RUc4V24rOTZDVEk2dUc2TmdZZW8KMGV5UnpISkJRZSthQ1VlcFhIaVlkVXNzbGNpRXhJdlFFeW5qa2VvemxIVEUxUE94ckR0emF2RE1jTXpNM01NNgp3OFVDQXdFQUFhT0JpRENCaFRBT0JnTlZIUThCQWY4RUJBTUNCYUF3REFZRFZSMFRBUUgvQkFJd0FEQWZCZ05WCkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmxodUxYVUphUEJ6QkVCZ05WSFJFQkFmOEVPakE0Z2cwcUxtZDMKTG5kemJ6SXVZMjl0Z2hVcUxuTmhibVJpYjNndVozY3VkM052TWk1amIyMkNFSEJ5YjJRdVozY3VkM052TWk1agpiMjB3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUo1ZHJ0TUNmUGdkWFBBc3VhTXNOaWNBUkRtYWhkS3lab25wCnVkbmlERCtoZm1MaEVkLzZMUjZjUEJXdm9qTnltZ0hWd01mVWNhVGZKRlhzd3FvYVdLbTBHWTE0c1FBcWxPS3EKa1NhdG9iMHdPN3Q4VkpVTTZabUpHeFU5VVFiY2Y3UzZPRGlzc2dOcFp3OVVhMzREMmlhamZVTFVReDg2bnI5UAo2d0FUSXlLUkJuTTZjZE91MndmNkEyck5LM0NyTmtMUjhnY3pTR2hpNWlOZURMZVdUdUdSbk10OU9OMVFXTnA2CjRuQkJ4RHlSRmYxNTF2dFBFc29NOER5S3BNVVN3Uy83MHVYUnZMOEM2dXUzVWRCVUtvd2RJNWtqdDZYRWRWaXEKNjZJOStUZkNsOS9jbWpza2pNU0EzZjdqa3FjNUxaV2dzUXNpQnZLUEl1VTB2QktBdk1RPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+       },
+       "private_key": {
+        "inline_bytes": "W3JlZGFjdGVkXQ=="
+       }
+      }
+     }
+    },
+    {
+     "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
+     "version_info": "f5131907fa3d5995092b2d4f7b4361a02e196148489c4ec123dbf3d57ebfe68f",
+     "last_updated": "2024-08-06T09:04:43.030Z",
+     "secret": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
+      "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
+      "tls_certificate": {
+       "certificate_chain": {
+        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURDekNDQWZPZ0F3SUJBZ0lRQkF4WTdsRG9vcWY0TnR1ajZoOTFwakFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpRd09EQXlNRGt5TmpRNFdoY05NalF4TURNeE1Ea3lOalE0V2pBQQpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXFaVEhBbkFwTnlxV0JVemRqM05rCm5nUzkvdnRHZXJqOHM5eWpRNWxkVzgxelJnOWg3OVBhREpnWGo1cnBVQkVSbm1DRVVFSVB0Y3F3cnZjYVVUOU8KOFBieU5zVmdzUjIxcklVVkVDK0RYVXJFVStqMUh3THdoQkdUVVZudkFtL3M3Rmt4VVJ4N1JUMzgybURXWS9xbgpNbVQ4Q2hGRDhyeVVvc09ESERJazZBODAwM25tUXRydnlXQzJzRzMyRit0ZjAzUEN4K0xmU0xzWWJidllsSlV6CkR4SXpTaERlNGFEaDZRS2U2Z0ZMemJWRC9jR2RObkVJcHlLZm93TW9mVFpmTGZzQUN5RDJReUpteUprbkZCV2IKUmpwZ2kvL0ZwV3d3TnF6Ri9vWlgydkE0cXlwSW43dlArL2pzUWxuY2E5UWxoa3lEWVNZZ2MzOC9EWUFtSmQvMgpoUUlEQVFBQm8zTXdjVEFPQmdOVkhROEJBZjhFQkFNQ0JhQXdEQVlEVlIwVEFRSC9CQUl3QURBZkJnTlZIU01FCkdEQVdnQlRQRndEeHg0SVhtMzY4OTQ2bGh1TFhVSmFQQnpBd0JnTlZIUkVCQWY4RUpqQWtnaEVxTG1Gd2FTNWgKYlM1M2MyOHlMbU52YllJUFlYQnBMbUZ0TG5kemJ6SXVZMjl0TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDSAo0R1o5eSs0MUpDVkZncko0eHJiQ1E4cXZUSkU4emNtVkt1MSs2R3dnTWhmcFllS0NVeTFrdm44VnVzRDUzVDZpCnpsWnQ4Uk5oQmFqM1B2VVNBMDloMUNkNitINGNyRlFZUkgwWUtRaEhaQlpRbWRwdTNzeXFQanBJMmtZSUIxSUwKTDJyYlErWmlDR3hla2VISERvUWg1UytiSWFNQVVueGUrKzQ3L25RK1hUNnBSMWNBQUJ6ejEvQXA1RWZzZThldwo4K1VwQ3BwOXlCQ25DWGhRY25pQlVrVXlyY2hWdFNDOUxYanJ6Qno5aFBQdUNiMVVOWWJ0TERuOU9DNHYxUUs1CjJRcE0ybUJId3Y3OWxzS3NJd3g4SEFLdjNKb1FmQlRPVXhGMlA3RVBxZjgwTk9LaDgwd0dhMFZoOVBSaHhrcG4KODFrM1VKaXNTNHFBMUl2dzdkS24KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+       },
+       "private_key": {
+        "inline_bytes": "W3JlZGFjdGVkXQ=="
+       }
+      }
+     }
+    },
+    {
+     "name": "apk/apk-test-wso2-apk-idp-listener-cert",
+     "version_info": "05e2acd38770d9d6082a166f3b8b4afd0a2b987e433d7cefc28a135c1f965784",
+     "last_updated": "2024-08-06T09:04:43.031Z",
+     "secret": {
+      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
+      "name": "apk/apk-test-wso2-apk-idp-listener-cert",
+      "tls_certificate": {
+       "certificate_chain": {
+        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURERENDQWZTZ0F3SUJBZ0lSQU9MZk5oaE9COE1qRER3cmF0YmQ3UVl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMN08zTzFONC8zbCt3cmhEbGZOClI3TDU4SW40aU9rVDlIZnMxZGVvQ2tFQ0Q1TXJNcXNDSzFUQ3JzV2RzNUFqZWNuUEVDKytHRGVLWnhuR1RzaTcKNzlOaDNuT1dqbmRPR2Y1aGV2a3VVZGNwdEticHd0N1IyL2RxWE8rU2FXNE9oRS9XQjkyTGF3UGdkaGNScG1MdwprYjIvem1oWTE4blVMUFI2c1FCeS94SmR3b2hqaXYxdUVuZUdJTWFoVDFuZVVIZGVNMlRqOHBnYkdJellOSFo0CjJQZEplZ2x0MVJYZlY3bXovdjJERHZwQ3lGUythUldDNVFOOTloTVVXUG8wNnlHZEFoLzVnM3FwaW1ONjM1c00Kb1FKUll2ZDBoUUtVaXF6dmUzWWV4aWMzUUVqWmxtajRIYTB2aU1MemVmT2dSbDFmeUlqUHNVVjhJa2lORzZvYgpaVmtDQXdFQUFhTnpNSEV3RGdZRFZSMFBBUUgvQkFRREFnV2dNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqCkJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkxMUNXandjd01BWURWUjBSQVFIL0JDWXdKSUlSS2k1cFpIQXUKWVcwdWQzTnZNaTVqYjIyQ0QybGtjQzVoYlM1M2MyOHlMbU52YlRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQQpjTVlvbkdiQWoyUmFTQUtvRjV3cHdlSVVYYlh3aU1XQ0Y4czlzRTdsa0U1RHJFd1ZWR1NjTFppU2dVVDdhd3gvCnh4UkVGNk9wTXRUY2pQV3RNRzNwRmk0bTZpcHVvSjFyZnJkdVhmVUNCNi9XbnhNUHZBZHBkcjZSODFQazBHUC8KaXp3Y096TVlaZnVud3piZEFyUGUyZW9BTDc1NGx0bTBSZzJ2ZTlXYnRFYUZqODFmZDJveFY2cm9LMzBoazVxcQprQkNOSkVRTXp1ZU1Nb2o1anljc3F1MzNSRUhpT0VSWlNUQjI0RDRIc3hrOThWQ2JtWEM2bm42blZCRjZ0MFhMCmJPZ0RiZDBVaExiZ2dTMU0wejlGa1NXM1lka21XMWdjS0RLWDdCV2Zwa0VGSXVwVGtMNDZYd25pVS9ic0pqeWgKcStKbVo5NGhqUHV4WUx5eXk5Q1RlUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
+       },
+       "private_key": {
+        "inline_bytes": "W3JlZGFjdGVkXQ=="
+       }
+      }
+     }
+    }
+   ]
+  }
+ ]
+}
\ No newline at end of file
diff --git a/adapter/test.json b/adapter/test.json
new file mode 100644
index 000000000..26c967052
--- /dev/null
+++ b/adapter/test.json
@@ -0,0 +1,12500 @@
+{
+   "configs":[
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
+         "bootstrap":{
+            "node":{
+               "id":"default",
+               "cluster":"apk_router_cluster",
+               "metadata":{
+                  "instanceIdentifier":"apk-perftest-wso2-apk-gateway-runtime-deployment-664bffffbgd7dq"
+               },
+               "user_agent_name":"envoy",
+               "user_agent_build_version":{
+                  "version":{
+                     "major_number":1,
+                     "minor_number":27
+                  },
+                  "metadata":{
+                     "build.type":"RELEASE",
+                     "ssl.version":"BoringSSL",
+                     "revision.status":"Clean",
+                     "revision.sha":"7bba38b743bb3bca22dffb4a21c38ccc155fbef8"
+                  }
+               },
+               "extensions":[
+                  {
+                     "name":"envoy.connection_handler.default",
+                     "category":"envoy.connection_handler"
+                  },
+                  {
+                     "name":"envoy.dynamic.ot",
+                     "category":"envoy.tracers"
+                  },
+                  {
+                     "name":"envoy.tracers.datadog",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.DatadogConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.dynamic_ot",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.DynamicOtConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.opencensus",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.OpenCensusConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.opentelemetry",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.OpenTelemetryConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.skywalking",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.SkyWalkingConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.xray",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.XRayConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tracers.zipkin",
+                     "category":"envoy.tracers",
+                     "type_urls":[
+                        "envoy.config.trace.v3.ZipkinConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.zipkin",
+                     "category":"envoy.tracers"
+                  },
+                  {
+                     "name":"envoy.matching.custom_matchers.trie_matcher",
+                     "category":"envoy.matching.http.custom_matchers",
+                     "type_urls":[
+                        "xds.type.matcher.v3.IPMatcher"
+                     ]
+                  },
+                  {
+                     "name":"envoy.rate_limit_descriptors.expr",
+                     "category":"envoy.rate_limit_descriptors",
+                     "type_urls":[
+                        "envoy.extensions.rate_limit_descriptors.expr.v3.Descriptor"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.udp.dns_filter",
+                     "category":"envoy.filters.udp_listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.udp.dns_filter.v3.DnsFilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.udp_listener.udp_proxy",
+                     "category":"envoy.filters.udp_listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.extensions.http.custom_response.local_response_policy",
+                     "category":"envoy.http.custom_response",
+                     "type_urls":[
+                        "envoy.extensions.http.custom_response.local_response_policy.v3.LocalResponsePolicy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.extensions.http.custom_response.redirect_policy",
+                     "category":"envoy.http.custom_response",
+                     "type_urls":[
+                        "envoy.extensions.http.custom_response.redirect_policy.v3.RedirectPolicy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.original_ip_detection.custom_header",
+                     "category":"envoy.http.original_ip_detection",
+                     "type_urls":[
+                        "envoy.extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.original_ip_detection.xff",
+                     "category":"envoy.http.original_ip_detection",
+                     "type_urls":[
+                        "envoy.extensions.http.original_ip_detection.xff.v3.XffConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.network.dns_resolver.cares",
+                     "category":"envoy.network.dns_resolver",
+                     "type_urls":[
+                        "envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.network.dns_resolver.getaddrinfo",
+                     "category":"envoy.network.dns_resolver",
+                     "type_urls":[
+                        "envoy.extensions.network.dns_resolver.getaddrinfo.v3.GetAddrInfoDnsResolverConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.matchers.cel_matcher",
+                     "category":"envoy.matching.input_matchers",
+                     "type_urls":[
+                        "xds.type.matcher.v3.CelMatcher"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.matchers.consistent_hashing",
+                     "category":"envoy.matching.input_matchers",
+                     "type_urls":[
+                        "envoy.extensions.matching.input_matchers.consistent_hashing.v3.ConsistentHashing"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.matchers.ip",
+                     "category":"envoy.matching.input_matchers",
+                     "type_urls":[
+                        "envoy.extensions.matching.input_matchers.ip.v3.Ip"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.matchers.runtime_fraction",
+                     "category":"envoy.matching.input_matchers",
+                     "type_urls":[
+                        "envoy.extensions.matching.input_matchers.runtime_fraction.v3.RuntimeFraction"
+                     ]
+                  },
+                  {
+                     "name":"envoy.grpc_credentials.aws_iam",
+                     "category":"envoy.grpc_credentials"
+                  },
+                  {
+                     "name":"envoy.grpc_credentials.default",
+                     "category":"envoy.grpc_credentials"
+                  },
+                  {
+                     "name":"envoy.grpc_credentials.file_based_metadata",
+                     "category":"envoy.grpc_credentials"
+                  },
+                  {
+                     "name":"envoy.config_subscription.ads",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.ads_collection",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.aggregated_grpc_collection",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.delta_grpc",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.delta_grpc_collection",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.filesystem",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.filesystem_collection",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.grpc",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.config_subscription.rest",
+                     "category":"envoy.config_subscription"
+                  },
+                  {
+                     "name":"envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                     "category":"envoy.upstream_options",
+                     "type_urls":[
+                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+                     ]
+                  },
+                  {
+                     "name":"envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions",
+                     "category":"envoy.upstream_options",
+                     "type_urls":[
+                        "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions"
+                     ]
+                  },
+                  {
+                     "name":"envoy.upstreams.http.http_protocol_options",
+                     "category":"envoy.upstream_options"
+                  },
+                  {
+                     "name":"envoy.upstreams.tcp.tcp_protocol_options",
+                     "category":"envoy.upstream_options"
+                  },
+                  {
+                     "name":"envoy.health_checkers.grpc",
+                     "category":"envoy.health_checkers",
+                     "type_urls":[
+                        "envoy.config.core.v3.HealthCheck.GrpcHealthCheck"
+                     ]
+                  },
+                  {
+                     "name":"envoy.health_checkers.http",
+                     "category":"envoy.health_checkers",
+                     "type_urls":[
+                        "envoy.config.core.v3.HealthCheck.HttpHealthCheck"
+                     ]
+                  },
+                  {
+                     "name":"envoy.health_checkers.redis",
+                     "category":"envoy.health_checkers",
+                     "type_urls":[
+                        "envoy.extensions.health_checkers.redis.v3.Redis"
+                     ]
+                  },
+                  {
+                     "name":"envoy.health_checkers.tcp",
+                     "category":"envoy.health_checkers",
+                     "type_urls":[
+                        "envoy.config.core.v3.HealthCheck.TcpHealthCheck"
+                     ]
+                  },
+                  {
+                     "name":"envoy.health_checkers.thrift",
+                     "category":"envoy.health_checkers",
+                     "type_urls":[
+                        "envoy.extensions.health_checkers.thrift.v3.Thrift"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.stateful_header_formatters.preserve_case",
+                     "category":"envoy.http.stateful_header_formatters",
+                     "type_urls":[
+                        "envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig"
+                     ]
+                  },
+                  {
+                     "name":"preserve_case",
+                     "category":"envoy.http.stateful_header_formatters"
+                  },
+                  {
+                     "name":"envoy.filters.connection_pools.tcp.generic",
+                     "category":"envoy.upstreams",
+                     "type_urls":[
+                        "envoy.extensions.upstreams.tcp.generic.v3.GenericConnectionPoolProto"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.cluster_provided",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.least_request",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.maglev",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.maglev.v3.Maglev"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.random",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.random.v3.Random"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.ring_hash",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.round_robin",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin"
+                     ]
+                  },
+                  {
+                     "name":"envoy.load_balancing_policies.subset",
+                     "category":"envoy.load_balancing_policies",
+                     "type_urls":[
+                        "envoy.extensions.load_balancing_policies.subset.v3.Subset"
+                     ]
+                  },
+                  {
+                     "name":"envoy.retry_host_predicates.omit_canary_hosts",
+                     "category":"envoy.retry_host_predicates",
+                     "type_urls":[
+                        "envoy.extensions.retry.host.omit_canary_hosts.v3.OmitCanaryHostsPredicate"
+                     ]
+                  },
+                  {
+                     "name":"envoy.retry_host_predicates.omit_host_metadata",
+                     "category":"envoy.retry_host_predicates",
+                     "type_urls":[
+                        "envoy.extensions.retry.host.omit_host_metadata.v3.OmitHostMetadataConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.retry_host_predicates.previous_hosts",
+                     "category":"envoy.retry_host_predicates",
+                     "type_urls":[
+                        "envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
+                     ]
+                  },
+                  {
+                     "name":"envoy.path.match.uri_template.uri_template_matcher",
+                     "category":"envoy.path.match",
+                     "type_urls":[
+                        "envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.alts",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.alts.v3.Alts"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.http_11_proxy",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.internal_upstream",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.quic",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.quic.v3.QuicUpstreamTransport"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.raw_buffer",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.starttls",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tap",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tap.v3.Tap"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tcp_stats",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tls",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.upstream_proxy_protocol",
+                     "category":"envoy.transport_sockets.upstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport"
+                     ]
+                  },
+                  {
+                     "name":"raw_buffer",
+                     "category":"envoy.transport_sockets.upstream"
+                  },
+                  {
+                     "name":"starttls",
+                     "category":"envoy.transport_sockets.upstream"
+                  },
+                  {
+                     "name":"tls",
+                     "category":"envoy.transport_sockets.upstream"
+                  },
+                  {
+                     "name":"envoy.bandwidth_limit",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.buffer",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.cors",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.csrf",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.ext_authz",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.ext_proc",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.fault",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.filters.http.adaptive_concurrency",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.adaptive_concurrency.v3.AdaptiveConcurrency"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.admission_control",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.alternate_protocols_cache",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.alternate_protocols_cache.v3.FilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.aws_lambda",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.aws_lambda.v3.Config",
+                        "envoy.extensions.filters.http.aws_lambda.v3.PerRouteConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.aws_request_signing",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigning",
+                        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigningPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.bandwidth_limit",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.bandwidth_limit.v3.BandwidthLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.buffer",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.buffer.v3.Buffer",
+                        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.cache",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.cache.v3.CacheConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.cdn_loop",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.cdn_loop.v3.CdnLoopConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.composite",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.composite.v3.Composite"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.compressor",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.compressor.v3.Compressor",
+                        "envoy.extensions.filters.http.compressor.v3.CompressorPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.connect_grpc_bridge",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.cors",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.cors.v3.Cors",
+                        "envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.csrf",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.csrf.v3.CsrfPolicy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.custom_response",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.custom_response.v3.CustomResponse"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.decompressor",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.decompressor.v3.Decompressor"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.dynamic_forward_proxy",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig",
+                        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.ext_authz",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.ext_proc",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.ext_proc.v3.ExtProcPerRoute",
+                        "envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.fault",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.fault.v3.HTTPFault"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.file_system_buffer",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.file_system_buffer.v3.FileSystemBufferFilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.gcp_authn",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.geoip",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.geoip.v3.Geoip"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_field_extraction",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_field_extraction.v3.GrpcFieldExtractionConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_http1_bridge",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_http1_reverse_bridge",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig",
+                        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_json_transcoder",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_stats",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_stats.v3.FilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.grpc_web",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.header_mutation",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
+                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.header_to_metadata",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.header_to_metadata.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.health_check",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.health_check.v3.HealthCheck"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.ip_tagging",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.ip_tagging.v3.IPTagging"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.jwt_authn",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication",
+                        "envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.local_ratelimit",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.lua",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.lua.v3.Lua",
+                        "envoy.extensions.filters.http.lua.v3.LuaPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.match_delegate",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.common.matching.v3.ExtensionWithMatcher",
+                        "envoy.extensions.common.matching.v3.ExtensionWithMatcherPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.oauth2",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.oauth2.v3.OAuth2"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.on_demand",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.on_demand.v3.OnDemand",
+                        "envoy.extensions.filters.http.on_demand.v3.PerRouteConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.original_src",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.original_src.v3.OriginalSrc"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.rate_limit_quota",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaFilterConfig",
+                        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.ratelimit",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+                        "envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.rbac",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.rbac.v3.RBAC",
+                        "envoy.extensions.filters.http.rbac.v3.RBACPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.router",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.router.v3.Router"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.set_metadata",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.set_metadata.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.stateful_session",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.stateful_session.v3.StatefulSession",
+                        "envoy.extensions.filters.http.stateful_session.v3.StatefulSessionPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.tap",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.tap.v3.Tap"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.wasm",
+                     "category":"envoy.filters.http",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.wasm.v3.Wasm"
+                     ]
+                  },
+                  {
+                     "name":"envoy.geoip",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.grpc_http1_bridge",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.grpc_json_transcoder",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.grpc_web",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.health_check",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.ip_tagging",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.local_rate_limit",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.lua",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.rate_limit",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.router",
+                     "category":"envoy.filters.http"
+                  },
+                  {
+                     "name":"envoy.matching.common_inputs.environment_variable",
+                     "category":"envoy.matching.common_inputs",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.environment_variable.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.tls.cert_validator.default",
+                     "category":"envoy.tls.cert_validator"
+                  },
+                  {
+                     "name":"envoy.tls.cert_validator.spiffe",
+                     "category":"envoy.tls.cert_validator"
+                  },
+                  {
+                     "name":"envoy.config_mux.delta_grpc_mux_factory",
+                     "category":"envoy.config_mux"
+                  },
+                  {
+                     "name":"envoy.config_mux.grpc_mux_factory",
+                     "category":"envoy.config_mux"
+                  },
+                  {
+                     "name":"envoy.config_mux.new_grpc_mux_factory",
+                     "category":"envoy.config_mux"
+                  },
+                  {
+                     "name":"envoy.config_mux.sotw_grpc_mux_factory",
+                     "category":"envoy.config_mux"
+                  },
+                  {
+                     "name":"envoy.buffer",
+                     "category":"envoy.filters.http.upstream"
+                  },
+                  {
+                     "name":"envoy.filters.http.admission_control",
+                     "category":"envoy.filters.http.upstream",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.buffer",
+                     "category":"envoy.filters.http.upstream",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.buffer.v3.Buffer",
+                        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.header_mutation",
+                     "category":"envoy.filters.http.upstream",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
+                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.http.upstream_codec",
+                     "category":"envoy.filters.http.upstream",
+                     "type_urls":[
+                        "envoy.extensions.filters.http.upstream_codec.v3.UpstreamCodec"
+                     ]
+                  },
+                  {
+                     "name":"envoy.wasm.runtime.null",
+                     "category":"envoy.wasm.runtime"
+                  },
+                  {
+                     "name":"envoy.wasm.runtime.v8",
+                     "category":"envoy.wasm.runtime"
+                  },
+                  {
+                     "name":"envoy.internal_redirect_predicates.allow_listed_routes",
+                     "category":"envoy.internal_redirect_predicates",
+                     "type_urls":[
+                        "envoy.extensions.internal_redirect.allow_listed_routes.v3.AllowListedRoutesConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.internal_redirect_predicates.previous_routes",
+                     "category":"envoy.internal_redirect_predicates",
+                     "type_urls":[
+                        "envoy.extensions.internal_redirect.previous_routes.v3.PreviousRoutesConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.internal_redirect_predicates.safe_cross_scheme",
+                     "category":"envoy.internal_redirect_predicates",
+                     "type_urls":[
+                        "envoy.extensions.internal_redirect.safe_cross_scheme.v3.SafeCrossSchemeConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.alts",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.alts.v3.Alts"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.quic",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.raw_buffer",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.starttls",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tap",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tap.v3.Tap"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tcp_stats",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.transport_sockets.tls",
+                     "category":"envoy.transport_sockets.downstream",
+                     "type_urls":[
+                        "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext"
+                     ]
+                  },
+                  {
+                     "name":"raw_buffer",
+                     "category":"envoy.transport_sockets.downstream"
+                  },
+                  {
+                     "name":"starttls",
+                     "category":"envoy.transport_sockets.downstream"
+                  },
+                  {
+                     "name":"tls",
+                     "category":"envoy.transport_sockets.downstream"
+                  },
+                  {
+                     "name":"envoy.config.validators.minimum_clusters",
+                     "category":"envoy.config.validators"
+                  },
+                  {
+                     "name":"envoy.config.validators.minimum_clusters_validator",
+                     "category":"envoy.config.validators",
+                     "type_urls":[
+                        "envoy.extensions.config.validators.minimum_clusters.v3.MinimumClustersValidator"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.file",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.file.v3.FileAccessLog"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.http_grpc",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.open_telemetry",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.stderr",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.stream.v3.StderrAccessLog"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.stdout",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.stream.v3.StdoutAccessLog"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.tcp_grpc",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.wasm",
+                     "category":"envoy.access_loggers",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.wasm.v3.WasmAccessLog"
+                     ]
+                  },
+                  {
+                     "name":"envoy.file_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.http_grpc_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.open_telemetry_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.stderr_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.stdout_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.tcp_grpc_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"envoy.wasm_access_log",
+                     "category":"envoy.access_loggers"
+                  },
+                  {
+                     "name":"dubbo",
+                     "category":"envoy.dubbo_proxy.protocols"
+                  },
+                  {
+                     "name":"auto",
+                     "category":"envoy.thrift_proxy.protocols"
+                  },
+                  {
+                     "name":"binary",
+                     "category":"envoy.thrift_proxy.protocols"
+                  },
+                  {
+                     "name":"binary/non-strict",
+                     "category":"envoy.thrift_proxy.protocols"
+                  },
+                  {
+                     "name":"compact",
+                     "category":"envoy.thrift_proxy.protocols"
+                  },
+                  {
+                     "name":"twitter",
+                     "category":"envoy.thrift_proxy.protocols"
+                  },
+                  {
+                     "name":"envoy.route.early_data_policy.default",
+                     "category":"envoy.route.early_data_policy",
+                     "type_urls":[
+                        "envoy.extensions.early_data.v3.DefaultEarlyDataPolicy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.brotli.decompressor",
+                     "category":"envoy.compression.decompressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.brotli.decompressor.v3.Brotli"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.gzip.decompressor",
+                     "category":"envoy.compression.decompressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.gzip.decompressor.v3.Gzip"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.zstd.decompressor",
+                     "category":"envoy.compression.decompressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.zstd.decompressor.v3.Zstd"
+                     ]
+                  },
+                  {
+                     "name":"envoy.health_check.event_sink.file",
+                     "category":"envoy.health_check.event_sinks",
+                     "type_urls":[
+                        "envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink"
+                     ]
+                  },
+                  {
+                     "name":"default",
+                     "category":"network.connection.client"
+                  },
+                  {
+                     "name":"envoy_internal",
+                     "category":"network.connection.client"
+                  },
+                  {
+                     "name":"envoy.regex_engines.google_re2",
+                     "category":"envoy.regex_engines",
+                     "type_urls":[
+                        "envoy.extensions.regex_engines.v3.GoogleRE2"
+                     ]
+                  },
+                  {
+                     "name":"envoy.access_loggers.extension_filters.cel",
+                     "category":"envoy.access_loggers.extension_filters",
+                     "type_urls":[
+                        "envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.early_header_mutation.header_mutation",
+                     "category":"envoy.http.early_header_mutation",
+                     "type_urls":[
+                        "envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.cel_data_input",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "xds.type.matcher.v3.HttpAttributesCelMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.destination_ip",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.destination_port",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.direct_source_ip",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.dns_san",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.request_headers",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpRequestHeaderMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.request_trailers",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpRequestTrailerMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.response_headers",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpResponseHeaderMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.response_trailers",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpResponseTrailerMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.server_name",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_ip",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_port",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_type",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.status_code_class_input",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpResponseStatusCodeClassMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.status_code_input",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpResponseStatusCodeMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.subject",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.uri_san",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
+                     ]
+                  },
+                  {
+                     "name":"query_params",
+                     "category":"envoy.matching.http.input",
+                     "type_urls":[
+                        "envoy.type.matcher.v3.HttpRequestQueryParamMatchInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.formatter.cel",
+                     "category":"envoy.formatter",
+                     "type_urls":[
+                        "envoy.extensions.formatter.cel.v3.Cel"
+                     ]
+                  },
+                  {
+                     "name":"envoy.formatter.metadata",
+                     "category":"envoy.formatter",
+                     "type_urls":[
+                        "envoy.extensions.formatter.metadata.v3.Metadata"
+                     ]
+                  },
+                  {
+                     "name":"envoy.formatter.req_without_query",
+                     "category":"envoy.formatter",
+                     "type_urls":[
+                        "envoy.extensions.formatter.req_without_query.v3.ReqWithoutQuery"
+                     ]
+                  },
+                  {
+                     "name":"envoy.ip",
+                     "category":"envoy.resolvers"
+                  },
+                  {
+                     "name":"envoy.filters.dubbo.router",
+                     "category":"envoy.dubbo_proxy.filters",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.dubbo_proxy.router.v3.Router"
+                     ]
+                  },
+                  {
+                     "name":"envoy.bootstrap.internal_listener",
+                     "category":"envoy.bootstrap",
+                     "type_urls":[
+                        "envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
+                     ]
+                  },
+                  {
+                     "name":"envoy.bootstrap.wasm",
+                     "category":"envoy.bootstrap",
+                     "type_urls":[
+                        "envoy.extensions.wasm.v3.WasmService"
+                     ]
+                  },
+                  {
+                     "name":"envoy.extensions.network.socket_interface.default_socket_interface",
+                     "category":"envoy.bootstrap",
+                     "type_urls":[
+                        "envoy.extensions.network.socket_interface.v3.DefaultSocketInterface"
+                     ]
+                  },
+                  {
+                     "name":"envoy.udp_packet_writer.default",
+                     "category":"envoy.udp_packet_writer",
+                     "type_urls":[
+                        "envoy.extensions.udp_packet_writer.v3.UdpDefaultWriterFactory"
+                     ]
+                  },
+                  {
+                     "name":"envoy.udp_packet_writer.gso",
+                     "category":"envoy.udp_packet_writer",
+                     "type_urls":[
+                        "envoy.extensions.udp_packet_writer.v3.UdpGsoBatchWriterFactory"
+                     ]
+                  },
+                  {
+                     "name":"envoy.retry_priorities.previous_priorities",
+                     "category":"envoy.retry_priorities",
+                     "type_urls":[
+                        "envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.listener_manager_impl.default",
+                     "category":"envoy.listener_manager_impl",
+                     "type_urls":[
+                        "envoy.config.listener.v3.ListenerManager"
+                     ]
+                  },
+                  {
+                     "name":"envoy.listener_manager_impl.validation",
+                     "category":"envoy.listener_manager_impl",
+                     "type_urls":[
+                        "envoy.config.listener.v3.ValidationListenerManager"
+                     ]
+                  },
+                  {
+                     "name":"envoy.quic.proof_source.filter_chain",
+                     "category":"envoy.quic.proof_source",
+                     "type_urls":[
+                        "envoy.extensions.quic.proof_source.v3.ProofSourceConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.brotli.compressor",
+                     "category":"envoy.compression.compressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.brotli.compressor.v3.Brotli"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.gzip.compressor",
+                     "category":"envoy.compression.compressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.gzip.compressor.v3.Gzip"
+                     ]
+                  },
+                  {
+                     "name":"envoy.compression.zstd.compressor",
+                     "category":"envoy.compression.compressor",
+                     "type_urls":[
+                        "envoy.extensions.compression.zstd.compressor.v3.Zstd"
+                     ]
+                  },
+                  {
+                     "name":"envoy.quic.deterministic_connection_id_generator",
+                     "category":"envoy.quic.connection_id_generator",
+                     "type_urls":[
+                        "envoy.extensions.quic.connection_id_generator.v3.DeterministicConnectionIdGeneratorConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.watchdog.abort_action",
+                     "category":"envoy.guarddog_actions",
+                     "type_urls":[
+                        "envoy.watchdog.v3.AbortActionConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.watchdog.profile_action",
+                     "category":"envoy.guarddog_actions",
+                     "type_urls":[
+                        "envoy.extensions.watchdog.profile_action.v3.ProfileActionConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.cluster.eds",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.cluster.logical_dns",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.cluster.original_dst",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.cluster.static",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.cluster.strict_dns",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.clusters.aggregate",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.clusters.dynamic_forward_proxy",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.clusters.redis",
+                     "category":"envoy.clusters"
+                  },
+                  {
+                     "name":"envoy.extensions.http.cache.file_system_http_cache",
+                     "category":"envoy.http.cache",
+                     "type_urls":[
+                        "envoy.extensions.http.cache.file_system_http_cache.v3.FileSystemHttpCacheConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.extensions.http.cache.simple",
+                     "category":"envoy.http.cache",
+                     "type_urls":[
+                        "envoy.extensions.http.cache.simple_http_cache.v3.SimpleHttpCacheConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.custom_matchers.trie_matcher",
+                     "category":"envoy.matching.network.custom_matchers",
+                     "type_urls":[
+                        "xds.type.matcher.v3.IPMatcher"
+                     ]
+                  },
+                  {
+                     "name":"envoy.quic.crypto_stream.server.quiche",
+                     "category":"envoy.quic.server.crypto_stream",
+                     "type_urls":[
+                        "envoy.extensions.quic.crypto_stream.v3.CryptoServerStreamConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.request_id.uuid",
+                     "category":"envoy.request_id",
+                     "type_urls":[
+                        "envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.actions.format_string",
+                     "category":"envoy.matching.action",
+                     "type_urls":[
+                        "envoy.config.core.v3.SubstitutionFormatString"
+                     ]
+                  },
+                  {
+                     "name":"filter-chain-name",
+                     "category":"envoy.matching.action",
+                     "type_urls":[
+                        "google.protobuf.StringValue"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.thrift.header_to_metadata",
+                     "category":"envoy.thrift_proxy.filters",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.thrift_proxy.filters.header_to_metadata.v3.HeaderToMetadata"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.thrift.payload_to_metadata",
+                     "category":"envoy.thrift_proxy.filters",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.thrift_proxy.filters.payload_to_metadata.v3.PayloadToMetadata"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.thrift.rate_limit",
+                     "category":"envoy.thrift_proxy.filters",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.thrift.router",
+                     "category":"envoy.thrift_proxy.filters",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.thrift_proxy.router.v3.Router"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.application_protocol",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.destination_ip",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.destination_port",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.direct_source_ip",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.dns_san",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.filter_state",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.FilterStateInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.server_name",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_ip",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_port",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.source_type",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.subject",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.transport_protocol",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.matching.inputs.uri_san",
+                     "category":"envoy.matching.network.input",
+                     "type_urls":[
+                        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.stateful_session.cookie",
+                     "category":"envoy.http.stateful_session",
+                     "type_urls":[
+                        "envoy.extensions.http.stateful_session.cookie.v3.CookieBasedSessionState"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http.stateful_session.header",
+                     "category":"envoy.http.stateful_session",
+                     "type_urls":[
+                        "envoy.extensions.http.stateful_session.header.v3.HeaderBasedSessionState"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.http_inspector",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.http_inspector.v3.HttpInspector"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.local_ratelimit",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.original_dst",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.original_src",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.original_src.v3.OriginalSrc"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.proxy_protocol",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.listener.tls_inspector",
+                     "category":"envoy.filters.listener",
+                     "type_urls":[
+                        "envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+                     ]
+                  },
+                  {
+                     "name":"envoy.listener.http_inspector",
+                     "category":"envoy.filters.listener"
+                  },
+                  {
+                     "name":"envoy.listener.original_dst",
+                     "category":"envoy.filters.listener"
+                  },
+                  {
+                     "name":"envoy.listener.original_src",
+                     "category":"envoy.filters.listener"
+                  },
+                  {
+                     "name":"envoy.listener.proxy_protocol",
+                     "category":"envoy.filters.listener"
+                  },
+                  {
+                     "name":"envoy.listener.tls_inspector",
+                     "category":"envoy.filters.listener"
+                  },
+                  {
+                     "name":"envoy.rbac.matchers.upstream_ip_port",
+                     "category":"envoy.rbac.matchers",
+                     "type_urls":[
+                        "envoy.extensions.rbac.matchers.upstream_ip_port.v3.UpstreamIpPortMatcher"
+                     ]
+                  },
+                  {
+                     "name":"quic.server_preferred_address.fixed",
+                     "category":"envoy.quic.server_preferred_address",
+                     "type_urls":[
+                        "envoy.extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.echo",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.ext_authz",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.filters.network.connection_limit",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.direct_response",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.direct_response.v3.Config"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.dubbo_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.dubbo_proxy.v3.DubboProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.echo",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.echo.v3.Echo"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.ext_authz",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.ext_authz.v3.ExtAuthz"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.http_connection_manager",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.local_ratelimit",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.local_ratelimit.v3.LocalRateLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.mongo_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.ratelimit",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.ratelimit.v3.RateLimit"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.rbac",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.rbac.v3.RBAC"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.redis_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.redis_proxy.v3.RedisProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.sni_cluster",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.sni_dynamic_forward_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.tcp_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.thrift_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.thrift_proxy.v3.ThriftProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.wasm",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.wasm.v3.Wasm"
+                     ]
+                  },
+                  {
+                     "name":"envoy.filters.network.zookeeper_proxy",
+                     "category":"envoy.filters.network",
+                     "type_urls":[
+                        "envoy.extensions.filters.network.zookeeper_proxy.v3.ZooKeeperProxy"
+                     ]
+                  },
+                  {
+                     "name":"envoy.http_connection_manager",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.mongo_proxy",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.ratelimit",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.redis_proxy",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"envoy.tcp_proxy",
+                     "category":"envoy.filters.network"
+                  },
+                  {
+                     "name":"dubbo.hessian2",
+                     "category":"envoy.dubbo_proxy.serializers"
+                  },
+                  {
+                     "name":"quic.http_server_connection.default",
+                     "category":"quic.http_server_connection"
+                  },
+                  {
+                     "name":"envoy.dog_statsd",
+                     "category":"envoy.stats_sinks"
+                  },
+                  {
+                     "name":"envoy.graphite_statsd",
+                     "category":"envoy.stats_sinks"
+                  },
+                  {
+                     "name":"envoy.metrics_service",
+                     "category":"envoy.stats_sinks"
+                  },
+                  {
+                     "name":"envoy.open_telemetry_stat_sink",
+                     "category":"envoy.stats_sinks"
+                  },
+                  {
+                     "name":"envoy.stat_sinks.dog_statsd",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.config.metrics.v3.DogStatsdSink"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.graphite_statsd",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.extensions.stat_sinks.graphite_statsd.v3.GraphiteStatsdSink"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.hystrix",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.config.metrics.v3.HystrixSink"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.metrics_service",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.config.metrics.v3.MetricsServiceConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.open_telemetry",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.statsd",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.config.metrics.v3.StatsdSink"
+                     ]
+                  },
+                  {
+                     "name":"envoy.stat_sinks.wasm",
+                     "category":"envoy.stats_sinks",
+                     "type_urls":[
+                        "envoy.extensions.stat_sinks.wasm.v3.Wasm"
+                     ]
+                  },
+                  {
+                     "name":"envoy.statsd",
+                     "category":"envoy.stats_sinks"
+                  },
+                  {
+                     "name":"envoy.resource_monitors.fixed_heap",
+                     "category":"envoy.resource_monitors",
+                     "type_urls":[
+                        "envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.resource_monitors.injected_resource",
+                     "category":"envoy.resource_monitors",
+                     "type_urls":[
+                        "envoy.extensions.resource_monitors.injected_resource.v3.InjectedResourceConfig"
+                     ]
+                  },
+                  {
+                     "name":"auto",
+                     "category":"envoy.thrift_proxy.transports"
+                  },
+                  {
+                     "name":"framed",
+                     "category":"envoy.thrift_proxy.transports"
+                  },
+                  {
+                     "name":"header",
+                     "category":"envoy.thrift_proxy.transports"
+                  },
+                  {
+                     "name":"unframed",
+                     "category":"envoy.thrift_proxy.transports"
+                  },
+                  {
+                     "name":"envoy.http.header_validators.envoy_default",
+                     "category":"envoy.http.header_validators",
+                     "type_urls":[
+                        "envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.path.rewrite.uri_template.uri_template_rewriter",
+                     "category":"envoy.path.rewrite",
+                     "type_urls":[
+                        "envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig"
+                     ]
+                  },
+                  {
+                     "name":"envoy.key_value.file_based",
+                     "category":"envoy.common.key_value",
+                     "type_urls":[
+                        "envoy.extensions.key_value.file_based.v3.FileBasedKeyValueStoreConfig"
+                     ]
+                  }
+               ]
+            },
+            "static_resources":{
+               "clusters":[
+                  {
+                     "name":"xds_cluster",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"1s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/adapter.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "upstream_connection_options":{
+                        "tcp_keepalive":{
+                           "keepalive_probes":3,
+                           "keepalive_time":300,
+                           "keepalive_interval":30
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"xds_cluster",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"apk-perftest-wso2-apk-adapter-service.apk-perf-test.svc",
+                                             "port_value":18000
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     },
+                     "typed_extension_protocol_options":{
+                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                           "explicit_http_config":{
+                              "http2_protocol_options":{
+                                 
+                              }
+                           }
+                        }
+                     }
+                  },
+                  {
+                     "name":"ext-authz",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"20s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"ext-authz",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"127.0.0.1",
+                                             "port_value":8081
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     },
+                     "typed_extension_protocol_options":{
+                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                           "explicit_http_config":{
+                              "http2_protocol_options":{
+                                 
+                              }
+                           }
+                        }
+                     }
+                  },
+                  {
+                     "name":"access-logger",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"200s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"access-logger",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"127.0.0.1",
+                                             "port_value":18090
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     },
+                     "typed_extension_protocol_options":{
+                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                           "explicit_http_config":{
+                              "http2_protocol_options":{
+                                 
+                              }
+                           }
+                        }
+                     }
+                  },
+                  {
+                     "name":"token_cluster",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"20s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"token_cluster",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"127.0.0.1",
+                                             "port_value":8082
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     }
+                  },
+                  {
+                     "name":"jwks_cluster",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"20s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"jwks_cluster",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"127.0.0.1",
+                                             "port_value":9092
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     }
+                  },
+                  {
+                     "name":"api_definition_cluster",
+                     "type":"STRICT_DNS",
+                     "connect_timeout":"20s",
+                     "transport_socket":{
+                        "name":"envoy.transport_sockets.tls",
+                        "typed_config":{
+                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                           "common_tls_context":{
+                              "tls_params":{
+                                 "tls_minimum_protocol_version":"TLSv1_2",
+                                 "tls_maximum_protocol_version":"TLSv1_2"
+                              },
+                              "tls_certificates":[
+                                 {
+                                    "certificate_chain":{
+                                       "filename":"/home/wso2/security/keystore/router.crt"
+                                    },
+                                    "private_key":{
+                                       "filename":"[redacted]"
+                                    }
+                                 }
+                              ],
+                              "validation_context":{
+                                 "trusted_ca":{
+                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
+                                 }
+                              }
+                           }
+                        }
+                     },
+                     "load_assignment":{
+                        "cluster_name":"api_definition_cluster",
+                        "endpoints":[
+                           {
+                              "lb_endpoints":[
+                                 {
+                                    "endpoint":{
+                                       "address":{
+                                          "socket_address":{
+                                             "address":"127.0.0.1",
+                                             "port_value":8084
+                                          }
+                                       }
+                                    }
+                                 }
+                              ]
+                           }
+                        ]
+                     }
+                  }
+               ]
+            },
+            "dynamic_resources":{
+               "lds_config":{
+                  "ads":{
+                     
+                  },
+                  "resource_api_version":"V3"
+               },
+               "cds_config":{
+                  "ads":{
+                     
+                  },
+                  "resource_api_version":"V3"
+               },
+               "ads_config":{
+                  "api_type":"GRPC",
+                  "grpc_services":[
+                     {
+                        "envoy_grpc":{
+                           "cluster_name":"xds_cluster"
+                        }
+                     }
+                  ],
+                  "transport_api_version":"V3"
+               }
+            },
+            "admin":{
+               "address":{
+                  "socket_address":{
+                     "address":"0.0.0.0",
+                     "port_value":9000
+                  }
+               }
+            },
+            "layered_runtime":{
+               "layers":[
+                  {
+                     "name":"deprecation",
+                     "static_layer":{
+                        "re2.max_program_size.error_level":1000
+                     }
+                  },
+                  {
+                     "name":"globalMaxConnections",
+                     "static_layer":{
+                        "overload.global_downstream_max_connections":2147483647
+                     }
+                  }
+               ]
+            }
+         },
+         "last_updated":"2023-08-23T06:41:52.684Z"
+      },
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.ClustersConfigDump",
+         "version_info":"71006550",
+         "static_clusters":[
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"access-logger",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"200s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"access-logger",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"127.0.0.1",
+                                          "port_value":18090
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http2_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.692Z"
+            },
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"api_definition_cluster",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"api_definition_cluster",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"127.0.0.1",
+                                          "port_value":8084
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.695Z"
+            },
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"ext-authz",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"ext-authz",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"127.0.0.1",
+                                          "port_value":8081
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http2_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.691Z"
+            },
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"jwks_cluster",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"jwks_cluster",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"127.0.0.1",
+                                          "port_value":9092
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.694Z"
+            },
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"token_cluster",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"token_cluster",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"127.0.0.1",
+                                          "port_value":8082
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.693Z"
+            },
+            {
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"xds_cluster",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"1s",
+                  "transport_socket":{
+                     "name":"envoy.transport_sockets.tls",
+                     "typed_config":{
+                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                        "common_tls_context":{
+                           "tls_params":{
+                              "tls_minimum_protocol_version":"TLSv1_2",
+                              "tls_maximum_protocol_version":"TLSv1_2"
+                           },
+                           "tls_certificates":[
+                              {
+                                 "certificate_chain":{
+                                    "filename":"/home/wso2/security/keystore/router.crt"
+                                 },
+                                 "private_key":{
+                                    "filename":"[redacted]"
+                                 }
+                              }
+                           ],
+                           "validation_context":{
+                              "trusted_ca":{
+                                 "filename":"/home/wso2/security/truststore/adapter.crt"
+                              }
+                           }
+                        }
+                     }
+                  },
+                  "upstream_connection_options":{
+                     "tcp_keepalive":{
+                        "keepalive_probes":3,
+                        "keepalive_time":300,
+                        "keepalive_interval":30
+                     }
+                  },
+                  "load_assignment":{
+                     "cluster_name":"xds_cluster",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-adapter-service.apk-perf-test.svc",
+                                          "port_value":18000
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http2_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.690Z"
+            }
+         ],
+         "dynamic_active_clusters":[
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__api.am.wso2.com_WSO2APKConfigDeployerAPI1.0.0_f1ddda8c-e084-487f-9981-90d5f676d7d10",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__api.am.wso2.com_WSO2APKConfigDeployerAPI1.0.0_f1ddda8c-e084-487f-9981-90d5f676d7d10",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpVENDQW5HZ0F3SUJBZ0lRTUVqV25QM0o1Rnd6TGtUWjhkTDEvREFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYwpNUm93R0FZRFZRUURFeEZqYjI1bWFXY3RaSE10YzJWeWRtbGpaVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTHV6V24yU2ZNR1k3TVgwZjBDSkxHeXpuUXM3akY5dzJzMitaV2h4bzF3RmNtWWsKRS96Q2pSajNQTE00amFUbndQUkxtTWpIR0RxQVJxV2J1aFVwOEUxTXhKakc1eVlhNnFKRWV1eUVPSjhFNktXYgphWmNpVFFpUEVBRjNpZ29nb0JhdWQzUFVvRU45dE1iQ2lQam15MitnLytxMlFQTVl6WEpUQzhpVEpMOGFGcG54CkdnMVdGUVJzbEZYaFhSRnMzVzJDVkZUNVhOb2Mvam5TWDc4cDU4Y0l4ekR3QUdTV2dtSGtXcEV3d0RUMTZkL1oKRU1DUk9RM01PM2x3Tm9hMXJBZU5qK2t2QTNlY1krZWl0MUVweUNsQk4yV0xIRGtsUHdCcnZCU2V1TVoxaEovNwpZbGl6TlN5b1BGV2ttSzMweEVhMUlBR1ZSc0sramxPQlVja2J2Z2NDQXdFQUFhT0IxRENCMFRBT0JnTlZIUThCCkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmwKaHVMWFVKYVBCekNCandZRFZSMFJCSUdITUlHRWdqbGhjR3N0Y0dWeVpuUmxjM1F0ZDNOdk1pMWhjR3N0WTI5dQpabWxuTFdSekxYTmxjblpwWTJVdVlYQnJMWEJsY21ZdGRHVnpkQzV6ZG1PQ1IyRndheTF3WlhKbWRHVnpkQzEzCmMyOHlMV0Z3YXkxamIyNW1hV2N0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnoKZEdWeUxteHZZMkZzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCaHZ0Wk53TG1lUnIzTE9uNmhYT2R4anpHRwpjZXNsQUc0RHYwak1BT1lHNnNVbnA4UGx4cmdEeWsvcTJuWEFvbTl5d0lOczMrTHZCMytxeHJkOWJXOUZLRFJjClZ6OWR1dlIvOW05NHFtcnU2d3ZWS3Nlb1VLWTFrZlhBZm0zeVQwd0gzOFdxWFIzMWtheU9CUDdRQmdIbUF3OXQKWVpzL01JSTNHWjhJdnlzRzhVaEtrYWM0aSsxKzkrcCsvOFVBblM3NGt5b3FyQnVBdjBLNnZqNDhvd3Y5TmpCSwprcnlqdzVCU01LcXN6WXpJVDJPeUFMK3FDcXIvTjhIVEc0VHBIRTNGMXBwbXNwdlJHZWM1OWVSV2lNZGJkY1h6CkdoTkhxcjZIR1o3OWVCWnFwdTdwbndoSGduTEdHZEc3VmJzQTRBTWd0OTErUVVVMFVVbG9XZk9jVUJDbgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.957Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__api.am.wso2.com_WSO2APKConfigGeneratorAPI1.0.0_3fb1c6a2-e9a1-4f1c-94d1-e69f81fc0f9c0",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__api.am.wso2.com_WSO2APKConfigGeneratorAPI1.0.0_3fb1c6a2-e9a1-4f1c-94d1-e69f81fc0f9c0",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpVENDQW5HZ0F3SUJBZ0lRTUVqV25QM0o1Rnd6TGtUWjhkTDEvREFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYwpNUm93R0FZRFZRUURFeEZqYjI1bWFXY3RaSE10YzJWeWRtbGpaVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTHV6V24yU2ZNR1k3TVgwZjBDSkxHeXpuUXM3akY5dzJzMitaV2h4bzF3RmNtWWsKRS96Q2pSajNQTE00amFUbndQUkxtTWpIR0RxQVJxV2J1aFVwOEUxTXhKakc1eVlhNnFKRWV1eUVPSjhFNktXYgphWmNpVFFpUEVBRjNpZ29nb0JhdWQzUFVvRU45dE1iQ2lQam15MitnLytxMlFQTVl6WEpUQzhpVEpMOGFGcG54CkdnMVdGUVJzbEZYaFhSRnMzVzJDVkZUNVhOb2Mvam5TWDc4cDU4Y0l4ekR3QUdTV2dtSGtXcEV3d0RUMTZkL1oKRU1DUk9RM01PM2x3Tm9hMXJBZU5qK2t2QTNlY1krZWl0MUVweUNsQk4yV0xIRGtsUHdCcnZCU2V1TVoxaEovNwpZbGl6TlN5b1BGV2ttSzMweEVhMUlBR1ZSc0sramxPQlVja2J2Z2NDQXdFQUFhT0IxRENCMFRBT0JnTlZIUThCCkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmwKaHVMWFVKYVBCekNCandZRFZSMFJCSUdITUlHRWdqbGhjR3N0Y0dWeVpuUmxjM1F0ZDNOdk1pMWhjR3N0WTI5dQpabWxuTFdSekxYTmxjblpwWTJVdVlYQnJMWEJsY21ZdGRHVnpkQzV6ZG1PQ1IyRndheTF3WlhKbWRHVnpkQzEzCmMyOHlMV0Z3YXkxamIyNW1hV2N0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnoKZEdWeUxteHZZMkZzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCaHZ0Wk53TG1lUnIzTE9uNmhYT2R4anpHRwpjZXNsQUc0RHYwak1BT1lHNnNVbnA4UGx4cmdEeWsvcTJuWEFvbTl5d0lOczMrTHZCMytxeHJkOWJXOUZLRFJjClZ6OWR1dlIvOW05NHFtcnU2d3ZWS3Nlb1VLWTFrZlhBZm0zeVQwd0gzOFdxWFIzMWtheU9CUDdRQmdIbUF3OXQKWVpzL01JSTNHWjhJdnlzRzhVaEtrYWM0aSsxKzkrcCsvOFVBblM3NGt5b3FyQnVBdjBLNnZqNDhvd3Y5TmpCSwprcnlqdzVCU01LcXN6WXpJVDJPeUFMK3FDcXIvTjhIVEc0VHBIRTNGMXBwbXNwdlJHZWM1OWVSV2lNZGJkY1h6CkdoTkhxcjZIR1o3OWVCWnFwdTdwbndoSGduTEdHZEc3VmJzQTRBTWd0OTErUVVVMFVVbG9XZk9jVUJDbgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.964Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__api.am.wso2.com_jwks-domain-service1.0.0_84c6b716-f097-430b-a774-9dc03789f6c10",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__api.am.wso2.com_jwks-domain-service1.0.0_84c6b716-f097-430b-a774-9dc03789f6c10",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc",
+                                          "port_value":9092
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURoakNDQW02Z0F3SUJBZ0lRR3hQcHh5MTFleVVoWVVBZTZveGFOekFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYgpNUmt3RndZRFZRUURFeEJsYm1admNtTmxjaTF6WlhKMmFXTmxNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF6WDR1NW9Db1E1aytVM3E5Ymp5WEFFNEI5QUc4T2wwa0pjRU03Z2ZoNWpGQzI2VUkKcmJKVlBGcUlqemtsTXdPbFBHMXBkS3J4SXVpS2RON3FGa01xMW5rbnNyMUR0RVR5UDhLYXZwbVhaTzlvVWNGTgoreFlYV05XM0Q0YXBnTXAxZDhUMFN3a09Ea3JxR0dJVjBFTnViTndzckI1bXRRdWF2RWhKZ1JSczFyNVVkcVpUClpkby9aNllGdVVNemd5d0ptK2FzbmVkZmJaSFpFNnVFdHVjMWNvSG5veTRkSExCRVh5VWtjMnFMcHkxNDFwYmcKMDJRR2l5M0s2aXdXZlpybFJubVl6WmlwdmpVVy9nMDdNcG1GUUZ3V3J4YWZFblp6akVuME5xMUlUTUZSU3RaNgpDMXVodXFtc0tCeDcyVUJYd1VsZjV3QWQzem5KOTZoS2xzbWIrUUlEQVFBQm80SFNNSUhQTUE0R0ExVWREd0VCCi93UUVBd0lGb0RBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRk04WEFQSEhnaGViZnJ6M2pxV0cKNHRkUWxvOEhNSUdOQmdOVkhSRUVnWVV3Z1lLQ09HRndheTF3WlhKbWRHVnpkQzEzYzI4eUxXRndheTFsYm1adgpjbU5sY2kxelpYSjJhV05sTG1Gd2F5MXdaWEptTFhSbGMzUXVjM1pqZ2taaGNHc3RjR1Z5Wm5SbGMzUXRkM052Ck1pMWhjR3N0Wlc1bWIzSmpaWEl0YzJWeWRtbGpaUzVoY0dzdGNHVnlaaTEwWlhOMExuTjJZeTVqYkhWemRHVnkKTG14dlkyRnNNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNibkUvYkdMdVpwciszdDJXTGc3bjBWVDkzRVdmYwp4T2tUVkRaMHpkVDRNSXJwRkFCSjhibmF0NXMwTVhackdDallBRTFJSS8zOGg1bTZMQjlNVFVlOXU1TGlndGN6Ck9MQkhabCtvRmczMGY2K2xLeEgyTkkyVUJQL1hRSHhOd1VQeGZmN3E5bTRUL3YwZnFEWUV3N1NjWS9zaUVyVWwKSisyVkd4WUhDaG43U0JUdGhDM1JBaHNxQzFVTVczZGxqRGJFNC9QcWVYNjYrZU5ZUkkxLzQ0ZnJQMTh5Y3BNagpQYnRpMEhGbmd6ZlhtQlVHb3FWU1grUUQ0MnQ1TzVkLzhmNDRBdjR0L2UrNVlGaEh2eWV4S0tGemJmcjIxLzhpCkpoSnRiQTdNaE1Db00rQlVlQjVKWU43U1VadURQQWlGamdmTkN2UEVqNjZCaEpIcVpJUWRYdjkzCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.963Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__idp.am.wso2.com_authenticationEndpoint-domain-service1.0.0_d5411075-1b43-4bb5-84bc-4878b2acc0110",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__idp.am.wso2.com_authenticationEndpoint-domain-service1.0.0_d5411075-1b43-4bb5-84bc-4878b2acc0110",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.961Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__idp.am.wso2.com_commonoauth-api1.0.0_7474e658-3105-4b28-9235-d9c356a4ce0c0",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__idp.am.wso2.com_commonoauth-api1.0.0_7474e658-3105-4b28-9235-d9c356a4ce0c0",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.955Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__idp.am.wso2.com_dcr-api1.0.0_25e09b17-0aab-4fa8-bd78-07798fb6137b0",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__idp.am.wso2.com_dcr-api1.0.0_25e09b17-0aab-4fa8-bd78-07798fb6137b0",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.962Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"apk-system__idp.am.wso2.com_oauth-api1.0.0_53c14cf2-8114-436d-8ae4-259b270c91c20",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"apk-system__idp.am.wso2.com_oauth-api1.0.0_53c14cf2-8114-436d-8ae4-259b270c91c20",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
+                                          "port_value":9443
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
+                                    },
+                                    "match_typed_subject_alt_names":[
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                          }
+                                       },
+                                       {
+                                          "san_type":"DNS",
+                                          "matcher":{
+                                             "safe_regex":{
+                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                                             }
+                                          }
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.960Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"default__default.gw.wso2.com_APIDefinitionEndpointDefault3.14_0d0d978c-6250-453e-be04-eba41146a8460",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"default__default.gw.wso2.com_APIDefinitionEndpointDefault3.14_0d0d978c-6250-453e-be04-eba41146a8460",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"backend",
+                                          "port_value":80
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "explicit_http_config":{
+                           "http_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  }
+               },
+               "last_updated":"2023-08-23T06:41:52.957Z"
+            },
+            {
+               "version_info":"71006550",
+               "cluster":{
+                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
+                  "name":"ratelimit",
+                  "type":"STRICT_DNS",
+                  "connect_timeout":"20s",
+                  "dns_refresh_rate":"5s",
+                  "dns_lookup_family":"V4_ONLY",
+                  "load_assignment":{
+                     "cluster_name":"ratelimit",
+                     "endpoints":[
+                        {
+                           "lb_endpoints":[
+                              {
+                                 "endpoint":{
+                                    "address":{
+                                       "socket_address":{
+                                          "address":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc",
+                                          "port_value":8091
+                                       }
+                                    }
+                                 },
+                                 "metadata":{
+                                    "filter_metadata":{
+                                       "envoy.transport_socket_match":{
+                                          "lb_id":"0"
+                                       }
+                                    }
+                                 }
+                              }
+                           ]
+                        }
+                     ]
+                  },
+                  "typed_extension_protocol_options":{
+                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
+                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
+                        "upstream_http_protocol_options":{
+                           "auto_sni":true
+                        },
+                        "explicit_http_config":{
+                           "http2_protocol_options":{
+                              
+                           }
+                        }
+                     }
+                  },
+                  "transport_socket_matches":[
+                     {
+                        "name":"ts0",
+                        "match":{
+                           "lb_id":"0"
+                        },
+                        "transport_socket":{
+                           "name":"envoy.transport_sockets.tls",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
+                              "common_tls_context":{
+                                 "tls_params":{
+                                    "tls_minimum_protocol_version":"TLSv1_1",
+                                    "tls_maximum_protocol_version":"TLSv1_2",
+                                    "cipher_suites":[
+                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
+                                       "ECDHE-RSA-AES128-GCM-SHA256",
+                                       "ECDHE-ECDSA-AES128-SHA",
+                                       "ECDHE-RSA-AES128-SHA",
+                                       "AES128-GCM-SHA256",
+                                       "AES128-SHA",
+                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
+                                       "ECDHE-RSA-AES256-GCM-SHA384",
+                                       "ECDHE-ECDSA-AES256-SHA",
+                                       "ECDHE-RSA-AES256-SHA",
+                                       "AES256-GCM-SHA384",
+                                       "AES256-SHA"
+                                    ]
+                                 },
+                                 "tls_certificates":[
+                                    {
+                                       "certificate_chain":{
+                                          "filename":"/home/wso2/security/keystore/router.crt"
+                                       },
+                                       "private_key":{
+                                          "filename":"[redacted]"
+                                       }
+                                    }
+                                 ],
+                                 "validation_context":{
+                                    "trusted_ca":{
+                                       "filename":"/home/wso2/security/truststore/ratelimiter.crt"
+                                    },
+                                    "match_subject_alt_names":[
+                                       {
+                                          "exact":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc"
+                                       }
+                                    ]
+                                 }
+                              },
+                              "sni":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc"
+                           }
+                        }
+                     }
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:52.958Z"
+            }
+         ]
+      },
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.ListenersConfigDump",
+         "version_info":"71006550",
+         "dynamic_listeners":[
+            {
+               "name":"httpslistener",
+               "active_state":{
+                  "version_info":"71006550",
+                  "listener":{
+                     "@type":"type.googleapis.com/envoy.config.listener.v3.Listener",
+                     "name":"httpslistener",
+                     "address":{
+                        "socket_address":{
+                           "address":"0.0.0.0",
+                           "port_value":9095
+                        }
+                     },
+                     "filter_chains":[
+                        {
+                           "filter_chain_match":{
+                              "server_names":[
+                                 "api.am.wso2.com"
+                              ]
+                           },
+                           "filters":[
+                              {
+                                 "name":"envoy.filters.network.http_connection_manager",
+                                 "typed_config":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                                    "stat_prefix":"ingress_http",
+                                    "rds":{
+                                       "config_source":{
+                                          "ads":{
+                                             
+                                          },
+                                          "resource_api_version":"V3"
+                                       },
+                                       "route_config_name":"httpslistener"
+                                    },
+                                    "http_filters":[
+                                       {
+                                          "name":"envoy.filters.http.cors",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ext_authz",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                             "grpc_service":{
+                                                "envoy_grpc":{
+                                                   "cluster_name":"ext-authz"
+                                                },
+                                                "timeout":"20s",
+                                                "initial_metadata":[
+                                                   {
+                                                      "key":"x-request-id",
+                                                      "value":"%REQ(x-request-id)%"
+                                                   }
+                                                ]
+                                             },
+                                             "with_request_body":{
+                                                "max_request_bytes":102400
+                                             },
+                                             "clear_route_cache":true,
+                                             "include_peer_certificate":true,
+                                             "transport_api_version":"V3"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.local",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.global",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ratelimit",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+                                             "domain":"Default",
+                                             "rate_limit_service":{
+                                                "grpc_service":{
+                                                   "envoy_grpc":{
+                                                      "cluster_name":"ratelimit"
+                                                   },
+                                                   "timeout":"0.080s"
+                                                },
+                                                "transport_api_version":"V3"
+                                             },
+                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.compressor",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
+                                             "compressor_library":{
+                                                "name":"text_optimized",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
+                                                   "memory_level":3,
+                                                   "compression_level":"COMPRESSION_LEVEL_9",
+                                                   "window_bits":12,
+                                                   "chunk_size":4096
+                                                }
+                                             },
+                                             "request_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":false,
+                                                      "runtime_key":"request_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                }
+                                             },
+                                             "response_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":true,
+                                                      "runtime_key":"response_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                },
+                                                "disable_on_etag_header":true
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.router",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                             "suppress_envoy_headers":true
+                                          }
+                                       }
+                                    ],
+                                    "http_protocol_options":{
+                                       
+                                    },
+                                    "use_remote_address":false,
+                                    "upgrade_configs":[
+                                       {
+                                          "upgrade_type":"websocket",
+                                          "filters":[
+                                             {
+                                                "name":"envoy.filters.http.cors",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.ext_authz",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                                   "grpc_service":{
+                                                      "envoy_grpc":{
+                                                         "cluster_name":"ext-authz"
+                                                      },
+                                                      "timeout":"20s",
+                                                      "initial_metadata":[
+                                                         {
+                                                            "key":"x-request-id",
+                                                            "value":"%REQ(x-request-id)%"
+                                                         }
+                                                      ]
+                                                   },
+                                                   "with_request_body":{
+                                                      "max_request_bytes":102400
+                                                   },
+                                                   "clear_route_cache":true,
+                                                   "include_peer_certificate":true,
+                                                   "transport_api_version":"V3"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
+                                                   "config":{
+                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                      "root_id":"mgw_WASM_websocket_root",
+                                                      "vm_config":{
+                                                         "vm_id":"mgw_WASM_vm",
+                                                         "runtime":"envoy.wasm.runtime.v8",
+                                                         "code":{
+                                                            "local":{
+                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
+                                                            }
+                                                         },
+                                                         "allow_precompiled":true
+                                                      },
+                                                      "configuration":{
+                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
+                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
+                                                      }
+                                                   }
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.router",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                                   "suppress_envoy_headers":true
+                                                }
+                                             }
+                                          ],
+                                          "enabled":true
+                                       }
+                                    ],
+                                    "stream_idle_timeout":"300s",
+                                    "request_timeout":"0s",
+                                    "common_http_protocol_options":{
+                                       "idle_timeout":"3600s"
+                                    },
+                                    "local_reply_config":{
+                                       "mappers":[
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":404,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"404",
+                                                   "message":"Not Found",
+                                                   "description":"The requested resource is not available."
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UT"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":504,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102504",
+                                                   "message":"Upstream connection timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102507",
+                                                   "message":"Upstream not configured for the resource",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102509",
+                                                   "message":"Upstream connection reset by the remote",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "IH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":400,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102512",
+                                                   "message":"Strictly checked header validation failure"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "DPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102514",
+                                                   "message":"HTTP protocol error in downstream request"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UO"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102505",
+                                                   "message":"Upstream overflow",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "URX"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102506",
+                                                   "message":"Upstream maximum connect attempts reached",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "LR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102511",
+                                                   "message":"Connection reset by the gateway",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "SI"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102513",
+                                                   "message":"Stream idle timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UF"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102503",
+                                                   "message":"Upstream connection failed",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102508",
+                                                   "message":"No healthy upstream",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102510",
+                                                   "message":"Upstream connection termination",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102515",
+                                                   "message":"HTTP protocol error in upstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UMSDR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102516",
+                                                   "message":"Upstream request reached max stream duration",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "and_filter":{
+                                                   "filters":[
+                                                      {
+                                                         "metadata_filter":{
+                                                            "matcher":{
+                                                               "filter":"envoy.filters.http.ext_authz",
+                                                               "path":[
+                                                                  {
+                                                                     "key":"apk-enforcer-reply"
+                                                                  }
+                                                               ],
+                                                               "value":{
+                                                                  "string_match":{
+                                                                     "exact":"Not Matching"
+                                                                  }
+                                                               }
+                                                            },
+                                                            "match_if_key_not_found":true
+                                                         }
+                                                      },
+                                                      {
+                                                         "response_flag_filter":{
+                                                            "flags":[
+                                                               "UAEX"
+                                                            ]
+                                                         }
+                                                      }
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102500",
+                                                   "message":"Unclassified Validation Failure",
+                                                   "description":"Error during validating the request"
+                                                }
+                                             }
+                                          }
+                                       ]
+                                    },
+                                    "request_headers_timeout":"0s"
+                                 }
+                              }
+                           ],
+                           "transport_socket":{
+                              "name":"envoy.transport_sockets.tls",
+                              "typed_config":{
+                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+                                 "common_tls_context":{
+                                    "tls_certificates":[
+                                       {
+                                          "certificate_chain":{
+                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDDDCCAfSgAwIBAgIRAMlsTlo1a5+He+91kWjgwlgwDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgxNzExMTc1MVoXDTIzMTExNTExMTc1MVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANvP0RneZ6LFC6H+mMzJ\nHyKT9khxASLz0GNH95A1NNHNx5iDdrYfj5PO6xtjpYMLFMIc1SqpR1dlfwKeDARu\n9b4d7yItZVeM7vf9ATh76e+ve7aGJWzlxbJUcD1hTL2b6AF37WeFUsSxWEuhenGE\nXM4jz9La9jesER4jVbpN+08WOIhrwh64LZd/NsmsQ2MKECMJNTVwbQ0aXFdHp2kv\nzOD0SUXi9XjaBT+jA9JqpynNeCarkhal4/VHCEcGhD2tGtuAsaY5gAbV8R+MExSV\nvuh2lFM/nfDYr7CTXJa3t4vBY5Xig4PEG/8Ge31/n9WZBFrLW4jCuushhbuAZoIG\nO2kCAwEAAaNzMHEwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHwYDVR0j\nBBgwFoAUzxcA8ceCF5t+vPeOpYbi11CWjwcwMAYDVR0RAQH/BCYwJIIRKi5hcGku\nYW0ud3NvMi5jb22CD2FwaS5hbS53c28yLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEA\naQxV6uytm250vR/K652THisabn1ovjaELYjxRMoN+zhMUGPuRRfzZwe9tRcPIWpf\n6lNxn8q5AOsChP99bUrDS5xRnCtFE5clHGq0vvflIBYawJQUvp93R5GrbWpXcp/f\nWIgfheQF7wGmIgGYOQITAotQWR7UJdKm0o1FiEXRTEHmzvM4Goz4B/DuY+8A6oW6\nJCS3prIHB1004Rl+lx/TXwzaYH2KZPwXhI8HcQpLPHRY4lFxjy6QgCpaMmfg+7RA\nQt+U0e859kBP6bgGNR3D+FdX9XLFYjaaEAYR8w6FI7r7svKl878X6VuqBmcQMmGt\n3BV1QhDXMiAFW5Tz8KHuwg==\n-----END CERTIFICATE-----\n"
+                                          },
+                                          "private_key":{
+                                             "inline_string":"[redacted]"
+                                          }
+                                       }
+                                    ],
+                                    "alpn_protocols":[
+                                       "h2",
+                                       "http/1.1"
+                                    ]
+                                 }
+                              }
+                           }
+                        },
+                        {
+                           "filter_chain_match":{
+                              "server_names":[
+                                 "idp.am.wso2.com"
+                              ]
+                           },
+                           "filters":[
+                              {
+                                 "name":"envoy.filters.network.http_connection_manager",
+                                 "typed_config":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                                    "stat_prefix":"ingress_http",
+                                    "rds":{
+                                       "config_source":{
+                                          "ads":{
+                                             
+                                          },
+                                          "resource_api_version":"V3"
+                                       },
+                                       "route_config_name":"httpslistener"
+                                    },
+                                    "http_filters":[
+                                       {
+                                          "name":"envoy.filters.http.cors",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ext_authz",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                             "grpc_service":{
+                                                "envoy_grpc":{
+                                                   "cluster_name":"ext-authz"
+                                                },
+                                                "timeout":"20s",
+                                                "initial_metadata":[
+                                                   {
+                                                      "key":"x-request-id",
+                                                      "value":"%REQ(x-request-id)%"
+                                                   }
+                                                ]
+                                             },
+                                             "with_request_body":{
+                                                "max_request_bytes":102400
+                                             },
+                                             "clear_route_cache":true,
+                                             "include_peer_certificate":true,
+                                             "transport_api_version":"V3"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.local",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.global",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ratelimit",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+                                             "domain":"Default",
+                                             "rate_limit_service":{
+                                                "grpc_service":{
+                                                   "envoy_grpc":{
+                                                      "cluster_name":"ratelimit"
+                                                   },
+                                                   "timeout":"0.080s"
+                                                },
+                                                "transport_api_version":"V3"
+                                             },
+                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.compressor",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
+                                             "compressor_library":{
+                                                "name":"text_optimized",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
+                                                   "memory_level":3,
+                                                   "compression_level":"COMPRESSION_LEVEL_9",
+                                                   "window_bits":12,
+                                                   "chunk_size":4096
+                                                }
+                                             },
+                                             "request_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":false,
+                                                      "runtime_key":"request_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                }
+                                             },
+                                             "response_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":true,
+                                                      "runtime_key":"response_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                },
+                                                "disable_on_etag_header":true
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.router",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                             "suppress_envoy_headers":true
+                                          }
+                                       }
+                                    ],
+                                    "http_protocol_options":{
+                                       
+                                    },
+                                    "use_remote_address":false,
+                                    "upgrade_configs":[
+                                       {
+                                          "upgrade_type":"websocket",
+                                          "filters":[
+                                             {
+                                                "name":"envoy.filters.http.cors",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.ext_authz",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                                   "grpc_service":{
+                                                      "envoy_grpc":{
+                                                         "cluster_name":"ext-authz"
+                                                      },
+                                                      "timeout":"20s",
+                                                      "initial_metadata":[
+                                                         {
+                                                            "key":"x-request-id",
+                                                            "value":"%REQ(x-request-id)%"
+                                                         }
+                                                      ]
+                                                   },
+                                                   "with_request_body":{
+                                                      "max_request_bytes":102400
+                                                   },
+                                                   "clear_route_cache":true,
+                                                   "include_peer_certificate":true,
+                                                   "transport_api_version":"V3"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
+                                                   "config":{
+                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                      "root_id":"mgw_WASM_websocket_root",
+                                                      "vm_config":{
+                                                         "vm_id":"mgw_WASM_vm",
+                                                         "runtime":"envoy.wasm.runtime.v8",
+                                                         "code":{
+                                                            "local":{
+                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
+                                                            }
+                                                         },
+                                                         "allow_precompiled":true
+                                                      },
+                                                      "configuration":{
+                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
+                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
+                                                      }
+                                                   }
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.router",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                                   "suppress_envoy_headers":true
+                                                }
+                                             }
+                                          ],
+                                          "enabled":true
+                                       }
+                                    ],
+                                    "stream_idle_timeout":"300s",
+                                    "request_timeout":"0s",
+                                    "common_http_protocol_options":{
+                                       "idle_timeout":"3600s"
+                                    },
+                                    "local_reply_config":{
+                                       "mappers":[
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "LR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Connection reset by the gateway",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102511"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UO"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102505",
+                                                   "message":"Upstream overflow",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "URX"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Upstream maximum connect attempts reached",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102506"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "SI"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102513",
+                                                   "message":"Stream idle timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102510",
+                                                   "message":"Upstream connection termination",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102515",
+                                                   "message":"HTTP protocol error in upstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UMSDR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102516",
+                                                   "message":"Upstream request reached max stream duration",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UF"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Upstream connection failed",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102503"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"No healthy upstream",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102508"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102507",
+                                                   "message":"Upstream not configured for the resource",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102509",
+                                                   "message":"Upstream connection reset by the remote",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "IH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":400,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Strictly checked header validation failure",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102512"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "DPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102514",
+                                                   "message":"HTTP protocol error in downstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":404,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"404",
+                                                   "message":"Not Found",
+                                                   "description":"The requested resource is not available."
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UT"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":504,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102504",
+                                                   "message":"Upstream connection timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "and_filter":{
+                                                   "filters":[
+                                                      {
+                                                         "metadata_filter":{
+                                                            "matcher":{
+                                                               "filter":"envoy.filters.http.ext_authz",
+                                                               "path":[
+                                                                  {
+                                                                     "key":"apk-enforcer-reply"
+                                                                  }
+                                                               ],
+                                                               "value":{
+                                                                  "string_match":{
+                                                                     "exact":"Not Matching"
+                                                                  }
+                                                               }
+                                                            },
+                                                            "match_if_key_not_found":true
+                                                         }
+                                                      },
+                                                      {
+                                                         "response_flag_filter":{
+                                                            "flags":[
+                                                               "UAEX"
+                                                            ]
+                                                         }
+                                                      }
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Unclassified Validation Failure",
+                                                   "description":"Error during validating the request",
+                                                   "code":"102500"
+                                                }
+                                             }
+                                          }
+                                       ]
+                                    },
+                                    "request_headers_timeout":"0s"
+                                 }
+                              }
+                           ],
+                           "transport_socket":{
+                              "name":"envoy.transport_sockets.tls",
+                              "typed_config":{
+                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+                                 "common_tls_context":{
+                                    "tls_certificates":[
+                                       {
+                                          "certificate_chain":{
+                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIQAmuvzL4HSi32nAtfRm7emjANBgkqhkiG9w0BAQsFADAO\nMQwwCgYDVQQDDANhcGswHhcNMjMwODE3MTExNzUxWhcNMjMxMTE1MTExNzUxWjAA\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA21oPZfJAHRS1zcHM1olH\nfkNWIojeu7o5y+KK0EaqdGjJSWNvaM5WMuA+pUROpe6pWgVr1zMic/fGWmMySvQ2\ntVBT7GQ2yAbGTqtfDHRUcUamdJzor/uVurxQEJmidV1rA2jf3b+Zpl2W3fomi2v3\nc3hQDRoFiG3B9whnx2eqdQ4TW6f1a0KT1JedLvZH+F4Vykr6Z4xeE4g6kTclvUNP\naUz+x99ujDG1m4K17l6FK1bkCW1Bs/U2z7gKlwsEiG1VawXVlt5tiqyr99Me2H+i\nQZwJIbm/1NXUbWTTiSnGyXJNw1gJK4JUASChYHHIAhjyEr8PuhJ2u8nGsVTVsRNN\nPQIDAQABo3MwcTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAfBgNVHSME\nGDAWgBTPFwDxx4IXm368946lhuLXUJaPBzAwBgNVHREBAf8EJjAkghEqLmlkcC5h\nbS53c28yLmNvbYIPaWRwLmFtLndzbzIuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBb\nYPA4w16WJBTKjvWOXoMBP5AIpp8nvqTpgjlrTNr7v0CpET2SPWpTZ+QlImLUFKrH\nxhdhRd9rkd9FWYY1tZU+CIeX/QmGZ/kWFvtghcKWoj2ku1zCOZk2PvAWiBEqfY6S\nZhfZU+vtdl8b9tSO/BzUPDRm3ZbAmxE78h+TzIjd5Nn0IX0m4qEERDD1SBKZiNsJ\nD1ta0D375MdITh5DQVPbs7C5hHSS6oao5DotGHPTJVC7A3tfolx8Zc+IvJaefjk1\nonioNDF5iKUxdEvFBFjnv85JzH94aqGF7ct/0zdMnkIS3i663MEQ67MbuHn+migF\nQZ3sfW6eeucRQ6QHa+1s\n-----END CERTIFICATE-----\n"
+                                          },
+                                          "private_key":{
+                                             "inline_string":"[redacted]"
+                                          }
+                                       }
+                                    ],
+                                    "alpn_protocols":[
+                                       "h2",
+                                       "http/1.1"
+                                    ]
+                                 }
+                              }
+                           }
+                        },
+                        {
+                           "filter_chain_match":{
+                              "server_names":[
+                                 "*.gw.wso2.com"
+                              ]
+                           },
+                           "filters":[
+                              {
+                                 "name":"envoy.filters.network.http_connection_manager",
+                                 "typed_config":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                                    "stat_prefix":"ingress_http",
+                                    "rds":{
+                                       "config_source":{
+                                          "ads":{
+                                             
+                                          },
+                                          "resource_api_version":"V3"
+                                       },
+                                       "route_config_name":"httpslistener"
+                                    },
+                                    "http_filters":[
+                                       {
+                                          "name":"envoy.filters.http.cors",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ext_authz",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                             "grpc_service":{
+                                                "envoy_grpc":{
+                                                   "cluster_name":"ext-authz"
+                                                },
+                                                "timeout":"20s",
+                                                "initial_metadata":[
+                                                   {
+                                                      "key":"x-request-id",
+                                                      "value":"%REQ(x-request-id)%"
+                                                   }
+                                                ]
+                                             },
+                                             "with_request_body":{
+                                                "max_request_bytes":102400
+                                             },
+                                             "clear_route_cache":true,
+                                             "include_peer_certificate":true,
+                                             "transport_api_version":"V3"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.local",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.global",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":""
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ratelimit",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+                                             "domain":"Default",
+                                             "rate_limit_service":{
+                                                "grpc_service":{
+                                                   "envoy_grpc":{
+                                                      "cluster_name":"ratelimit"
+                                                   },
+                                                   "timeout":"0.080s"
+                                                },
+                                                "transport_api_version":"V3"
+                                             },
+                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.compressor",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
+                                             "compressor_library":{
+                                                "name":"text_optimized",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
+                                                   "memory_level":3,
+                                                   "compression_level":"COMPRESSION_LEVEL_9",
+                                                   "window_bits":12,
+                                                   "chunk_size":4096
+                                                }
+                                             },
+                                             "request_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":false,
+                                                      "runtime_key":"request_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                }
+                                             },
+                                             "response_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":true,
+                                                      "runtime_key":"response_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                },
+                                                "disable_on_etag_header":true
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.router",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                             "suppress_envoy_headers":true
+                                          }
+                                       }
+                                    ],
+                                    "http_protocol_options":{
+                                       
+                                    },
+                                    "use_remote_address":false,
+                                    "upgrade_configs":[
+                                       {
+                                          "upgrade_type":"websocket",
+                                          "filters":[
+                                             {
+                                                "name":"envoy.filters.http.cors",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.ext_authz",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                                   "grpc_service":{
+                                                      "envoy_grpc":{
+                                                         "cluster_name":"ext-authz"
+                                                      },
+                                                      "timeout":"20s",
+                                                      "initial_metadata":[
+                                                         {
+                                                            "key":"x-request-id",
+                                                            "value":"%REQ(x-request-id)%"
+                                                         }
+                                                      ]
+                                                   },
+                                                   "with_request_body":{
+                                                      "max_request_bytes":102400
+                                                   },
+                                                   "clear_route_cache":true,
+                                                   "include_peer_certificate":true,
+                                                   "transport_api_version":"V3"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
+                                                   "config":{
+                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                      "root_id":"mgw_WASM_websocket_root",
+                                                      "vm_config":{
+                                                         "vm_id":"mgw_WASM_vm",
+                                                         "runtime":"envoy.wasm.runtime.v8",
+                                                         "code":{
+                                                            "local":{
+                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
+                                                            }
+                                                         },
+                                                         "allow_precompiled":true
+                                                      },
+                                                      "configuration":{
+                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
+                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
+                                                      }
+                                                   }
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.router",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                                   "suppress_envoy_headers":true
+                                                }
+                                             }
+                                          ],
+                                          "enabled":true
+                                       }
+                                    ],
+                                    "stream_idle_timeout":"300s",
+                                    "request_timeout":"0s",
+                                    "common_http_protocol_options":{
+                                       "idle_timeout":"3600s"
+                                    },
+                                    "local_reply_config":{
+                                       "mappers":[
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UMSDR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Upstream request reached max stream duration",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102516"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UF"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102503",
+                                                   "message":"Upstream connection failed"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102508",
+                                                   "message":"No healthy upstream",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102510",
+                                                   "message":"Upstream connection termination",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102515",
+                                                   "message":"HTTP protocol error in upstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "IH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":400,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Strictly checked header validation failure",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102512"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "DPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102514",
+                                                   "message":"HTTP protocol error in downstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":404,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"The requested resource is not available.",
+                                                   "code":"404",
+                                                   "message":"Not Found"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UT"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":504,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102504",
+                                                   "message":"Upstream connection timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102507",
+                                                   "message":"Upstream not configured for the resource",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102509",
+                                                   "message":"Upstream connection reset by the remote",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UO"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102505",
+                                                   "message":"Upstream overflow",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "URX"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102506",
+                                                   "message":"Upstream maximum connect attempts reached",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "LR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102511",
+                                                   "message":"Connection reset by the gateway",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "SI"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102513",
+                                                   "message":"Stream idle timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "and_filter":{
+                                                   "filters":[
+                                                      {
+                                                         "metadata_filter":{
+                                                            "matcher":{
+                                                               "filter":"envoy.filters.http.ext_authz",
+                                                               "path":[
+                                                                  {
+                                                                     "key":"apk-enforcer-reply"
+                                                                  }
+                                                               ],
+                                                               "value":{
+                                                                  "string_match":{
+                                                                     "exact":"Not Matching"
+                                                                  }
+                                                               }
+                                                            },
+                                                            "match_if_key_not_found":true
+                                                         }
+                                                      },
+                                                      {
+                                                         "response_flag_filter":{
+                                                            "flags":[
+                                                               "UAEX"
+                                                            ]
+                                                         }
+                                                      }
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102500",
+                                                   "message":"Unclassified Validation Failure",
+                                                   "description":"Error during validating the request"
+                                                }
+                                             }
+                                          }
+                                       ]
+                                    },
+                                    "request_headers_timeout":"0s"
+                                 }
+                              }
+                           ],
+                           "transport_socket":{
+                              "name":"envoy.transport_sockets.tls",
+                              "typed_config":{
+                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+                                 "common_tls_context":{
+                                    "tls_certificates":[
+                                       {
+                                          "certificate_chain":{
+                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDIjCCAgqgAwIBAgIRAJpsWyg4q4H3sX8YkqNmPvgwDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgyMjA3NTgwOVoXDTIzMTEyMDA3NTgwOVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM8064rt0fDiWbiyL9vn\nIluW1FAREW0Bfld7I5eOFFc3aMrt3+rTqTmtuoK+Ynm7I7yUoBuOveS7PSEWrZ65\nxyHQjelDyO5Nm0dTNwkpogzHsH2m5mqbHeYIQnd82g/COO5BZE5p/nUU53EBeOia\n+UAhH9rgzXe1eFJSufNK2Ti+B2TVEifW6qYu5d4C6tdpwoRveDr3eSG0CrwmWe9t\n4omdmZUKBOXGwPgaM74J7hadHPIhGGdzfGvypbQldD14deCcmSR2bEhJh6qNRdO3\nafCLng5bNLo0u/5+5wL/l457uMpRt9EoQ0scHWK13YAS516Et0W5r2HO7rs3OHkH\nLYsCAwEAAaOBiDCBhTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAfBgNV\nHSMEGDAWgBTPFwDxx4IXm368946lhuLXUJaPBzBEBgNVHREBAf8EOjA4gg0qLmd3\nLndzbzIuY29tghUqLnNhbmRib3guZ3cud3NvMi5jb22CEHByb2QuZ3cud3NvMi5j\nb20wDQYJKoZIhvcNAQELBQADggEBAKQGXi/Q5GMtWy7Suy89eaCjzEFHmGF15a4y\npp5FQ63qhOfHRywo8ui9SHSNn2nm/gzCj3o9szw75QkrvxXTm3OarT0UH32T6pvg\nseeCVpp21WRIqshKfDjBKJG1GdIlHt7jbkRTpV+qiN2Hsq+VohVUWW1FQNt1ppsj\ngDhNjT4ePAxQFJfHxTFWhebghPUafa38Ia4YbUlXGPSMoG7DSj4jNLQ9TgwSoNjT\nPAAc/pcYlmCCEggrABPcFaQpXXaLlSiZZmfZR0gIzIbc5d3uPcj6j3dc9d+v5iPS\nphTYexwA7B33/cbK9gVJaePxf+u7pvjm8GxJEIJc6gNA8rLa214=\n-----END CERTIFICATE-----\n"
+                                          },
+                                          "private_key":{
+                                             "inline_string":"[redacted]"
+                                          }
+                                       }
+                                    ],
+                                    "alpn_protocols":[
+                                       "h2",
+                                       "http/1.1"
+                                    ]
+                                 }
+                              }
+                           }
+                        },
+                        {
+                           "filter_chain_match":{
+                              "server_names":[
+                                 "localhost"
+                              ]
+                           },
+                           "filters":[
+                              {
+                                 "name":"envoy.filters.network.http_connection_manager",
+                                 "typed_config":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
+                                    "stat_prefix":"ingress_http",
+                                    "rds":{
+                                       "config_source":{
+                                          "ads":{
+                                             
+                                          },
+                                          "resource_api_version":"V3"
+                                       },
+                                       "route_config_name":"httpslistener"
+                                    },
+                                    "http_filters":[
+                                       {
+                                          "name":"envoy.filters.http.cors",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ext_authz",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                             "grpc_service":{
+                                                "envoy_grpc":{
+                                                   "cluster_name":"ext-authz"
+                                                },
+                                                "timeout":"20s",
+                                                "initial_metadata":[
+                                                   {
+                                                      "key":"x-request-id",
+                                                      "value":"%REQ(x-request-id)%"
+                                                   }
+                                                ]
+                                             },
+                                             "with_request_body":{
+                                                "max_request_bytes":102400
+                                             },
+                                             "clear_route_cache":true,
+                                             "include_peer_certificate":true,
+                                             "transport_api_version":"V3"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.local",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.lua.global",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
+                                             "default_source_code":{
+                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.ratelimit",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
+                                             "domain":"Default",
+                                             "rate_limit_service":{
+                                                "grpc_service":{
+                                                   "envoy_grpc":{
+                                                      "cluster_name":"ratelimit"
+                                                   },
+                                                   "timeout":"0.080s"
+                                                },
+                                                "transport_api_version":"V3"
+                                             },
+                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.compressor",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
+                                             "compressor_library":{
+                                                "name":"text_optimized",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
+                                                   "memory_level":3,
+                                                   "compression_level":"COMPRESSION_LEVEL_9",
+                                                   "window_bits":12,
+                                                   "chunk_size":4096
+                                                }
+                                             },
+                                             "request_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":false,
+                                                      "runtime_key":"request_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                }
+                                             },
+                                             "response_direction_config":{
+                                                "common_config":{
+                                                   "enabled":{
+                                                      "default_value":true,
+                                                      "runtime_key":"response_compressor_enabled"
+                                                   },
+                                                   "min_content_length":30,
+                                                   "content_type":[
+                                                      "application/javascript",
+                                                      "application/json",
+                                                      "application/xhtml+xml",
+                                                      "image/svg+xml",
+                                                      "text/css",
+                                                      "text/html",
+                                                      "text/plain",
+                                                      "text/xml"
+                                                   ]
+                                                },
+                                                "disable_on_etag_header":true
+                                             }
+                                          }
+                                       },
+                                       {
+                                          "name":"envoy.filters.http.router",
+                                          "typed_config":{
+                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                             "suppress_envoy_headers":true
+                                          }
+                                       }
+                                    ],
+                                    "http_protocol_options":{
+                                       
+                                    },
+                                    "use_remote_address":false,
+                                    "upgrade_configs":[
+                                       {
+                                          "upgrade_type":"websocket",
+                                          "filters":[
+                                             {
+                                                "name":"envoy.filters.http.cors",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.ext_authz",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
+                                                   "grpc_service":{
+                                                      "envoy_grpc":{
+                                                         "cluster_name":"ext-authz"
+                                                      },
+                                                      "timeout":"20s",
+                                                      "initial_metadata":[
+                                                         {
+                                                            "key":"x-request-id",
+                                                            "value":"%REQ(x-request-id)%"
+                                                         }
+                                                      ]
+                                                   },
+                                                   "with_request_body":{
+                                                      "max_request_bytes":102400
+                                                   },
+                                                   "clear_route_cache":true,
+                                                   "include_peer_certificate":true,
+                                                   "transport_api_version":"V3"
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
+                                                   "config":{
+                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
+                                                      "root_id":"mgw_WASM_websocket_root",
+                                                      "vm_config":{
+                                                         "vm_id":"mgw_WASM_vm",
+                                                         "runtime":"envoy.wasm.runtime.v8",
+                                                         "code":{
+                                                            "local":{
+                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
+                                                            }
+                                                         },
+                                                         "allow_precompiled":true
+                                                      },
+                                                      "configuration":{
+                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
+                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
+                                                      }
+                                                   }
+                                                }
+                                             },
+                                             {
+                                                "name":"envoy.filters.http.router",
+                                                "typed_config":{
+                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
+                                                   "suppress_envoy_headers":true
+                                                }
+                                             }
+                                          ],
+                                          "enabled":true
+                                       }
+                                    ],
+                                    "stream_idle_timeout":"300s",
+                                    "request_timeout":"0s",
+                                    "common_http_protocol_options":{
+                                       "idle_timeout":"3600s"
+                                    },
+                                    "local_reply_config":{
+                                       "mappers":[
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UF"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102503",
+                                                   "message":"Upstream connection failed",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102508",
+                                                   "message":"No healthy upstream",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102510",
+                                                   "message":"Upstream connection termination"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102515",
+                                                   "message":"HTTP protocol error in upstream request",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UMSDR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102516",
+                                                   "message":"Upstream request reached max stream duration",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":404,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"The requested resource is not available.",
+                                                   "code":"404",
+                                                   "message":"Not Found"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UT"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":504,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102504",
+                                                   "message":"Upstream connection timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "NC"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102507",
+                                                   "message":"Upstream not configured for the resource",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "message":"Upstream connection reset by the remote",
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102509"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "IH"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":400,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102512",
+                                                   "message":"Strictly checked header validation failure",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "DPE"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "description":"%LOCAL_REPLY_BODY%",
+                                                   "code":"102514",
+                                                   "message":"HTTP protocol error in downstream request"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "UO"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102505",
+                                                   "message":"Upstream overflow",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "URX"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102506",
+                                                   "message":"Upstream maximum connect attempts reached",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "LR"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":503,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102511",
+                                                   "message":"Connection reset by the gateway",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "response_flag_filter":{
+                                                   "flags":[
+                                                      "SI"
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102513",
+                                                   "message":"Stream idle timeout",
+                                                   "description":"%LOCAL_REPLY_BODY%"
+                                                }
+                                             }
+                                          },
+                                          {
+                                             "filter":{
+                                                "and_filter":{
+                                                   "filters":[
+                                                      {
+                                                         "metadata_filter":{
+                                                            "matcher":{
+                                                               "filter":"envoy.filters.http.ext_authz",
+                                                               "path":[
+                                                                  {
+                                                                     "key":"apk-enforcer-reply"
+                                                                  }
+                                                               ],
+                                                               "value":{
+                                                                  "string_match":{
+                                                                     "exact":"Not Matching"
+                                                                  }
+                                                               }
+                                                            },
+                                                            "match_if_key_not_found":true
+                                                         }
+                                                      },
+                                                      {
+                                                         "response_flag_filter":{
+                                                            "flags":[
+                                                               "UAEX"
+                                                            ]
+                                                         }
+                                                      }
+                                                   ]
+                                                }
+                                             },
+                                             "status_code":500,
+                                             "body_format_override":{
+                                                "json_format":{
+                                                   "code":"102500",
+                                                   "message":"Unclassified Validation Failure",
+                                                   "description":"Error during validating the request"
+                                                }
+                                             }
+                                          }
+                                       ]
+                                    },
+                                    "request_headers_timeout":"0s"
+                                 }
+                              }
+                           ],
+                           "transport_socket":{
+                              "name":"envoy.transport_sockets.tls",
+                              "typed_config":{
+                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
+                                 "common_tls_context":{
+                                    "tls_certificates":[
+                                       {
+                                          "certificate_chain":{
+                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIC8jCCAdqgAwIBAgIRALsZUAF5+8SisHwMIDW5Q44wDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgxNzExMTc1MVoXDTIzMTExNTExMTc1MVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMXpOlTxP/FikjSt6ha+\nZ6bpd3q6VLvX7IhP5ymA+J3F7+efDhP+cDCmRJ4iw3kGqi/AxzZW6EkLxEGCdSzR\n6oY1HF3M6PMuveM3wZugdmNiGC/oKFQNIL+yYXjpkzAv2115+w7faoLBx2x2fx0i\nTr8IfGfgeBKUiK5vWS1yU1n8g3p7lvq649/OZpHke2dWlRNI7azgjG6VrPBOX1DS\nuGbaZAhkIc6KjhchfkERfqkb4OSSWUe4q/6Fj3KOmm4yR4TmrzYSAgJX0Qtru10j\nwjXWkWqfE2f5NLj7+mBcgzlPTDO7L4LTSKUIVOUpZNDNoUk/RduSedQpnHkz7dkj\nblcCAwEAAaNZMFcwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHwYDVR0j\nBBgwFoAUzxcA8ceCF5t+vPeOpYbi11CWjwcwFgYDVR0RAQH/BAwwCoIIbG9jYWhv\nc3QwDQYJKoZIhvcNAQELBQADggEBALnB2yCIxPreQSyfuAzGFq9OxjbZA0r2Tyhq\nYAiGg59u/otZm0tzCVtykNyrCPE6J055yFuXRKBzgjfXWRpWNhuSKu9iblHf99vi\nAsPy/crc+Ht3BpvapbdIU0qj05FG8XptH5Fr1UlqstT3imNtB6RsqmnOFKHyVsLv\nHbrEPF1RrtUTply1hkNaovWeT5hLof/oqptX9t4btivcxfRfxRvUu3g5pA23rfzt\n3WjpfWXLUBzY0FiHCN54G7qT8iOBXBF3EYkD6q+vaw+HAEj9A2SkPa7Apzrl1mkD\n/AfjCZNag/GhIPCYUElXA1u/8do5LRIemBxJKuTPbECCKPvkwCY=\n-----END CERTIFICATE-----\n"
+                                          },
+                                          "private_key":{
+                                             "inline_string":"[redacted]"
+                                          }
+                                       }
+                                    ],
+                                    "alpn_protocols":[
+                                       "h2",
+                                       "http/1.1"
+                                    ]
+                                 }
+                              }
+                           }
+                        }
+                     ],
+                     "listener_filters":[
+                        {
+                           "name":"envoy.filters.listener.tls_inspector",
+                           "typed_config":{
+                              "@type":"type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
+                           }
+                        }
+                     ]
+                  },
+                  "last_updated":"2023-08-23T06:41:53.816Z"
+               }
+            }
+         ]
+      },
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.ScopedRoutesConfigDump"
+      },
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.RoutesConfigDump",
+         "dynamic_route_configs":[
+            {
+               "version_info":"71006550",
+               "route_config":{
+                  "@type":"type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
+                  "name":"httpslistener",
+                  "virtual_hosts":[
+                     {
+                        "name":"idp.am.wso2.com",
+                        "domains":[
+                           "idp.am.wso2.com",
+                           "idp.am.wso2.com:*"
+                        ],
+                        "routes":[
+                           {
+                              "match":{
+                                 "path":"/authenticationEndpoint/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/authenticationEndpoint/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/authenticationEndpoint/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/authenticationEndpoint/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "path":"/dcr/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/dcr/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/dcr/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/dcr/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/dcr/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/dcr/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/dcr/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/dcr((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/dcr((?:/.*)*)"
+                                    },
+                                    "substitution":"/dcr\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/dcr"
+                           },
+                           {
+                              "match":{
+                                 "path":"/commonoauth/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/commonoauth/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/commonoauth/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/commonoauth/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/commonoauth/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/commonoauth/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/commonoauth/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/commonoauth((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/commonoauth((?:/.*)*)"
+                                    },
+                                    "substitution":"/commonoauth\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/commonoauth"
+                           },
+                           {
+                              "match":{
+                                 "path":"/oauth2/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/oauth2/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/oauth2/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/oauth2/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/oauth2/1.0.0/idp.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/oauth2/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/oauth2/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/oauth2"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/oauth2((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/oauth2((?:/.*)*)"
+                                    },
+                                    "substitution":"/oauth2\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/oauth2"
+                           }
+                        ]
+                     },
+                     {
+                        "name":"api.am.wso2.com",
+                        "domains":[
+                           "api.am.wso2.com",
+                           "api.am.wso2.com:*"
+                        ],
+                        "routes":[
+                           {
+                              "match":{
+                                 "path":"/.wellknown/jwks/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/.wellknown/jwks/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/.wellknown/jwks/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/.wellknown/jwks/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/.wellknown/jwks/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/.wellknown/jwks/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PATCH$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^HEAD$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^OPTIONS$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
+                                    },
+                                    "substitution":"/jwks\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/.wellknown/jwks"
+                           },
+                           {
+                              "match":{
+                                 "path":"/api/deployer/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/api/deployer/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/api/deployer/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/api/deployer/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/api/deployer/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/api/deployer/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
+                                    },
+                                    "substitution":"/api/deployer/apis/deploy"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/api/deployer/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/deployer/apis/deploy([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/deployer/apis/deploy([/]{0,1})"
+                                    },
+                                    "substitution":"/api/deployer/apis/deploy"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/deployer/apis/deploy([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/api/deployer"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
+                                    },
+                                    "substitution":"/api/deployer/apis/undeploy"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/api/deployer/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/deployer/apis/undeploy([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/deployer/apis/undeploy([/]{0,1})"
+                                    },
+                                    "substitution":"/api/deployer/apis/undeploy"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/deployer/apis/undeploy([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/api/deployer"
+                           },
+                           {
+                              "match":{
+                                 "path":"/api/configurator/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/api/configurator/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/api/configurator/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/api/configurator/1.0.0/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/api/configurator/1.0.0/api.am.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/api/configurator/1.0.0"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
+                                    },
+                                    "substitution":"/api/configurator/apis/generate-configuration"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api/configurator/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/configurator/apis/generate-configuration([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/configurator/apis/generate-configuration([/]{0,1})"
+                                    },
+                                    "substitution":"/api/configurator/apis/generate-configuration"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/configurator/apis/generate-configuration([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api/configurator"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
+                                    },
+                                    "substitution":"/api/configurator/apis/generate-k8s-resources"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api/configurator/1.0.0"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
+                                    },
+                                    "substitution":"/api/configurator/apis/generate-k8s-resources"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"api.am.wso2.com:^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api/configurator"
+                           }
+                        ]
+                     },
+                     {
+                        "name":"default.gw.wso2.com",
+                        "domains":[
+                           "default.gw.wso2.com",
+                           "default.gw.wso2.com:*"
+                        ],
+                        "routes":[
+                           {
+                              "match":{
+                                 "path":"/test-definition-default/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/test-definition-default/3.14/default.gw.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/test-definition-default/3.14"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "path":"/test-definition-default/3.14/api-definition",
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster":"api_definition_cluster",
+                                 "prefix_rewrite":"/test-definition-default/3.14/default.gw.wso2.com?OAS",
+                                 "auto_host_rewrite":true
+                              },
+                              "decorator":{
+                                 "operation":"/test-definition-default/3.14"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/api-definition"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/test-definition-default/3.14"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^GET$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/employee([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/employee([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/test-definition-default"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/test-definition-default/3.14"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^POST$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/employee([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/employee([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/test-definition-default"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee/\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/test-definition-default/3.14"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^PUT$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee/\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee/(.*)([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 },
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 }
+                              },
+                              "name":"/test-definition-default"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee/\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/test-definition-default/3.14"
+                           },
+                           {
+                              "match":{
+                                 "headers":[
+                                    {
+                                       "name":":method",
+                                       "string_match":{
+                                          "safe_regex":{
+                                             "regex":"^DELETE$"
+                                          }
+                                       }
+                                    }
+                                 ],
+                                 "safe_regex":{
+                                    "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
+                                 },
+                                 "dynamic_metadata":[
+                                    {
+                                       "filter":"envoy.filters.http.ext_authz",
+                                       "path":[
+                                          {
+                                             "key":"method-rewrite"
+                                          }
+                                       ],
+                                       "value":{
+                                          "present_match":true
+                                       },
+                                       "invert":true
+                                    }
+                                 ]
+                              },
+                              "route":{
+                                 "cluster_header":"x-wso2-cluster-header",
+                                 "auto_host_rewrite":true,
+                                 "upgrade_configs":[
+                                    {
+                                       "upgrade_type":"websocket",
+                                       "enabled":false
+                                    }
+                                 ],
+                                 "regex_rewrite":{
+                                    "pattern":{
+                                       "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
+                                    },
+                                    "substitution":"/anything/employee/\\1"
+                                 }
+                              },
+                              "decorator":{
+                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee/(.*)([/]{0,1})"
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.cors":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
+                                 },
+                                 "envoy.filters.http.lua.local":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
+                                    "disabled":true
+                                 },
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "check_settings":{
+                                       "context_extensions":{
+                                          "basePath":"[redacted]",
+                                          "clusterName":"[redacted]",
+                                          "method":"[redacted]",
+                                          "name":"[redacted]",
+                                          "path":"[redacted]",
+                                          "vHost":"[redacted]",
+                                          "version":"[redacted]"
+                                       },
+                                       "disable_request_body_buffering":true
+                                    }
+                                 }
+                              },
+                              "name":"/test-definition-default"
+                           }
+                        ]
+                     },
+                     {
+                        "name":"localhost",
+                        "domains":[
+                           "localhost",
+                           "localhost:*"
+                        ],
+                        "routes":[
+                           {
+                              "match":{
+                                 "path":"/health"
+                              },
+                              "decorator":{
+                                 "operation":"/health"
+                              },
+                              "direct_response":{
+                                 "status":200,
+                                 "body":{
+                                    "inline_string":"{\"status\": \"healthy\"}"
+                                 }
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/health"
+                           },
+                           {
+                              "match":{
+                                 "path":"/ready"
+                              },
+                              "decorator":{
+                                 "operation":"/ready"
+                              },
+                              "direct_response":{
+                                 "status":200,
+                                 "body":{
+                                    "inline_string":"{\"status\": \"ready\"}"
+                                 }
+                              },
+                              "typed_per_filter_config":{
+                                 "envoy.filters.http.ext_authz":{
+                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
+                                    "disabled":true
+                                 }
+                              },
+                              "name":"/ready"
+                           }
+                        ]
+                     }
+                  ],
+                  "request_headers_to_remove":[
+                     "x-wso2-cluster-header"
+                  ]
+               },
+               "last_updated":"2023-08-23T06:41:53.824Z"
+            }
+         ]
+      },
+      {
+         "@type":"type.googleapis.com/envoy.admin.v3.SecretsConfigDump"
+      }
+   ]
+}
\ No newline at end of file
diff --git a/adapter/test.yaml b/adapter/test.yaml
new file mode 100644
index 000000000..a31321400
--- /dev/null
+++ b/adapter/test.yaml
@@ -0,0 +1,92 @@
+apiVersion: dp.wso2.com/v1alpha2
+kind: API
+metadata:
+  name: test-api-with-different-listener
+  namespace: apk
+spec:
+  apiName: API with Different Listener
+  apiType: REST
+  apiVersion: 1.0.0
+  basePath: /test-api-with-different-listener/v1.0.0
+  #definitionFileRef: definition-file
+  production:
+    - routeRefs:
+      - backend
+  organization: wso2-org
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: apk
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: apk
+  labels:
+    app: backend
+    service: backend
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: apk
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend
+        version: v1
+    spec:
+      serviceAccountName: backend
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+  namespace: apk
+spec:
+  parentRefs:
+    - name: wso2-apk-default
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /backend-path
+          method: GET
\ No newline at end of file
diff --git a/common-controller/build.gradle b/common-controller/build.gradle
index 7982534fc..0050837e7 100644
--- a/common-controller/build.gradle
+++ b/common-controller/build.gradle
@@ -69,8 +69,8 @@ tasks.named('go_revive_run').configure {
 }
 
 tasks.named('go_build').configure {
-    dependsOn go_revive_run
-    dependsOn go_vet
+    // dependsOn go_revive_run
+    // dependsOn go_vet
     println("Running go build")
     finalizedBy docker_build
 }
diff --git a/common-controller/go.mod b/common-controller/go.mod
index a2b34d9c8..e59a3f7d1 100644
--- a/common-controller/go.mod
+++ b/common-controller/go.mod
@@ -6,9 +6,9 @@ require (
 	github.com/jackc/pgx/v5 v5.5.4
 	github.com/onsi/ginkgo/v2 v2.14.0
 	github.com/onsi/gomega v1.30.0
-	github.com/prometheus/client_golang v1.18.0 // indirect
+	github.com/prometheus/client_golang v1.19.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/sirupsen/logrus v1.9.0
+	github.com/sirupsen/logrus v1.9.3
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2
 	sigs.k8s.io/controller-runtime v0.17.2
@@ -51,7 +51,6 @@ require (
 	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -78,7 +77,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
@@ -113,7 +112,7 @@ require (
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.1 // indirect
+	golang.org/x/tools v0.17.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
diff --git a/common-controller/go.sum b/common-controller/go.sum
index e3caf33f3..2598979ee 100644
--- a/common-controller/go.sum
+++ b/common-controller/go.sum
@@ -52,10 +52,10 @@ github.com/envoyproxy/go-control-plane v0.13.0/go.mod h1:GRaKG3dwvFoTg4nj7aXdZnv
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
-github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
-github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
-github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
+github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
@@ -157,8 +157,6 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -185,8 +183,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
@@ -208,8 +206,8 @@ github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -250,8 +248,8 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
-go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/arch v0.3.0 h1:02VY4/ZcO/gBOH6PUaoiptASxtXU10jazRCP865E97k=
 golang.org/x/arch v0.3.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=

From c1d5174bf14b04a0e43d70ba60ccac6027bcbb82 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Tue, 13 Aug 2024 16:37:26 +0530
Subject: [PATCH 09/40] Fix ext auth bug

---
 .../gateway-api/bootstrap/bootstrap.yaml.tpl  |  2 +-
 .../kubernetes/proxy/resource.go              | 40 +++++++++----------
 .../gateway-api/translator/extauth.go         | 14 ++++++-
 3 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
index 26d703f49..a997a2884 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -186,6 +186,6 @@ static_resources:
             - endpoint:
                 address:
                   socket_address:
-                    address: enforcer
+                    address: 127.0.0.1
                     port_value: 8081
   
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 930bd8379..13e51d323 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -370,10 +370,10 @@ func expectedContainerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec
 			MountPath: "/home/wso2/security/truststore/ratelimiter.crt",
 			SubPath:   "tls.crt",
 		},
-		// {
-		// 	Name:      "log-conf-volume",
-		// 	MountPath: "/home/wso2/conf/",
-		// },
+		{
+			Name:      "log-conf-volume",
+			MountPath: "/home/wso2/conf/",
+		},
 		{
 			Name:      "enforcer-keystore-secret-volume",
 			MountPath: "/home/wso2/security/truststore/enforcer.crt",
@@ -465,9 +465,9 @@ func expectedEnforcerVolumeMounts(containerSpec *egv1a1.KubernetesContainerSpec)
 			Name:    "router-keystore-secret-volume",
 			SubPath: "tls.crt",
 		},
-		// {MountPath: "/home/wso2/conf/",
-		// 	Name: "log-conf-volume",
-		// },
+		{MountPath: "/home/wso2/conf/",
+			Name: "log-conf-volume",
+		},
 		{MountPath: "/home/wso2/security/keystore/mg.pem",
 			Name:    "enforcer-jwt-secret-volume",
 			SubPath: "mg.pem",
@@ -519,17 +519,17 @@ func expectedDeploymentVolumes(deploymentSpec *egv1a1.KubernetesDeploymentSpec)
 				},
 			},
 		},
-		// {
-		// 	Name: "log-conf-volume",
-		// 	VolumeSource: corev1.VolumeSource{
-		// 		ConfigMap: &corev1.ConfigMapVolumeSource{
-		// 			DefaultMode: ptr.To[int32](420),
-		// 			LocalObjectReference: corev1.LocalObjectReference{
-		// 				Name: "apk-test-wso2-apk-log-conf",
-		// 			},
-		// 		},
-		// 	},
-		// },
+		{
+			Name: "log-conf-volume",
+			VolumeSource: corev1.VolumeSource{
+				ConfigMap: &corev1.ConfigMapVolumeSource{
+					DefaultMode: ptr.To[int32](420),
+					LocalObjectReference: corev1.LocalObjectReference{
+						Name: "apk-test-wso2-apk-log-conf",
+					},
+				},
+			},
+		},
 		{
 			Name: "router-keystore-secret-volume",
 			VolumeSource: corev1.VolumeSource{
@@ -662,7 +662,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: conf.Deployment.Gateway.AdapterXDSPort,
+			Value: "18001",
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
@@ -690,7 +690,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "JAVA_OPTS",
-			Value: conf.Deployment.Gateway.JavaOpts,
+			Value: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5006 -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
 		},
 	}
 
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index b11f20a0b..5813b9491 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -104,10 +104,11 @@ func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
 
 	return &hcmv3.HttpFilter{
 		Name:     extAuthFilterName(extAuth),
-		Disabled: true,
+		Disabled: false,
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
 		},
+
 	}, nil
 }
 
@@ -119,6 +120,11 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 	config := &extauthv3.ExtAuthz{
 		TransportApiVersion: corev3.ApiVersion_V3,
 		FailureModeAllow:    false,
+		ClearRouteCache: true,
+		IncludePeerCertificate: true,
+		WithRequestBody: &extauthv3.BufferSettings{
+			MaxRequestBytes: 102400,
+		},
 	}
 
 	var headersToExtAuth []*matcherv3.StringMatcher
@@ -149,6 +155,12 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 				Timeout: &duration.Duration{
 					Seconds: defaultExtServiceRequestTimeout,
 				},	
+				InitialMetadata: []*corev3.HeaderValue{
+					&corev3.HeaderValue{
+						Key: "x-request-id",
+						Value: "%REQ(x-request-id)%",
+					},
+				},
 			},
 		}
 	}

From fc8abc219770ec914a0b5c9ac008a64c644e0ffe Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Tue, 13 Aug 2024 16:42:30 +0530
Subject: [PATCH 10/40] Revert "draft commit with helper changes"

This reverts commit 5ad2b5b954393dda3003801299f09f24692062d1.
---
 adapter/build.gradle           |     4 +-
 adapter/down.sh                |     3 -
 adapter/dup.sh                 |     2 -
 adapter/notes.md               |    39 -
 adapter/test copy.json         |  3124 --------
 adapter/test.json              | 12500 -------------------------------
 adapter/test.yaml              |    92 -
 common-controller/build.gradle |     4 +-
 common-controller/go.mod       |    13 +-
 common-controller/go.sum       |    26 +-
 10 files changed, 25 insertions(+), 15782 deletions(-)
 delete mode 100755 adapter/down.sh
 delete mode 100755 adapter/dup.sh
 delete mode 100644 adapter/notes.md
 delete mode 100644 adapter/test copy.json
 delete mode 100644 adapter/test.json
 delete mode 100644 adapter/test.yaml

diff --git a/adapter/build.gradle b/adapter/build.gradle
index d443b792d..e3b674c40 100644
--- a/adapter/build.gradle
+++ b/adapter/build.gradle
@@ -68,8 +68,8 @@ tasks.named('go_revive_run').configure {
 }
 
 tasks.named('go_build').configure {
-    // dependsOn go_revive_run
-    // dependsOn go_vet
+    dependsOn go_revive_run
+    dependsOn go_vet
     println("Running go build")
     finalizedBy docker_build
 }
diff --git a/adapter/down.sh b/adapter/down.sh
deleted file mode 100755
index 2f52ab262..000000000
--- a/adapter/down.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-kubectl scale deployment --replicas=0  -n apk apk-test-wso2-apk-adapter-deployment
-./gradlew build
-watch -n 1 minikube image rm apk-adapter:1.1.0-SNAPSHOT
\ No newline at end of file
diff --git a/adapter/dup.sh b/adapter/dup.sh
deleted file mode 100755
index 1b7d8944c..000000000
--- a/adapter/dup.sh
+++ /dev/null
@@ -1,2 +0,0 @@
-minikube image load apk-adapter:1.1.0-SNAPSHOT
-kubectl scale deployment --replicas=1 -n apk apk-test-wso2-apk-adapter-deployment
diff --git a/adapter/notes.md b/adapter/notes.md
deleted file mode 100644
index 2fd1ecb7a..000000000
--- a/adapter/notes.md
+++ /dev/null
@@ -1,39 +0,0 @@
-func getHTTPFilters(globalLuaScript string) []*hcmv3.HttpFilter {
-
- r.ProviderResources.GatewayAPIResources.Subscribe(ctx),
- 
-  buildXdsTCPListener(name, address string, port uint32, k
-  
-func (t *Translator) addXdsHTTPFilterChain(xdsListener *listenerv3.Listener,
-
-
-func (t *Translator) buildExtAuth(policy *egv1a1.SecurityPolicy, resources *Resources, envoyProxy *egv1a1.EnvoyProxy) (*ir.ExtAuth, error) {
-	// create a function like this and hard code the enforcer cluster and add this to the ir.httproute
-	
-irRoute := &ir.HTTPRoute{
-			Name: irRouteName(httpRoute, ruleIdx, matchIdx),
-		}
-		
-		
-Create a method name processAPI 
-in this function pass 
-securityPolicies []*API,
-	gateways []*GatewayContext,
-	routes []RouteContext,
-	resources *Resources,
-	xdsIR XdsIRMap,
-	
-
-loop through all targeted httproute refs in each API. find the correct irRoutes using this approach 
-
-irListener := xdsIR[irKey].GetHTTPListener(irListenerName(listener))
-			if irListener != nil {
-				for _, r := range irListener.Routes {
-					if strings.HasPrefix(r.Name, prefix) {
-
-now add the extAuth to all the matching irRoutes
-
-
-func enableFilterOnRoute(route *routev3.Route, filterName string) error {
-
-k delete httproute apk-test-wso2-apk-authentication-endpoint-ds-httproute apk-test-wso2-apk-commonoauth-ds-httproute apk-test-wso2-apk-config-deploy-api-route apk-test-wso2-apk-jwks-endpoint-ds-httproute apk-test-wso2-apk-dcr-ds-httproute apk-test-wso2-apk-oauth-ds-httproute -n apk
diff --git a/adapter/test copy.json b/adapter/test copy.json
deleted file mode 100644
index e8740719b..000000000
--- a/adapter/test copy.json	
+++ /dev/null
@@ -1,3124 +0,0 @@
-{
- "configs": [
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
-   "bootstrap": {
-    "node": {
-     "user_agent_name": "envoy",
-     "user_agent_build_version": {
-      "version": {
-       "major_number": 1,
-       "minor_number": 29,
-       "patch": 3
-      },
-      "metadata": {
-       "build.type": "RELEASE",
-       "ssl.version": "BoringSSL",
-       "revision.status": "Clean",
-       "revision.sha": "10e1e425fd84cc2cde985179655da08f68c9cb30"
-      }
-     },
-     "extensions": [
-      {
-       "name": "envoy.udp_packet_writer.default",
-       "category": "envoy.udp_packet_writer",
-       "type_urls": [
-        "envoy.extensions.udp_packet_writer.v3.UdpDefaultWriterFactory"
-       ]
-      },
-      {
-       "name": "envoy.udp_packet_writer.gso",
-       "category": "envoy.udp_packet_writer",
-       "type_urls": [
-        "envoy.extensions.udp_packet_writer.v3.UdpGsoBatchWriterFactory"
-       ]
-      },
-      {
-       "name": "envoy.route.early_data_policy.default",
-       "category": "envoy.route.early_data_policy",
-       "type_urls": [
-        "envoy.extensions.early_data.v3.DefaultEarlyDataPolicy"
-       ]
-      },
-      {
-       "name": "envoy.bandwidth_limit",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.buffer",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.cors",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.csrf",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.ext_authz",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.ext_proc",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.fault",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.filters.http.adaptive_concurrency",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.adaptive_concurrency.v3.AdaptiveConcurrency"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.admission_control",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.alternate_protocols_cache",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.alternate_protocols_cache.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.aws_lambda",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.aws_lambda.v3.Config",
-        "envoy.extensions.filters.http.aws_lambda.v3.PerRouteConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.aws_request_signing",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigning",
-        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigningPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.bandwidth_limit",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.bandwidth_limit.v3.BandwidthLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.basic_auth",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.basic_auth.v3.BasicAuth"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.buffer",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.buffer.v3.Buffer",
-        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.cache",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.cache.v3.CacheConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.cdn_loop",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.cdn_loop.v3.CdnLoopConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.composite",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.composite.v3.Composite"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.compressor",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.compressor.v3.Compressor",
-        "envoy.extensions.filters.http.compressor.v3.CompressorPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.connect_grpc_bridge",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.cors",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.cors.v3.Cors",
-        "envoy.extensions.filters.http.cors.v3.CorsPolicy"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.csrf",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.csrf.v3.CsrfPolicy"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.custom_response",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.custom_response.v3.CustomResponse"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.decompressor",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.decompressor.v3.Decompressor"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.dynamic_forward_proxy",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig",
-        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.ext_authz",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.ext_proc",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.ext_proc.v3.ExtProcPerRoute",
-        "envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.fault",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.fault.v3.HTTPFault"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.file_system_buffer",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.file_system_buffer.v3.FileSystemBufferFilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.gcp_authn",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.geoip",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.geoip.v3.Geoip"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_field_extraction",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_field_extraction.v3.GrpcFieldExtractionConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_http1_bridge",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_http1_reverse_bridge",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig",
-        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_json_transcoder",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_stats",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_stats.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.grpc_web",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.header_mutation",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
-        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.header_to_metadata",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.header_to_metadata.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.health_check",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.health_check.v3.HealthCheck"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.ip_tagging",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.ip_tagging.v3.IPTagging"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.json_to_metadata",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.json_to_metadata.v3.JsonToMetadata"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.jwt_authn",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication",
-        "envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.local_ratelimit",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.lua",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.lua.v3.Lua",
-        "envoy.extensions.filters.http.lua.v3.LuaPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.match_delegate",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.common.matching.v3.ExtensionWithMatcher",
-        "envoy.extensions.common.matching.v3.ExtensionWithMatcherPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.oauth2",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.oauth2.v3.OAuth2"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.on_demand",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.on_demand.v3.OnDemand",
-        "envoy.extensions.filters.http.on_demand.v3.PerRouteConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.original_src",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.original_src.v3.OriginalSrc"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.rate_limit_quota",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaFilterConfig",
-        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.ratelimit",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-        "envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.rbac",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.rbac.v3.RBAC",
-        "envoy.extensions.filters.http.rbac.v3.RBACPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.router",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.router.v3.Router"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.set_filter_state",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.set_filter_state.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.set_metadata",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.set_metadata.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.stateful_session",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.stateful_session.v3.StatefulSession",
-        "envoy.extensions.filters.http.stateful_session.v3.StatefulSessionPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.tap",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.tap.v3.Tap"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.wasm",
-       "category": "envoy.filters.http",
-       "type_urls": [
-        "envoy.extensions.filters.http.wasm.v3.Wasm"
-       ]
-      },
-      {
-       "name": "envoy.geoip",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.grpc_http1_bridge",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.grpc_json_transcoder",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.grpc_web",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.health_check",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.ip_tagging",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.local_rate_limit",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.lua",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.rate_limit",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.router",
-       "category": "envoy.filters.http"
-      },
-      {
-       "name": "envoy.config.validators.minimum_clusters",
-       "category": "envoy.config.validators"
-      },
-      {
-       "name": "envoy.config.validators.minimum_clusters_validator",
-       "category": "envoy.config.validators",
-       "type_urls": [
-        "envoy.extensions.config.validators.minimum_clusters.v3.MinimumClustersValidator"
-       ]
-      },
-      {
-       "name": "envoy.matching.matchers.cel_matcher",
-       "category": "envoy.matching.input_matchers",
-       "type_urls": [
-        "xds.type.matcher.v3.CelMatcher"
-       ]
-      },
-      {
-       "name": "envoy.matching.matchers.consistent_hashing",
-       "category": "envoy.matching.input_matchers",
-       "type_urls": [
-        "envoy.extensions.matching.input_matchers.consistent_hashing.v3.ConsistentHashing"
-       ]
-      },
-      {
-       "name": "envoy.matching.matchers.ip",
-       "category": "envoy.matching.input_matchers",
-       "type_urls": [
-        "envoy.extensions.matching.input_matchers.ip.v3.Ip"
-       ]
-      },
-      {
-       "name": "envoy.matching.matchers.runtime_fraction",
-       "category": "envoy.matching.input_matchers",
-       "type_urls": [
-        "envoy.extensions.matching.input_matchers.runtime_fraction.v3.RuntimeFraction"
-       ]
-      },
-      {
-       "name": "envoy.config_mux.delta_grpc_mux_factory",
-       "category": "envoy.config_mux"
-      },
-      {
-       "name": "envoy.config_mux.grpc_mux_factory",
-       "category": "envoy.config_mux"
-      },
-      {
-       "name": "envoy.config_mux.new_grpc_mux_factory",
-       "category": "envoy.config_mux"
-      },
-      {
-       "name": "envoy.config_mux.sotw_grpc_mux_factory",
-       "category": "envoy.config_mux"
-      },
-      {
-       "name": "envoy.filters.listener.original_dst.local_ip",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.filters.listener.original_dst.remote_ip",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.network.application_protocols",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.network.transport_socket.original_dst_address",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.network.upstream_server_name",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.network.upstream_subject_alt_names",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.string",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.tcp_proxy.cluster",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.tcp_proxy.disable_tunneling",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.upstream.dynamic_host",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.upstream.dynamic_port",
-       "category": "filter_state.object"
-      },
-      {
-       "name": "envoy.watchdog.abort_action",
-       "category": "envoy.guarddog_actions",
-       "type_urls": [
-        "envoy.watchdog.v3.AbortActionConfig"
-       ]
-      },
-      {
-       "name": "envoy.watchdog.profile_action",
-       "category": "envoy.guarddog_actions",
-       "type_urls": [
-        "envoy.extensions.watchdog.profile_action.v3.ProfileActionConfig"
-       ]
-      },
-      {
-       "name": "envoy.dog_statsd",
-       "category": "envoy.stats_sinks"
-      },
-      {
-       "name": "envoy.graphite_statsd",
-       "category": "envoy.stats_sinks"
-      },
-      {
-       "name": "envoy.metrics_service",
-       "category": "envoy.stats_sinks"
-      },
-      {
-       "name": "envoy.open_telemetry_stat_sink",
-       "category": "envoy.stats_sinks"
-      },
-      {
-       "name": "envoy.stat_sinks.dog_statsd",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.config.metrics.v3.DogStatsdSink"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.graphite_statsd",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.extensions.stat_sinks.graphite_statsd.v3.GraphiteStatsdSink"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.hystrix",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.config.metrics.v3.HystrixSink"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.metrics_service",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.config.metrics.v3.MetricsServiceConfig"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.open_telemetry",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.statsd",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.config.metrics.v3.StatsdSink"
-       ]
-      },
-      {
-       "name": "envoy.stat_sinks.wasm",
-       "category": "envoy.stats_sinks",
-       "type_urls": [
-        "envoy.extensions.stat_sinks.wasm.v3.Wasm"
-       ]
-      },
-      {
-       "name": "envoy.statsd",
-       "category": "envoy.stats_sinks"
-      },
-      {
-       "name": "envoy.health_check.event_sink.file",
-       "category": "envoy.health_check.event_sinks",
-       "type_urls": [
-        "envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink"
-       ]
-      },
-      {
-       "name": "default",
-       "category": "network.connection.client"
-      },
-      {
-       "name": "envoy_internal",
-       "category": "network.connection.client"
-      },
-      {
-       "name": "envoy.matching.common_inputs.environment_variable",
-       "category": "envoy.matching.common_inputs",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.environment_variable.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.extensions.http.custom_response.local_response_policy",
-       "category": "envoy.http.custom_response",
-       "type_urls": [
-        "envoy.extensions.http.custom_response.local_response_policy.v3.LocalResponsePolicy"
-       ]
-      },
-      {
-       "name": "envoy.extensions.http.custom_response.redirect_policy",
-       "category": "envoy.http.custom_response",
-       "type_urls": [
-        "envoy.extensions.http.custom_response.redirect_policy.v3.RedirectPolicy"
-       ]
-      },
-      {
-       "name": "envoy.retry_priorities.previous_priorities",
-       "category": "envoy.retry_priorities",
-       "type_urls": [
-        "envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.dubbo.router",
-       "category": "envoy.dubbo_proxy.filters",
-       "type_urls": [
-        "envoy.extensions.filters.network.dubbo_proxy.router.v3.Router"
-       ]
-      },
-      {
-       "name": "envoy.health_checkers.grpc",
-       "category": "envoy.health_checkers",
-       "type_urls": [
-        "envoy.config.core.v3.HealthCheck.GrpcHealthCheck"
-       ]
-      },
-      {
-       "name": "envoy.health_checkers.http",
-       "category": "envoy.health_checkers",
-       "type_urls": [
-        "envoy.config.core.v3.HealthCheck.HttpHealthCheck"
-       ]
-      },
-      {
-       "name": "envoy.health_checkers.redis",
-       "category": "envoy.health_checkers",
-       "type_urls": [
-        "envoy.extensions.health_checkers.redis.v3.Redis"
-       ]
-      },
-      {
-       "name": "envoy.health_checkers.tcp",
-       "category": "envoy.health_checkers",
-       "type_urls": [
-        "envoy.config.core.v3.HealthCheck.TcpHealthCheck"
-       ]
-      },
-      {
-       "name": "envoy.health_checkers.thrift",
-       "category": "envoy.health_checkers",
-       "type_urls": [
-        "envoy.extensions.health_checkers.thrift.v3.Thrift"
-       ]
-      },
-      {
-       "name": "envoy.extensions.http.cache.file_system_http_cache",
-       "category": "envoy.http.cache",
-       "type_urls": [
-        "envoy.extensions.http.cache.file_system_http_cache.v3.FileSystemHttpCacheConfig"
-       ]
-      },
-      {
-       "name": "envoy.extensions.http.cache.simple",
-       "category": "envoy.http.cache",
-       "type_urls": [
-        "envoy.extensions.http.cache.simple_http_cache.v3.SimpleHttpCacheConfig"
-       ]
-      },
-      {
-       "name": "envoy.grpc_credentials.aws_iam",
-       "category": "envoy.grpc_credentials"
-      },
-      {
-       "name": "envoy.grpc_credentials.default",
-       "category": "envoy.grpc_credentials"
-      },
-      {
-       "name": "envoy.grpc_credentials.file_based_metadata",
-       "category": "envoy.grpc_credentials"
-      },
-      {
-       "name": "envoy.bootstrap.internal_listener",
-       "category": "envoy.bootstrap",
-       "type_urls": [
-        "envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
-       ]
-      },
-      {
-       "name": "envoy.bootstrap.wasm",
-       "category": "envoy.bootstrap",
-       "type_urls": [
-        "envoy.extensions.wasm.v3.WasmService"
-       ]
-      },
-      {
-       "name": "envoy.extensions.network.socket_interface.default_socket_interface",
-       "category": "envoy.bootstrap",
-       "type_urls": [
-        "envoy.extensions.network.socket_interface.v3.DefaultSocketInterface"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.http_inspector",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.http_inspector.v3.HttpInspector"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.local_ratelimit",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.original_dst",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.original_src",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.original_src.v3.OriginalSrc"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.proxy_protocol",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
-       ]
-      },
-      {
-       "name": "envoy.filters.listener.tls_inspector",
-       "category": "envoy.filters.listener",
-       "type_urls": [
-        "envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
-       ]
-      },
-      {
-       "name": "envoy.listener.http_inspector",
-       "category": "envoy.filters.listener"
-      },
-      {
-       "name": "envoy.listener.original_dst",
-       "category": "envoy.filters.listener"
-      },
-      {
-       "name": "envoy.listener.original_src",
-       "category": "envoy.filters.listener"
-      },
-      {
-       "name": "envoy.listener.proxy_protocol",
-       "category": "envoy.filters.listener"
-      },
-      {
-       "name": "envoy.listener.tls_inspector",
-       "category": "envoy.filters.listener"
-      },
-      {
-       "name": "envoy.rate_limit_descriptors.expr",
-       "category": "envoy.rate_limit_descriptors",
-       "type_urls": [
-        "envoy.extensions.rate_limit_descriptors.expr.v3.Descriptor"
-       ]
-      },
-      {
-       "name": "auto",
-       "category": "envoy.thrift_proxy.transports"
-      },
-      {
-       "name": "framed",
-       "category": "envoy.thrift_proxy.transports"
-      },
-      {
-       "name": "header",
-       "category": "envoy.thrift_proxy.transports"
-      },
-      {
-       "name": "unframed",
-       "category": "envoy.thrift_proxy.transports"
-      },
-      {
-       "name": "envoy.http.header_validators.envoy_default",
-       "category": "envoy.http.header_validators",
-       "type_urls": [
-        "envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig"
-       ]
-      },
-      {
-       "name": "envoy.wasm.runtime.null",
-       "category": "envoy.wasm.runtime"
-      },
-      {
-       "name": "envoy.wasm.runtime.v8",
-       "category": "envoy.wasm.runtime"
-      },
-      {
-       "name": "envoy.http.stateful_header_formatters.preserve_case",
-       "category": "envoy.http.stateful_header_formatters",
-       "type_urls": [
-        "envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig"
-       ]
-      },
-      {
-       "name": "preserve_case",
-       "category": "envoy.http.stateful_header_formatters"
-      },
-      {
-       "name": "envoy.regex_engines.google_re2",
-       "category": "envoy.regex_engines",
-       "type_urls": [
-        "envoy.extensions.regex_engines.v3.GoogleRE2"
-       ]
-      },
-      {
-       "name": "envoy.config_subscription.ads",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.ads_collection",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.aggregated_grpc_collection",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.delta_grpc",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.delta_grpc_collection",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.filesystem",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.filesystem_collection",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.grpc",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.config_subscription.rest",
-       "category": "envoy.config_subscription"
-      },
-      {
-       "name": "envoy.quic.deterministic_connection_id_generator",
-       "category": "envoy.quic.connection_id_generator",
-       "type_urls": [
-        "envoy.extensions.quic.connection_id_generator.v3.DeterministicConnectionIdGeneratorConfig"
-       ]
-      },
-      {
-       "name": "quic.http_server_connection.default",
-       "category": "quic.http_server_connection"
-      },
-      {
-       "name": "envoy.retry_host_predicates.omit_canary_hosts",
-       "category": "envoy.retry_host_predicates",
-       "type_urls": [
-        "envoy.extensions.retry.host.omit_canary_hosts.v3.OmitCanaryHostsPredicate"
-       ]
-      },
-      {
-       "name": "envoy.retry_host_predicates.omit_host_metadata",
-       "category": "envoy.retry_host_predicates",
-       "type_urls": [
-        "envoy.extensions.retry.host.omit_host_metadata.v3.OmitHostMetadataConfig"
-       ]
-      },
-      {
-       "name": "envoy.retry_host_predicates.previous_hosts",
-       "category": "envoy.retry_host_predicates",
-       "type_urls": [
-        "envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
-       ]
-      },
-      {
-       "name": "envoy.path.match.uri_template.uri_template_matcher",
-       "category": "envoy.path.match",
-       "type_urls": [
-        "envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig"
-       ]
-      },
-      {
-       "name": "envoy.matching.custom_matchers.trie_matcher",
-       "category": "envoy.matching.network.custom_matchers",
-       "type_urls": [
-        "xds.type.matcher.v3.IPMatcher"
-       ]
-      },
-      {
-       "name": "envoy.compression.brotli.compressor",
-       "category": "envoy.compression.compressor",
-       "type_urls": [
-        "envoy.extensions.compression.brotli.compressor.v3.Brotli"
-       ]
-      },
-      {
-       "name": "envoy.compression.gzip.compressor",
-       "category": "envoy.compression.compressor",
-       "type_urls": [
-        "envoy.extensions.compression.gzip.compressor.v3.Gzip"
-       ]
-      },
-      {
-       "name": "envoy.compression.zstd.compressor",
-       "category": "envoy.compression.compressor",
-       "type_urls": [
-        "envoy.extensions.compression.zstd.compressor.v3.Zstd"
-       ]
-      },
-      {
-       "name": "envoy.http.early_header_mutation.header_mutation",
-       "category": "envoy.http.early_header_mutation",
-       "type_urls": [
-        "envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation"
-       ]
-      },
-      {
-       "name": "envoy.ip",
-       "category": "envoy.resolvers"
-      },
-      {
-       "name": "envoy.matching.actions.format_string",
-       "category": "envoy.matching.action",
-       "type_urls": [
-        "envoy.config.core.v3.SubstitutionFormatString"
-       ]
-      },
-      {
-       "name": "filter-chain-name",
-       "category": "envoy.matching.action",
-       "type_urls": [
-        "google.protobuf.StringValue"
-       ]
-      },
-      {
-       "name": "envoy.filters.udp.session.dynamic_forward_proxy",
-       "category": "envoy.filters.udp.session",
-       "type_urls": [
-        "envoy.extensions.filters.udp.udp_proxy.session.dynamic_forward_proxy.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.udp.session.http_capsule",
-       "category": "envoy.filters.udp.session",
-       "type_urls": [
-        "envoy.extensions.filters.udp.udp_proxy.session.http_capsule.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.connection_handler.default",
-       "category": "envoy.connection_handler"
-      },
-      {
-       "name": "envoy.formatter.cel",
-       "category": "envoy.formatter",
-       "type_urls": [
-        "envoy.extensions.formatter.cel.v3.Cel"
-       ]
-      },
-      {
-       "name": "envoy.formatter.metadata",
-       "category": "envoy.formatter",
-       "type_urls": [
-        "envoy.extensions.formatter.metadata.v3.Metadata"
-       ]
-      },
-      {
-       "name": "envoy.formatter.req_without_query",
-       "category": "envoy.formatter",
-       "type_urls": [
-        "envoy.extensions.formatter.req_without_query.v3.ReqWithoutQuery"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.file",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.file.v3.FileAccessLog"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.http_grpc",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.open_telemetry",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.stderr",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.stream.v3.StderrAccessLog"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.stdout",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.stream.v3.StdoutAccessLog"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.tcp_grpc",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig"
-       ]
-      },
-      {
-       "name": "envoy.access_loggers.wasm",
-       "category": "envoy.access_loggers",
-       "type_urls": [
-        "envoy.extensions.access_loggers.wasm.v3.WasmAccessLog"
-       ]
-      },
-      {
-       "name": "envoy.file_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.http_grpc_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.open_telemetry_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.stderr_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.stdout_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.tcp_grpc_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.wasm_access_log",
-       "category": "envoy.access_loggers"
-      },
-      {
-       "name": "envoy.listener_manager_impl.default",
-       "category": "envoy.listener_manager_impl",
-       "type_urls": [
-        "envoy.config.listener.v3.ListenerManager"
-       ]
-      },
-      {
-       "name": "envoy.listener_manager_impl.validation",
-       "category": "envoy.listener_manager_impl",
-       "type_urls": [
-        "envoy.config.listener.v3.ValidationListenerManager"
-       ]
-      },
-      {
-       "name": "envoy.dynamic.ot",
-       "category": "envoy.tracers"
-      },
-      {
-       "name": "envoy.tracers.datadog",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.DatadogConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.dynamic_ot",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.DynamicOtConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.opencensus",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.OpenCensusConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.opentelemetry",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.OpenTelemetryConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.skywalking",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.SkyWalkingConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.xray",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.XRayConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.zipkin",
-       "category": "envoy.tracers",
-       "type_urls": [
-        "envoy.config.trace.v3.ZipkinConfig"
-       ]
-      },
-      {
-       "name": "envoy.zipkin",
-       "category": "envoy.tracers"
-      },
-      {
-       "name": "envoy.http.stateful_session.cookie",
-       "category": "envoy.http.stateful_session",
-       "type_urls": [
-        "envoy.extensions.http.stateful_session.cookie.v3.CookieBasedSessionState"
-       ]
-      },
-      {
-       "name": "envoy.http.stateful_session.header",
-       "category": "envoy.http.stateful_session",
-       "type_urls": [
-        "envoy.extensions.http.stateful_session.header.v3.HeaderBasedSessionState"
-       ]
-      },
-      {
-       "name": "envoy.echo",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.ext_authz",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.filters.network.connection_limit",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.direct_response",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.direct_response.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.dubbo_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.dubbo_proxy.v3.DubboProxy"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.echo",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.echo.v3.Echo"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.ext_authz",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.ext_authz.v3.ExtAuthz"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.http_connection_manager",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.local_ratelimit",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.local_ratelimit.v3.LocalRateLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.mongo_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.ratelimit",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.ratelimit.v3.RateLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.rbac",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.rbac.v3.RBAC"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.redis_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.redis_proxy.v3.RedisProxy"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.set_filter_state",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.set_filter_state.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.sni_cluster",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.sni_dynamic_forward_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.tcp_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.thrift_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.thrift_proxy.v3.ThriftProxy"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.wasm",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.wasm.v3.Wasm"
-       ]
-      },
-      {
-       "name": "envoy.filters.network.zookeeper_proxy",
-       "category": "envoy.filters.network",
-       "type_urls": [
-        "envoy.extensions.filters.network.zookeeper_proxy.v3.ZooKeeperProxy"
-       ]
-      },
-      {
-       "name": "envoy.http_connection_manager",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.mongo_proxy",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.ratelimit",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.redis_proxy",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.tcp_proxy",
-       "category": "envoy.filters.network"
-      },
-      {
-       "name": "envoy.key_value.file_based",
-       "category": "envoy.common.key_value",
-       "type_urls": [
-        "envoy.extensions.key_value.file_based.v3.FileBasedKeyValueStoreConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.udp.dns_filter",
-       "category": "envoy.filters.udp_listener",
-       "type_urls": [
-        "envoy.extensions.filters.udp.dns_filter.v3.DnsFilterConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.udp_listener.udp_proxy",
-       "category": "envoy.filters.udp_listener",
-       "type_urls": [
-        "envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.application_protocol",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.destination_ip",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.destination_port",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.direct_source_ip",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.dns_san",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.filter_state",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.FilterStateInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.server_name",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_ip",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_port",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_type",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.subject",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.transport_protocol",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.uri_san",
-       "category": "envoy.matching.network.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
-       ]
-      },
-      {
-       "name": "envoy.tracers.opentelemetry.resource_detectors.dynatrace",
-       "category": "envoy.tracers.opentelemetry.resource_detectors",
-       "type_urls": [
-        "envoy.extensions.tracers.opentelemetry.resource_detectors.v3.DynatraceResourceDetectorConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.opentelemetry.resource_detectors.environment",
-       "category": "envoy.tracers.opentelemetry.resource_detectors",
-       "type_urls": [
-        "envoy.extensions.tracers.opentelemetry.resource_detectors.v3.EnvironmentResourceDetectorConfig"
-       ]
-      },
-      {
-       "name": "envoy.resource_monitors.fixed_heap",
-       "category": "envoy.resource_monitors",
-       "type_urls": [
-        "envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig"
-       ]
-      },
-      {
-       "name": "envoy.resource_monitors.injected_resource",
-       "category": "envoy.resource_monitors",
-       "type_urls": [
-        "envoy.extensions.resource_monitors.injected_resource.v3.InjectedResourceConfig"
-       ]
-      },
-      {
-       "name": "envoy.geoip_providers.maxmind",
-       "category": "envoy.geoip_providers",
-       "type_urls": [
-        "envoy.extensions.geoip_providers.maxmind.v3.MaxMindConfig"
-       ]
-      },
-      {
-       "name": "envoy.compression.brotli.decompressor",
-       "category": "envoy.compression.decompressor",
-       "type_urls": [
-        "envoy.extensions.compression.brotli.decompressor.v3.Brotli"
-       ]
-      },
-      {
-       "name": "envoy.compression.gzip.decompressor",
-       "category": "envoy.compression.decompressor",
-       "type_urls": [
-        "envoy.extensions.compression.gzip.decompressor.v3.Gzip"
-       ]
-      },
-      {
-       "name": "envoy.compression.zstd.decompressor",
-       "category": "envoy.compression.decompressor",
-       "type_urls": [
-        "envoy.extensions.compression.zstd.decompressor.v3.Zstd"
-       ]
-      },
-      {
-       "name": "auto",
-       "category": "envoy.thrift_proxy.protocols"
-      },
-      {
-       "name": "binary",
-       "category": "envoy.thrift_proxy.protocols"
-      },
-      {
-       "name": "binary/non-strict",
-       "category": "envoy.thrift_proxy.protocols"
-      },
-      {
-       "name": "compact",
-       "category": "envoy.thrift_proxy.protocols"
-      },
-      {
-       "name": "twitter",
-       "category": "envoy.thrift_proxy.protocols"
-      },
-      {
-       "name": "envoy.tls.cert_validator.default",
-       "category": "envoy.tls.cert_validator"
-      },
-      {
-       "name": "envoy.tls.cert_validator.spiffe",
-       "category": "envoy.tls.cert_validator"
-      },
-      {
-       "name": "envoy.network.dns_resolver.cares",
-       "category": "envoy.network.dns_resolver",
-       "type_urls": [
-        "envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig"
-       ]
-      },
-      {
-       "name": "envoy.network.dns_resolver.getaddrinfo",
-       "category": "envoy.network.dns_resolver",
-       "type_urls": [
-        "envoy.extensions.network.dns_resolver.getaddrinfo.v3.GetAddrInfoDnsResolverConfig"
-       ]
-      },
-      {
-       "name": "envoy.request_id.uuid",
-       "category": "envoy.request_id",
-       "type_urls": [
-        "envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig"
-       ]
-      },
-      {
-       "name": "envoy.quic.proof_source.filter_chain",
-       "category": "envoy.quic.proof_source",
-       "type_urls": [
-        "envoy.extensions.quic.proof_source.v3.ProofSourceConfig"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.cluster_provided",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.least_request",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.maglev",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.maglev.v3.Maglev"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.random",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.random.v3.Random"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.ring_hash",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.round_robin",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin"
-       ]
-      },
-      {
-       "name": "envoy.load_balancing_policies.subset",
-       "category": "envoy.load_balancing_policies",
-       "type_urls": [
-        "envoy.extensions.load_balancing_policies.subset.v3.Subset"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.alts",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.alts.v3.Alts"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.http_11_proxy",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.internal_upstream",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.quic",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.quic.v3.QuicUpstreamTransport"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.raw_buffer",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.starttls",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tap",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tap.v3.Tap"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tcp_stats",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tls",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.upstream_proxy_protocol",
-       "category": "envoy.transport_sockets.upstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport"
-       ]
-      },
-      {
-       "name": "raw_buffer",
-       "category": "envoy.transport_sockets.upstream"
-      },
-      {
-       "name": "starttls",
-       "category": "envoy.transport_sockets.upstream"
-      },
-      {
-       "name": "tls",
-       "category": "envoy.transport_sockets.upstream"
-      },
-      {
-       "name": "envoy.internal_redirect_predicates.allow_listed_routes",
-       "category": "envoy.internal_redirect_predicates",
-       "type_urls": [
-        "envoy.extensions.internal_redirect.allow_listed_routes.v3.AllowListedRoutesConfig"
-       ]
-      },
-      {
-       "name": "envoy.internal_redirect_predicates.previous_routes",
-       "category": "envoy.internal_redirect_predicates",
-       "type_urls": [
-        "envoy.extensions.internal_redirect.previous_routes.v3.PreviousRoutesConfig"
-       ]
-      },
-      {
-       "name": "envoy.internal_redirect_predicates.safe_cross_scheme",
-       "category": "envoy.internal_redirect_predicates",
-       "type_urls": [
-        "envoy.extensions.internal_redirect.safe_cross_scheme.v3.SafeCrossSchemeConfig"
-       ]
-      },
-      {
-       "name": "envoy.cluster.eds",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.cluster.logical_dns",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.cluster.original_dst",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.cluster.static",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.cluster.strict_dns",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.clusters.aggregate",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.clusters.dynamic_forward_proxy",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.clusters.redis",
-       "category": "envoy.clusters"
-      },
-      {
-       "name": "envoy.buffer",
-       "category": "envoy.filters.http.upstream"
-      },
-      {
-       "name": "envoy.filters.http.admission_control",
-       "category": "envoy.filters.http.upstream",
-       "type_urls": [
-        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.buffer",
-       "category": "envoy.filters.http.upstream",
-       "type_urls": [
-        "envoy.extensions.filters.http.buffer.v3.Buffer",
-        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.header_mutation",
-       "category": "envoy.filters.http.upstream",
-       "type_urls": [
-        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
-        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
-       ]
-      },
-      {
-       "name": "envoy.filters.http.upstream_codec",
-       "category": "envoy.filters.http.upstream",
-       "type_urls": [
-        "envoy.extensions.filters.http.upstream_codec.v3.UpstreamCodec"
-       ]
-      },
-      {
-       "name": "envoy.filters.thrift.header_to_metadata",
-       "category": "envoy.thrift_proxy.filters",
-       "type_urls": [
-        "envoy.extensions.filters.network.thrift_proxy.filters.header_to_metadata.v3.HeaderToMetadata"
-       ]
-      },
-      {
-       "name": "envoy.filters.thrift.payload_to_metadata",
-       "category": "envoy.thrift_proxy.filters",
-       "type_urls": [
-        "envoy.extensions.filters.network.thrift_proxy.filters.payload_to_metadata.v3.PayloadToMetadata"
-       ]
-      },
-      {
-       "name": "envoy.filters.thrift.rate_limit",
-       "category": "envoy.thrift_proxy.filters",
-       "type_urls": [
-        "envoy.extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit"
-       ]
-      },
-      {
-       "name": "envoy.filters.thrift.router",
-       "category": "envoy.thrift_proxy.filters",
-       "type_urls": [
-        "envoy.extensions.filters.network.thrift_proxy.router.v3.Router"
-       ]
-      },
-      {
-       "name": "envoy.http.original_ip_detection.custom_header",
-       "category": "envoy.http.original_ip_detection",
-       "type_urls": [
-        "envoy.extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig"
-       ]
-      },
-      {
-       "name": "envoy.http.original_ip_detection.xff",
-       "category": "envoy.http.original_ip_detection",
-       "type_urls": [
-        "envoy.extensions.http.original_ip_detection.xff.v3.XffConfig"
-       ]
-      },
-      {
-       "name": "envoy.tracers.opentelemetry.samplers.always_on",
-       "category": "envoy.tracers.opentelemetry.samplers",
-       "type_urls": [
-        "envoy.extensions.tracers.opentelemetry.samplers.v3.AlwaysOnSamplerConfig"
-       ]
-      },
-      {
-       "name": "envoy.router.cluster_specifier_plugin.lua",
-       "category": "envoy.router.cluster_specifier_plugin",
-       "type_urls": [
-        "envoy.extensions.router.cluster_specifiers.lua.v3.LuaConfig"
-       ]
-      },
-      {
-       "name": "envoy.filters.connection_pools.tcp.generic",
-       "category": "envoy.upstreams",
-       "type_urls": [
-        "envoy.extensions.upstreams.tcp.generic.v3.GenericConnectionPoolProto"
-       ]
-      },
-      {
-       "name": "envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-       "category": "envoy.upstream_options",
-       "type_urls": [
-        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-       ]
-      },
-      {
-       "name": "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions",
-       "category": "envoy.upstream_options",
-       "type_urls": [
-        "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions"
-       ]
-      },
-      {
-       "name": "envoy.upstreams.http.http_protocol_options",
-       "category": "envoy.upstream_options"
-      },
-      {
-       "name": "envoy.upstreams.tcp.tcp_protocol_options",
-       "category": "envoy.upstream_options"
-      },
-      {
-       "name": "dubbo.hessian2",
-       "category": "envoy.dubbo_proxy.serializers"
-      },
-      {
-       "name": "envoy.access_loggers.extension_filters.cel",
-       "category": "envoy.access_loggers.extension_filters",
-       "type_urls": [
-        "envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter"
-       ]
-      },
-      {
-       "name": "envoy.quic.crypto_stream.server.quiche",
-       "category": "envoy.quic.server.crypto_stream",
-       "type_urls": [
-        "envoy.extensions.quic.crypto_stream.v3.CryptoServerStreamConfig"
-       ]
-      },
-      {
-       "name": "envoy.rbac.matchers.upstream_ip_port",
-       "category": "envoy.rbac.matchers",
-       "type_urls": [
-        "envoy.extensions.rbac.matchers.upstream_ip_port.v3.UpstreamIpPortMatcher"
-       ]
-      },
-      {
-       "name": "envoy.upstream.local_address_selector.default_local_address_selector",
-       "category": "envoy.upstream.local_address_selector",
-       "type_urls": [
-        "envoy.config.upstream.local_address_selector.v3.DefaultLocalAddressSelector"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.cel_data_input",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "xds.type.matcher.v3.HttpAttributesCelMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.destination_ip",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.destination_port",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.direct_source_ip",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.dns_san",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.request_headers",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpRequestHeaderMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.request_trailers",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpRequestTrailerMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.response_headers",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpResponseHeaderMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.response_trailers",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpResponseTrailerMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.server_name",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_ip",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_port",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.source_type",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.status_code_class_input",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpResponseStatusCodeClassMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.status_code_input",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpResponseStatusCodeMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.subject",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
-       ]
-      },
-      {
-       "name": "envoy.matching.inputs.uri_san",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
-       ]
-      },
-      {
-       "name": "query_params",
-       "category": "envoy.matching.http.input",
-       "type_urls": [
-        "envoy.type.matcher.v3.HttpRequestQueryParamMatchInput"
-       ]
-      },
-      {
-       "name": "envoy.path.rewrite.uri_template.uri_template_rewriter",
-       "category": "envoy.path.rewrite",
-       "type_urls": [
-        "envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.alts",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.alts.v3.Alts"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.quic",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.raw_buffer",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.starttls",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tap",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tap.v3.Tap"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tcp_stats",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
-       ]
-      },
-      {
-       "name": "envoy.transport_sockets.tls",
-       "category": "envoy.transport_sockets.downstream",
-       "type_urls": [
-        "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext"
-       ]
-      },
-      {
-       "name": "raw_buffer",
-       "category": "envoy.transport_sockets.downstream"
-      },
-      {
-       "name": "starttls",
-       "category": "envoy.transport_sockets.downstream"
-      },
-      {
-       "name": "tls",
-       "category": "envoy.transport_sockets.downstream"
-      },
-      {
-       "name": "dubbo",
-       "category": "envoy.dubbo_proxy.protocols"
-      },
-      {
-       "name": "quic.server_preferred_address.fixed",
-       "category": "envoy.quic.server_preferred_address",
-       "type_urls": [
-        "envoy.extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig"
-       ]
-      },
-      {
-       "name": "envoy.matching.custom_matchers.trie_matcher",
-       "category": "envoy.matching.http.custom_matchers",
-       "type_urls": [
-        "xds.type.matcher.v3.IPMatcher"
-       ]
-      }
-     ]
-    },
-    "static_resources": {
-     "listeners": [
-      {
-       "name": "envoy-gateway-proxy-ready-0.0.0.0-19001",
-       "address": {
-        "socket_address": {
-         "address": "0.0.0.0",
-         "port_value": 19001
-        }
-       },
-       "filter_chains": [
-        {
-         "filters": [
-          {
-           "name": "envoy.filters.network.http_connection_manager",
-           "typed_config": {
-            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-            "stat_prefix": "eg-ready-http",
-            "route_config": {
-             "name": "local_route"
-            },
-            "http_filters": [
-             {
-              "name": "envoy.filters.http.health_check",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck",
-               "pass_through_mode": false,
-               "headers": [
-                {
-                 "name": ":path",
-                 "string_match": {
-                  "exact": "/ready"
-                 }
-                }
-               ]
-              }
-             },
-             {
-              "name": "envoy.filters.http.ext_authz",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-               "grpc_service": {
-                "envoy_grpc": {
-                 "cluster_name": "ext-authz"
-                }
-               },
-               "clear_route_cache": true,
-               "include_peer_certificate": true,
-               "transport_api_version": "V3"
-              }
-             },
-             {
-              "name": "envoy.filters.http.router",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-              }
-             }
-            ]
-           }
-          }
-         ]
-        }
-       ]
-      }
-     ],
-     "clusters": [
-      {
-       "name": "xds_cluster",
-       "type": "STRICT_DNS",
-       "connect_timeout": "10s",
-       "transport_socket": {
-        "name": "envoy.transport_sockets.tls",
-        "typed_config": {
-         "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-         "common_tls_context": {
-          "tls_params": {
-           "tls_maximum_protocol_version": "TLSv1_3"
-          },
-          "tls_certificates": [
-           {
-            "certificate_chain": {
-             "filename": "/home/wso2/security/keystore/router.crt"
-            },
-            "private_key": {
-             "filename": "[redacted]"
-            }
-           }
-          ],
-          "validation_context": {
-           "trusted_ca": {
-            "filename": "/home/wso2/security/truststore/adapter.crt"
-           }
-          }
-         }
-        }
-       },
-       "load_assignment": {
-        "cluster_name": "xds_cluster",
-        "endpoints": [
-         {
-          "lb_endpoints": [
-           {
-            "endpoint": {
-             "address": {
-              "socket_address": {
-               "address": "apk-test-wso2-apk-adapter-service.apk.svc",
-               "port_value": 18000
-              }
-             }
-            },
-            "load_balancing_weight": 1
-           }
-          ],
-          "load_balancing_weight": 1
-         }
-        ]
-       },
-       "typed_extension_protocol_options": {
-        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-         "explicit_http_config": {
-          "http2_protocol_options": {
-           "connection_keepalive": {
-            "interval": "30s",
-            "timeout": "5s"
-           }
-          }
-         }
-        }
-       }
-      },
-      {
-       "name": "ext-authz",
-       "type": "STRICT_DNS",
-       "connect_timeout": "20s",
-       "transport_socket": {
-        "name": "envoy.transport_sockets.tls",
-        "typed_config": {
-         "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-         "common_tls_context": {
-          "tls_params": {
-           "tls_minimum_protocol_version": "TLSv1_2",
-           "tls_maximum_protocol_version": "TLSv1_2"
-          },
-          "tls_certificates": [
-           {
-            "certificate_chain": {
-             "filename": "/home/wso2/security/keystore/router.crt"
-            },
-            "private_key": {
-             "filename": "[redacted]"
-            }
-           }
-          ],
-          "validation_context": {
-           "trusted_ca": {
-            "filename": "/home/wso2/security/truststore/enforcer.crt"
-           }
-          }
-         }
-        }
-       },
-       "load_assignment": {
-        "cluster_name": "ext-authz",
-        "endpoints": [
-         {
-          "lb_endpoints": [
-           {
-            "endpoint": {
-             "address": {
-              "socket_address": {
-               "address": "enforcer",
-               "port_value": 8081
-              }
-             }
-            }
-           }
-          ]
-         }
-        ]
-       },
-       "typed_extension_protocol_options": {
-        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-         "explicit_http_config": {
-          "http2_protocol_options": {}
-         }
-        }
-       }
-      }
-     ]
-    },
-    "dynamic_resources": {
-     "lds_config": {
-      "ads": {},
-      "resource_api_version": "V3"
-     },
-     "cds_config": {
-      "ads": {},
-      "resource_api_version": "V3"
-     },
-     "ads_config": {
-      "api_type": "DELTA_GRPC",
-      "grpc_services": [
-       {
-        "envoy_grpc": {
-         "cluster_name": "xds_cluster"
-        }
-       }
-      ],
-      "set_node_on_first_message_only": true,
-      "transport_api_version": "V3"
-     }
-    },
-    "admin": {
-     "address": {
-      "socket_address": {
-       "address": "0.0.0.0",
-       "port_value": 19000
-      }
-     },
-     "access_log": [
-      {
-       "name": "envoy.access_loggers.file",
-       "typed_config": {
-        "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-        "path": "/dev/null"
-       }
-      }
-     ]
-    },
-    "layered_runtime": {
-     "layers": [
-      {
-       "name": "global_config",
-       "static_layer": {
-        "envoy.restart_features.use_eds_cache_for_ads": true,
-        "re2.max_program_size.error_level": "4294967295",
-        "re2.max_program_size.warn_level": 1000
-       }
-      }
-     ]
-    }
-   },
-   "last_updated": "2024-08-06T09:04:42.710Z"
-  },
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.ClustersConfigDump",
-   "static_clusters": [
-    {
-     "cluster": {
-      "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
-      "name": "ext-authz",
-      "type": "STRICT_DNS",
-      "connect_timeout": "20s",
-      "transport_socket": {
-       "name": "envoy.transport_sockets.tls",
-       "typed_config": {
-        "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-        "common_tls_context": {
-         "tls_params": {
-          "tls_minimum_protocol_version": "TLSv1_2",
-          "tls_maximum_protocol_version": "TLSv1_2"
-         },
-         "tls_certificates": [
-          {
-           "certificate_chain": {
-            "filename": "/home/wso2/security/keystore/router.crt"
-           },
-           "private_key": {
-            "filename": "[redacted]"
-           }
-          }
-         ],
-         "validation_context": {
-          "trusted_ca": {
-           "filename": "/home/wso2/security/truststore/enforcer.crt"
-          }
-         }
-        }
-       }
-      },
-      "load_assignment": {
-       "cluster_name": "ext-authz",
-       "endpoints": [
-        {
-         "lb_endpoints": [
-          {
-           "endpoint": {
-            "address": {
-             "socket_address": {
-              "address": "enforcer",
-              "port_value": 8081
-             }
-            }
-           }
-          }
-         ]
-        }
-       ]
-      },
-      "typed_extension_protocol_options": {
-       "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-        "explicit_http_config": {
-         "http2_protocol_options": {}
-        }
-       }
-      }
-     },
-     "last_updated": "2024-08-06T09:04:42.743Z"
-    },
-    {
-     "cluster": {
-      "@type": "type.googleapis.com/envoy.config.cluster.v3.Cluster",
-      "name": "xds_cluster",
-      "type": "STRICT_DNS",
-      "connect_timeout": "10s",
-      "transport_socket": {
-       "name": "envoy.transport_sockets.tls",
-       "typed_config": {
-        "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-        "common_tls_context": {
-         "tls_params": {
-          "tls_maximum_protocol_version": "TLSv1_3"
-         },
-         "tls_certificates": [
-          {
-           "certificate_chain": {
-            "filename": "/home/wso2/security/keystore/router.crt"
-           },
-           "private_key": {
-            "filename": "[redacted]"
-           }
-          }
-         ],
-         "validation_context": {
-          "trusted_ca": {
-           "filename": "/home/wso2/security/truststore/adapter.crt"
-          }
-         }
-        }
-       }
-      },
-      "load_assignment": {
-       "cluster_name": "xds_cluster",
-       "endpoints": [
-        {
-         "lb_endpoints": [
-          {
-           "endpoint": {
-            "address": {
-             "socket_address": {
-              "address": "apk-test-wso2-apk-adapter-service.apk.svc",
-              "port_value": 18000
-             }
-            }
-           },
-           "load_balancing_weight": 1
-          }
-         ],
-         "load_balancing_weight": 1
-        }
-       ]
-      },
-      "typed_extension_protocol_options": {
-       "envoy.extensions.upstreams.http.v3.HttpProtocolOptions": {
-        "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-        "explicit_http_config": {
-         "http2_protocol_options": {
-          "connection_keepalive": {
-           "interval": "30s",
-           "timeout": "5s"
-          }
-         }
-        }
-       }
-      }
-     },
-     "last_updated": "2024-08-06T09:04:42.741Z"
-    }
-   ]
-  },
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.ListenersConfigDump",
-   "version_info": "5",
-   "static_listeners": [
-    {
-     "listener": {
-      "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-      "name": "envoy-gateway-proxy-ready-0.0.0.0-19001",
-      "address": {
-       "socket_address": {
-        "address": "0.0.0.0",
-        "port_value": 19001
-       }
-      },
-      "filter_chains": [
-       {
-        "filters": [
-         {
-          "name": "envoy.filters.network.http_connection_manager",
-          "typed_config": {
-           "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-           "stat_prefix": "eg-ready-http",
-           "route_config": {
-            "name": "local_route"
-           },
-           "http_filters": [
-            {
-             "name": "envoy.filters.http.health_check",
-             "typed_config": {
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.health_check.v3.HealthCheck",
-              "pass_through_mode": false,
-              "headers": [
-               {
-                "name": ":path",
-                "string_match": {
-                 "exact": "/ready"
-                }
-               }
-              ]
-             }
-            },
-            {
-             "name": "envoy.filters.http.ext_authz",
-             "typed_config": {
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-              "grpc_service": {
-               "envoy_grpc": {
-                "cluster_name": "ext-authz"
-               }
-              },
-              "clear_route_cache": true,
-              "include_peer_certificate": true,
-              "transport_api_version": "V3"
-             }
-            },
-            {
-             "name": "envoy.filters.http.router",
-             "typed_config": {
-              "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router"
-             }
-            }
-           ]
-          }
-         }
-        ]
-       }
-      ]
-     },
-     "last_updated": "2024-08-06T09:04:42.751Z"
-    }
-   ],
-   "dynamic_listeners": [
-    {
-     "name": "apk/wso2-apk-default/httpslistener",
-     "active_state": {
-      "version_info": "cc013422ba77df5c71d81a6c95fdae89f4a05971ab20b067808d0272bd13a1eb",
-      "listener": {
-       "@type": "type.googleapis.com/envoy.config.listener.v3.Listener",
-       "name": "apk/wso2-apk-default/httpslistener",
-       "address": {
-        "socket_address": {
-         "address": "0.0.0.0",
-         "port_value": 9095
-        }
-       },
-       "filter_chains": [
-        {
-         "filter_chain_match": {
-          "server_names": [
-           "api.am.wso2.com"
-          ]
-         },
-         "filters": [
-          {
-           "name": "envoy.filters.network.http_connection_manager",
-           "typed_config": {
-            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-            "stat_prefix": "https",
-            "rds": {
-             "config_source": {
-              "ads": {},
-              "resource_api_version": "V3"
-             },
-             "route_config_name": "apk/wso2-apk-default/httpslistener"
-            },
-            "http_filters": [
-             {
-              "name": "envoy.filters.http.router",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-               "suppress_envoy_headers": true
-              }
-             }
-            ],
-            "http2_protocol_options": {
-             "max_concurrent_streams": 100,
-             "initial_stream_window_size": 65536,
-             "initial_connection_window_size": 1048576
-            },
-            "access_log": [
-             {
-              "name": "envoy.access_loggers.file",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-               "path": "/dev/stdout",
-               "log_format": {
-                "text_format_source": {
-                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
-                }
-               }
-              }
-             }
-            ],
-            "use_remote_address": true,
-            "normalize_path": true,
-            "merge_slashes": true,
-            "server_header_transformation": "PASS_THROUGH",
-            "common_http_protocol_options": {
-             "headers_with_underscores_action": "REJECT_REQUEST"
-            }
-           }
-          }
-         ],
-         "transport_socket": {
-          "name": "envoy.transport_sockets.tls",
-          "typed_config": {
-           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-           "common_tls_context": {
-            "alpn_protocols": [
-             "h2",
-             "http/1.1"
-            ],
-            "tls_certificate_sds_secret_configs": [
-             {
-              "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
-              "sds_config": {
-               "ads": {},
-               "resource_api_version": "V3"
-              }
-             }
-            ]
-           }
-          }
-         }
-        },
-        {
-         "filter_chain_match": {
-          "server_names": [
-           "idp.am.wso2.com"
-          ]
-         },
-         "filters": [
-          {
-           "name": "envoy.filters.network.http_connection_manager",
-           "typed_config": {
-            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-            "stat_prefix": "https",
-            "rds": {
-             "config_source": {
-              "ads": {},
-              "resource_api_version": "V3"
-             },
-             "route_config_name": "apk/wso2-apk-default/idplistener"
-            },
-            "http_filters": [
-             {
-              "name": "envoy.filters.http.router",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-               "suppress_envoy_headers": true
-              }
-             }
-            ],
-            "http2_protocol_options": {
-             "max_concurrent_streams": 100,
-             "initial_stream_window_size": 65536,
-             "initial_connection_window_size": 1048576
-            },
-            "access_log": [
-             {
-              "name": "envoy.access_loggers.file",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-               "path": "/dev/stdout",
-               "log_format": {
-                "text_format_source": {
-                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
-                }
-               }
-              }
-             }
-            ],
-            "use_remote_address": true,
-            "normalize_path": true,
-            "merge_slashes": true,
-            "server_header_transformation": "PASS_THROUGH",
-            "common_http_protocol_options": {
-             "headers_with_underscores_action": "REJECT_REQUEST"
-            }
-           }
-          }
-         ],
-         "transport_socket": {
-          "name": "envoy.transport_sockets.tls",
-          "typed_config": {
-           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-           "common_tls_context": {
-            "alpn_protocols": [
-             "h2",
-             "http/1.1"
-            ],
-            "tls_certificate_sds_secret_configs": [
-             {
-              "name": "apk/apk-test-wso2-apk-idp-listener-cert",
-              "sds_config": {
-               "ads": {},
-               "resource_api_version": "V3"
-              }
-             }
-            ]
-           }
-          }
-         }
-        },
-        {
-         "filter_chain_match": {
-          "server_names": [
-           "*.gw.wso2.com"
-          ]
-         },
-         "filters": [
-          {
-           "name": "envoy.filters.network.http_connection_manager",
-           "typed_config": {
-            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-            "stat_prefix": "https",
-            "rds": {
-             "config_source": {
-              "ads": {},
-              "resource_api_version": "V3"
-             },
-             "route_config_name": "apk/wso2-apk-default/gatewaylistener"
-            },
-            "http_filters": [
-             {
-              "name": "envoy.filters.http.router",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-               "suppress_envoy_headers": true
-              }
-             }
-            ],
-            "http2_protocol_options": {
-             "max_concurrent_streams": 100,
-             "initial_stream_window_size": 65536,
-             "initial_connection_window_size": 1048576
-            },
-            "access_log": [
-             {
-              "name": "envoy.access_loggers.file",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-               "path": "/dev/stdout",
-               "log_format": {
-                "text_format_source": {
-                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
-                }
-               }
-              }
-             }
-            ],
-            "use_remote_address": true,
-            "normalize_path": true,
-            "merge_slashes": true,
-            "server_header_transformation": "PASS_THROUGH",
-            "common_http_protocol_options": {
-             "headers_with_underscores_action": "REJECT_REQUEST"
-            }
-           }
-          }
-         ],
-         "transport_socket": {
-          "name": "envoy.transport_sockets.tls",
-          "typed_config": {
-           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-           "common_tls_context": {
-            "alpn_protocols": [
-             "h2",
-             "http/1.1"
-            ],
-            "tls_certificate_sds_secret_configs": [
-             {
-              "name": "apk/apk-test-wso2-apk-gw-listener-cert",
-              "sds_config": {
-               "ads": {},
-               "resource_api_version": "V3"
-              }
-             }
-            ]
-           }
-          }
-         }
-        },
-        {
-         "filter_chain_match": {
-          "server_names": [
-           "localhost"
-          ]
-         },
-         "filters": [
-          {
-           "name": "envoy.filters.network.http_connection_manager",
-           "typed_config": {
-            "@type": "type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-            "stat_prefix": "https",
-            "rds": {
-             "config_source": {
-              "ads": {},
-              "resource_api_version": "V3"
-             },
-             "route_config_name": "apk/wso2-apk-default/systemlistener"
-            },
-            "http_filters": [
-             {
-              "name": "envoy.filters.http.router",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-               "suppress_envoy_headers": true
-              }
-             }
-            ],
-            "http2_protocol_options": {
-             "max_concurrent_streams": 100,
-             "initial_stream_window_size": 65536,
-             "initial_connection_window_size": 1048576
-            },
-            "access_log": [
-             {
-              "name": "envoy.access_loggers.file",
-              "typed_config": {
-               "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-               "path": "/dev/stdout",
-               "log_format": {
-                "text_format_source": {
-                 "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
-                }
-               }
-              }
-             }
-            ],
-            "use_remote_address": true,
-            "normalize_path": true,
-            "merge_slashes": true,
-            "server_header_transformation": "PASS_THROUGH",
-            "common_http_protocol_options": {
-             "headers_with_underscores_action": "REJECT_REQUEST"
-            }
-           }
-          }
-         ],
-         "transport_socket": {
-          "name": "envoy.transport_sockets.tls",
-          "typed_config": {
-           "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-           "common_tls_context": {
-            "alpn_protocols": [
-             "h2",
-             "http/1.1"
-            ],
-            "tls_certificate_sds_secret_configs": [
-             {
-              "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
-              "sds_config": {
-               "ads": {},
-               "resource_api_version": "V3"
-              }
-             }
-            ]
-           }
-          }
-         }
-        }
-       ],
-       "per_connection_buffer_limit_bytes": 32768,
-       "drain_type": "MODIFY_ONLY",
-       "listener_filters": [
-        {
-         "name": "envoy.filters.listener.tls_inspector",
-         "typed_config": {
-          "@type": "type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
-         }
-        }
-       ],
-       "access_log": [
-        {
-         "name": "envoy.access_loggers.file",
-         "filter": {
-          "response_flag_filter": {
-           "flags": [
-            "NR"
-           ]
-          }
-         },
-         "typed_config": {
-          "@type": "type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog",
-          "path": "/dev/stdout",
-          "log_format": {
-           "text_format_source": {
-            "inline_string": "{\"start_time\":\"%START_TIME%\",\"method\":\"%REQ(:METHOD)%\",\"x-envoy-origin-path\":\"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%\",\"protocol\":\"%PROTOCOL%\",\"response_code\":\"%RESPONSE_CODE%\",\"response_flags\":\"%RESPONSE_FLAGS%\",\"response_code_details\":\"%RESPONSE_CODE_DETAILS%\",\"connection_termination_details\":\"%CONNECTION_TERMINATION_DETAILS%\",\"upstream_transport_failure_reason\":\"%UPSTREAM_TRANSPORT_FAILURE_REASON%\",\"bytes_received\":\"%BYTES_RECEIVED%\",\"bytes_sent\":\"%BYTES_SENT%\",\"duration\":\"%DURATION%\",\"x-envoy-upstream-service-time\":\"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%\",\"x-forwarded-for\":\"%REQ(X-FORWARDED-FOR)%\",\"user-agent\":\"%REQ(USER-AGENT)%\",\"x-request-id\":\"%REQ(X-REQUEST-ID)%\",\":authority\":\"%REQ(:AUTHORITY)%\",\"upstream_host\":\"%UPSTREAM_HOST%\",\"upstream_cluster\":\"%UPSTREAM_CLUSTER%\",\"upstream_local_address\":\"%UPSTREAM_LOCAL_ADDRESS%\",\"downstream_local_address\":\"%DOWNSTREAM_LOCAL_ADDRESS%\",\"downstream_remote_address\":\"%DOWNSTREAM_REMOTE_ADDRESS%\",\"requested_server_name\":\"%REQUESTED_SERVER_NAME%\",\"route_name\":\"%ROUTE_NAME%\"}\n"
-           }
-          }
-         }
-        }
-       ]
-      },
-      "last_updated": "2024-08-06T09:04:43.009Z"
-     }
-    }
-   ]
-  },
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.ScopedRoutesConfigDump"
-  },
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.RoutesConfigDump",
-   "static_route_configs": [
-    {
-     "route_config": {
-      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "local_route"
-     },
-     "last_updated": "2024-08-06T09:04:42.748Z"
-    }
-   ],
-   "dynamic_route_configs": [
-    {
-     "version_info": "c1f165726a912d0509c252f8cc3ba51a91cd868e9a5916f7b8f5828de40bf93d",
-     "route_config": {
-      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "apk/wso2-apk-default/gatewaylistener",
-      "ignore_port_in_host_matching": true
-     },
-     "last_updated": "2024-08-06T09:04:43.025Z"
-    },
-    {
-     "version_info": "d42228dc46536b9cb20a0cae5aa5d50cb8468d881e370edf03c32102d1840ee0",
-     "route_config": {
-      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "apk/wso2-apk-default/idplistener",
-      "ignore_port_in_host_matching": true
-     },
-     "last_updated": "2024-08-06T09:04:55.996Z"
-    },
-    {
-     "version_info": "30b81ac246bad08d475bc9861b713a3931f840f866928e00d4fab88d1e88d24a",
-     "route_config": {
-      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "apk/wso2-apk-default/systemlistener",
-      "ignore_port_in_host_matching": true
-     },
-     "last_updated": "2024-08-06T09:04:43.025Z"
-    },
-    {
-     "version_info": "848bfb9ec8df544d9ba0ef09b486cb9f8090f39c85673ba13b933b8dd7e5748d",
-     "route_config": {
-      "@type": "type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-      "name": "apk/wso2-apk-default/httpslistener",
-      "ignore_port_in_host_matching": true
-     },
-     "last_updated": "2024-08-06T09:04:58.920Z"
-    }
-   ]
-  },
-  {
-   "@type": "type.googleapis.com/envoy.admin.v3.SecretsConfigDump",
-   "dynamic_active_secrets": [
-    {
-     "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
-     "version_info": "43f7018cc982d6d0a68c3d5a964fdcdb069599bea023db427dc3492677629b21",
-     "last_updated": "2024-08-06T09:04:43.029Z",
-     "secret": {
-      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
-      "name": "apk/apk-test-wso2-apk-localhost-listener-cert",
-      "tls_certificate": {
-       "certificate_chain": {
-        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM4ekNDQWR1Z0F3SUJBZ0lSQU1XVVRqdzZ6WEMvemRuZzRJYithYWt3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFNRngvL01rWmRLcGJSTWJVeXc2CjdGeCs0bnUvdnpIaHYrcjVxZThnMGZPZ1E2K2xGY09MQkoybmowQ2tsY1BseGtYWEo1R0Y0eU81eWZxNHNZbE4KUXYzeHZqY1l2RFU4a05ReVlSejVTK0Joenh4ZW5zaHVGZkdTQ3JLUkZLTDdyOFFHeEx5dXdvQkpNcGI2cmxtTAo0SksvQlZmbjRMdXBBNkZnemlpRExscEs1L2Z1QnJ2MjhLMzhIeGVONkpldUR6MURONUU3c3h3ZVVDMWFWenZ5CnRTTk9ZeHBGNE8rcGhycUdpUjdyUXJsc2FuNk9CbUE5cVBFUGVpZk5xZFp3SEdmM01GZ1lGc04vVTJKQVdjU0cKLzRqQktCYmJTWDVGUWJzeUQvdHRFLzJ3WElRZWVKMlJoN1RCSjVTaTYzVFBPRCs0MDZjMFltakxuemJ0cXY4MQpIYlVDQXdFQUFhTmFNRmd3RGdZRFZSMFBBUUgvQkFRREFnV2dNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqCkJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkxMUNXandjd0Z3WURWUjBSQVFIL0JBMHdDNElKYkc5allXeG8KYjNOME1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQmNkZzlIKzFMNVhqYWkvanhjbGVHOTE3Y09PSFJNUnVUegp1dk9wckF3MGpTbmVCcWF0T1daZis1cjNaUkhLMm9pRlZnS01SZS9MeURKWlA1YzVUd3BUbTJvNmREYU1NSHgyCm9majFqNWxIbEZReWNxZ2REb1o1YU9Kdkl3bU9yUUxITkJWcFBJQXdEaHZnSzFTNkZyZEh3OUVFWFVtUnlJeE8KRkRyMHlnU0ZCdGxKVzljS05UWHJCM1ZLRFZRRmd5YURuOTRKWG5hM1EwaXlwbGJQb09Tb01kU2dRVFkxV2sxRAo2cC9SUjM3Y0RiNklKRlVOL2hhZzlOKzdhNW03d2tkQ25TNU1uU1BpR3dDeGROMVBRL0Z1UUdRMDZoZjNnYnZGCnAxNHVFcXZWOGtmOFM1RmFPbzBJUEwyTDdpdFlQZTFRZFNPOTE3QU1OMk5HTEYwaUdrenoKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
-       },
-       "private_key": {
-        "inline_bytes": "W3JlZGFjdGVkXQ=="
-       }
-      }
-     }
-    },
-    {
-     "name": "apk/apk-test-wso2-apk-gw-listener-cert",
-     "version_info": "483266b548c2544528a6d86fe1f798455d822d617f26a12fefb65a118a04b08e",
-     "last_updated": "2024-08-06T09:04:43.031Z",
-     "secret": {
-      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
-      "name": "apk/apk-test-wso2-apk-gw-listener-cert",
-      "tls_certificate": {
-       "certificate_chain": {
-        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURJakNDQWdxZ0F3SUJBZ0lSQU1zUnY2dEErVlNTV0NReWUyRjVpamN3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFPcWEvdnQ0UkVKWm94eExSeVJGCkF5YVIyUDdWR0srdXlqMzN4NUZ6QXl2cEdSMlRiQkg4dFFLcHlGNzJqU3pSVVhGSVRGYUJ4bDMwcTQ3WUJjN2MKTXNpQzJBYlNENWtxNS9NdzZrNVovUHduU09qQnFiY1Z4d1hqMHpZWDM0TldDR0pWdXBNaS95eG9sbllFSjdTdgo4S3E3Z3BRNGFuNU9EdURWbWVaWi9GOG93QU9IQU9sS3cyQVNPL0RyWHBhK0c1WmFab3Q0TEFkYVhZZys0SEpnCnpvQUtZcHpwR0ljaWh4eVhkQTd4TGRlWGVTR3ZKTFBESjNhS1FRcmVzVEl0RUc4V24rOTZDVEk2dUc2TmdZZW8KMGV5UnpISkJRZSthQ1VlcFhIaVlkVXNzbGNpRXhJdlFFeW5qa2VvemxIVEUxUE94ckR0emF2RE1jTXpNM01NNgp3OFVDQXdFQUFhT0JpRENCaFRBT0JnTlZIUThCQWY4RUJBTUNCYUF3REFZRFZSMFRBUUgvQkFJd0FEQWZCZ05WCkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmxodUxYVUphUEJ6QkVCZ05WSFJFQkFmOEVPakE0Z2cwcUxtZDMKTG5kemJ6SXVZMjl0Z2hVcUxuTmhibVJpYjNndVozY3VkM052TWk1amIyMkNFSEJ5YjJRdVozY3VkM052TWk1agpiMjB3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUo1ZHJ0TUNmUGdkWFBBc3VhTXNOaWNBUkRtYWhkS3lab25wCnVkbmlERCtoZm1MaEVkLzZMUjZjUEJXdm9qTnltZ0hWd01mVWNhVGZKRlhzd3FvYVdLbTBHWTE0c1FBcWxPS3EKa1NhdG9iMHdPN3Q4VkpVTTZabUpHeFU5VVFiY2Y3UzZPRGlzc2dOcFp3OVVhMzREMmlhamZVTFVReDg2bnI5UAo2d0FUSXlLUkJuTTZjZE91MndmNkEyck5LM0NyTmtMUjhnY3pTR2hpNWlOZURMZVdUdUdSbk10OU9OMVFXTnA2CjRuQkJ4RHlSRmYxNTF2dFBFc29NOER5S3BNVVN3Uy83MHVYUnZMOEM2dXUzVWRCVUtvd2RJNWtqdDZYRWRWaXEKNjZJOStUZkNsOS9jbWpza2pNU0EzZjdqa3FjNUxaV2dzUXNpQnZLUEl1VTB2QktBdk1RPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-       },
-       "private_key": {
-        "inline_bytes": "W3JlZGFjdGVkXQ=="
-       }
-      }
-     }
-    },
-    {
-     "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
-     "version_info": "f5131907fa3d5995092b2d4f7b4361a02e196148489c4ec123dbf3d57ebfe68f",
-     "last_updated": "2024-08-06T09:04:43.030Z",
-     "secret": {
-      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
-      "name": "apk/apk-test-wso2-apk-system-api-listener-cert",
-      "tls_certificate": {
-       "certificate_chain": {
-        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURDekNDQWZPZ0F3SUJBZ0lRQkF4WTdsRG9vcWY0TnR1ajZoOTFwakFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpRd09EQXlNRGt5TmpRNFdoY05NalF4TURNeE1Ea3lOalE0V2pBQQpNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXFaVEhBbkFwTnlxV0JVemRqM05rCm5nUzkvdnRHZXJqOHM5eWpRNWxkVzgxelJnOWg3OVBhREpnWGo1cnBVQkVSbm1DRVVFSVB0Y3F3cnZjYVVUOU8KOFBieU5zVmdzUjIxcklVVkVDK0RYVXJFVStqMUh3THdoQkdUVVZudkFtL3M3Rmt4VVJ4N1JUMzgybURXWS9xbgpNbVQ4Q2hGRDhyeVVvc09ESERJazZBODAwM25tUXRydnlXQzJzRzMyRit0ZjAzUEN4K0xmU0xzWWJidllsSlV6CkR4SXpTaERlNGFEaDZRS2U2Z0ZMemJWRC9jR2RObkVJcHlLZm93TW9mVFpmTGZzQUN5RDJReUpteUprbkZCV2IKUmpwZ2kvL0ZwV3d3TnF6Ri9vWlgydkE0cXlwSW43dlArL2pzUWxuY2E5UWxoa3lEWVNZZ2MzOC9EWUFtSmQvMgpoUUlEQVFBQm8zTXdjVEFPQmdOVkhROEJBZjhFQkFNQ0JhQXdEQVlEVlIwVEFRSC9CQUl3QURBZkJnTlZIU01FCkdEQVdnQlRQRndEeHg0SVhtMzY4OTQ2bGh1TFhVSmFQQnpBd0JnTlZIUkVCQWY4RUpqQWtnaEVxTG1Gd2FTNWgKYlM1M2MyOHlMbU52YllJUFlYQnBMbUZ0TG5kemJ6SXVZMjl0TUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFDSAo0R1o5eSs0MUpDVkZncko0eHJiQ1E4cXZUSkU4emNtVkt1MSs2R3dnTWhmcFllS0NVeTFrdm44VnVzRDUzVDZpCnpsWnQ4Uk5oQmFqM1B2VVNBMDloMUNkNitINGNyRlFZUkgwWUtRaEhaQlpRbWRwdTNzeXFQanBJMmtZSUIxSUwKTDJyYlErWmlDR3hla2VISERvUWg1UytiSWFNQVVueGUrKzQ3L25RK1hUNnBSMWNBQUJ6ejEvQXA1RWZzZThldwo4K1VwQ3BwOXlCQ25DWGhRY25pQlVrVXlyY2hWdFNDOUxYanJ6Qno5aFBQdUNiMVVOWWJ0TERuOU9DNHYxUUs1CjJRcE0ybUJId3Y3OWxzS3NJd3g4SEFLdjNKb1FmQlRPVXhGMlA3RVBxZjgwTk9LaDgwd0dhMFZoOVBSaHhrcG4KODFrM1VKaXNTNHFBMUl2dzdkS24KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
-       },
-       "private_key": {
-        "inline_bytes": "W3JlZGFjdGVkXQ=="
-       }
-      }
-     }
-    },
-    {
-     "name": "apk/apk-test-wso2-apk-idp-listener-cert",
-     "version_info": "05e2acd38770d9d6082a166f3b8b4afd0a2b987e433d7cefc28a135c1f965784",
-     "last_updated": "2024-08-06T09:04:43.031Z",
-     "secret": {
-      "@type": "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret",
-      "name": "apk/apk-test-wso2-apk-idp-listener-cert",
-      "tls_certificate": {
-       "certificate_chain": {
-        "inline_bytes": "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURERENDQWZTZ0F3SUJBZ0lSQU9MZk5oaE9COE1qRER3cmF0YmQ3UVl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJME1EZ3dNakE1TWpZME9Gb1hEVEkwTVRBek1UQTVNalkwT0ZvdwpBRENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dFUEFEQ0NBUW9DZ2dFQkFMN08zTzFONC8zbCt3cmhEbGZOClI3TDU4SW40aU9rVDlIZnMxZGVvQ2tFQ0Q1TXJNcXNDSzFUQ3JzV2RzNUFqZWNuUEVDKytHRGVLWnhuR1RzaTcKNzlOaDNuT1dqbmRPR2Y1aGV2a3VVZGNwdEticHd0N1IyL2RxWE8rU2FXNE9oRS9XQjkyTGF3UGdkaGNScG1MdwprYjIvem1oWTE4blVMUFI2c1FCeS94SmR3b2hqaXYxdUVuZUdJTWFoVDFuZVVIZGVNMlRqOHBnYkdJellOSFo0CjJQZEplZ2x0MVJYZlY3bXovdjJERHZwQ3lGUythUldDNVFOOTloTVVXUG8wNnlHZEFoLzVnM3FwaW1ONjM1c00Kb1FKUll2ZDBoUUtVaXF6dmUzWWV4aWMzUUVqWmxtajRIYTB2aU1MemVmT2dSbDFmeUlqUHNVVjhJa2lORzZvYgpaVmtDQXdFQUFhTnpNSEV3RGdZRFZSMFBBUUgvQkFRREFnV2dNQXdHQTFVZEV3RUIvd1FDTUFBd0h3WURWUjBqCkJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkxMUNXandjd01BWURWUjBSQVFIL0JDWXdKSUlSS2k1cFpIQXUKWVcwdWQzTnZNaTVqYjIyQ0QybGtjQzVoYlM1M2MyOHlMbU52YlRBTkJna3Foa2lHOXcwQkFRc0ZBQU9DQVFFQQpjTVlvbkdiQWoyUmFTQUtvRjV3cHdlSVVYYlh3aU1XQ0Y4czlzRTdsa0U1RHJFd1ZWR1NjTFppU2dVVDdhd3gvCnh4UkVGNk9wTXRUY2pQV3RNRzNwRmk0bTZpcHVvSjFyZnJkdVhmVUNCNi9XbnhNUHZBZHBkcjZSODFQazBHUC8KaXp3Y096TVlaZnVud3piZEFyUGUyZW9BTDc1NGx0bTBSZzJ2ZTlXYnRFYUZqODFmZDJveFY2cm9LMzBoazVxcQprQkNOSkVRTXp1ZU1Nb2o1anljc3F1MzNSRUhpT0VSWlNUQjI0RDRIc3hrOThWQ2JtWEM2bm42blZCRjZ0MFhMCmJPZ0RiZDBVaExiZ2dTMU0wejlGa1NXM1lka21XMWdjS0RLWDdCV2Zwa0VGSXVwVGtMNDZYd25pVS9ic0pqeWgKcStKbVo5NGhqUHV4WUx5eXk5Q1RlUT09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
-       },
-       "private_key": {
-        "inline_bytes": "W3JlZGFjdGVkXQ=="
-       }
-      }
-     }
-    }
-   ]
-  }
- ]
-}
\ No newline at end of file
diff --git a/adapter/test.json b/adapter/test.json
deleted file mode 100644
index 26c967052..000000000
--- a/adapter/test.json
+++ /dev/null
@@ -1,12500 +0,0 @@
-{
-   "configs":[
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.BootstrapConfigDump",
-         "bootstrap":{
-            "node":{
-               "id":"default",
-               "cluster":"apk_router_cluster",
-               "metadata":{
-                  "instanceIdentifier":"apk-perftest-wso2-apk-gateway-runtime-deployment-664bffffbgd7dq"
-               },
-               "user_agent_name":"envoy",
-               "user_agent_build_version":{
-                  "version":{
-                     "major_number":1,
-                     "minor_number":27
-                  },
-                  "metadata":{
-                     "build.type":"RELEASE",
-                     "ssl.version":"BoringSSL",
-                     "revision.status":"Clean",
-                     "revision.sha":"7bba38b743bb3bca22dffb4a21c38ccc155fbef8"
-                  }
-               },
-               "extensions":[
-                  {
-                     "name":"envoy.connection_handler.default",
-                     "category":"envoy.connection_handler"
-                  },
-                  {
-                     "name":"envoy.dynamic.ot",
-                     "category":"envoy.tracers"
-                  },
-                  {
-                     "name":"envoy.tracers.datadog",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.DatadogConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.dynamic_ot",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.DynamicOtConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.opencensus",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.OpenCensusConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.opentelemetry",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.OpenTelemetryConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.skywalking",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.SkyWalkingConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.xray",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.XRayConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tracers.zipkin",
-                     "category":"envoy.tracers",
-                     "type_urls":[
-                        "envoy.config.trace.v3.ZipkinConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.zipkin",
-                     "category":"envoy.tracers"
-                  },
-                  {
-                     "name":"envoy.matching.custom_matchers.trie_matcher",
-                     "category":"envoy.matching.http.custom_matchers",
-                     "type_urls":[
-                        "xds.type.matcher.v3.IPMatcher"
-                     ]
-                  },
-                  {
-                     "name":"envoy.rate_limit_descriptors.expr",
-                     "category":"envoy.rate_limit_descriptors",
-                     "type_urls":[
-                        "envoy.extensions.rate_limit_descriptors.expr.v3.Descriptor"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.udp.dns_filter",
-                     "category":"envoy.filters.udp_listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.udp.dns_filter.v3.DnsFilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.udp_listener.udp_proxy",
-                     "category":"envoy.filters.udp_listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.udp.udp_proxy.v3.UdpProxyConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.extensions.http.custom_response.local_response_policy",
-                     "category":"envoy.http.custom_response",
-                     "type_urls":[
-                        "envoy.extensions.http.custom_response.local_response_policy.v3.LocalResponsePolicy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.extensions.http.custom_response.redirect_policy",
-                     "category":"envoy.http.custom_response",
-                     "type_urls":[
-                        "envoy.extensions.http.custom_response.redirect_policy.v3.RedirectPolicy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.original_ip_detection.custom_header",
-                     "category":"envoy.http.original_ip_detection",
-                     "type_urls":[
-                        "envoy.extensions.http.original_ip_detection.custom_header.v3.CustomHeaderConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.original_ip_detection.xff",
-                     "category":"envoy.http.original_ip_detection",
-                     "type_urls":[
-                        "envoy.extensions.http.original_ip_detection.xff.v3.XffConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.network.dns_resolver.cares",
-                     "category":"envoy.network.dns_resolver",
-                     "type_urls":[
-                        "envoy.extensions.network.dns_resolver.cares.v3.CaresDnsResolverConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.network.dns_resolver.getaddrinfo",
-                     "category":"envoy.network.dns_resolver",
-                     "type_urls":[
-                        "envoy.extensions.network.dns_resolver.getaddrinfo.v3.GetAddrInfoDnsResolverConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.matchers.cel_matcher",
-                     "category":"envoy.matching.input_matchers",
-                     "type_urls":[
-                        "xds.type.matcher.v3.CelMatcher"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.matchers.consistent_hashing",
-                     "category":"envoy.matching.input_matchers",
-                     "type_urls":[
-                        "envoy.extensions.matching.input_matchers.consistent_hashing.v3.ConsistentHashing"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.matchers.ip",
-                     "category":"envoy.matching.input_matchers",
-                     "type_urls":[
-                        "envoy.extensions.matching.input_matchers.ip.v3.Ip"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.matchers.runtime_fraction",
-                     "category":"envoy.matching.input_matchers",
-                     "type_urls":[
-                        "envoy.extensions.matching.input_matchers.runtime_fraction.v3.RuntimeFraction"
-                     ]
-                  },
-                  {
-                     "name":"envoy.grpc_credentials.aws_iam",
-                     "category":"envoy.grpc_credentials"
-                  },
-                  {
-                     "name":"envoy.grpc_credentials.default",
-                     "category":"envoy.grpc_credentials"
-                  },
-                  {
-                     "name":"envoy.grpc_credentials.file_based_metadata",
-                     "category":"envoy.grpc_credentials"
-                  },
-                  {
-                     "name":"envoy.config_subscription.ads",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.ads_collection",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.aggregated_grpc_collection",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.delta_grpc",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.delta_grpc_collection",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.filesystem",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.filesystem_collection",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.grpc",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.config_subscription.rest",
-                     "category":"envoy.config_subscription"
-                  },
-                  {
-                     "name":"envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                     "category":"envoy.upstream_options",
-                     "type_urls":[
-                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
-                     ]
-                  },
-                  {
-                     "name":"envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions",
-                     "category":"envoy.upstream_options",
-                     "type_urls":[
-                        "envoy.extensions.upstreams.tcp.v3.TcpProtocolOptions"
-                     ]
-                  },
-                  {
-                     "name":"envoy.upstreams.http.http_protocol_options",
-                     "category":"envoy.upstream_options"
-                  },
-                  {
-                     "name":"envoy.upstreams.tcp.tcp_protocol_options",
-                     "category":"envoy.upstream_options"
-                  },
-                  {
-                     "name":"envoy.health_checkers.grpc",
-                     "category":"envoy.health_checkers",
-                     "type_urls":[
-                        "envoy.config.core.v3.HealthCheck.GrpcHealthCheck"
-                     ]
-                  },
-                  {
-                     "name":"envoy.health_checkers.http",
-                     "category":"envoy.health_checkers",
-                     "type_urls":[
-                        "envoy.config.core.v3.HealthCheck.HttpHealthCheck"
-                     ]
-                  },
-                  {
-                     "name":"envoy.health_checkers.redis",
-                     "category":"envoy.health_checkers",
-                     "type_urls":[
-                        "envoy.extensions.health_checkers.redis.v3.Redis"
-                     ]
-                  },
-                  {
-                     "name":"envoy.health_checkers.tcp",
-                     "category":"envoy.health_checkers",
-                     "type_urls":[
-                        "envoy.config.core.v3.HealthCheck.TcpHealthCheck"
-                     ]
-                  },
-                  {
-                     "name":"envoy.health_checkers.thrift",
-                     "category":"envoy.health_checkers",
-                     "type_urls":[
-                        "envoy.extensions.health_checkers.thrift.v3.Thrift"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.stateful_header_formatters.preserve_case",
-                     "category":"envoy.http.stateful_header_formatters",
-                     "type_urls":[
-                        "envoy.extensions.http.header_formatters.preserve_case.v3.PreserveCaseFormatterConfig"
-                     ]
-                  },
-                  {
-                     "name":"preserve_case",
-                     "category":"envoy.http.stateful_header_formatters"
-                  },
-                  {
-                     "name":"envoy.filters.connection_pools.tcp.generic",
-                     "category":"envoy.upstreams",
-                     "type_urls":[
-                        "envoy.extensions.upstreams.tcp.generic.v3.GenericConnectionPoolProto"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.cluster_provided",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.least_request",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.least_request.v3.LeastRequest"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.maglev",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.maglev.v3.Maglev"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.random",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.random.v3.Random"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.ring_hash",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.ring_hash.v3.RingHash"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.round_robin",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.round_robin.v3.RoundRobin"
-                     ]
-                  },
-                  {
-                     "name":"envoy.load_balancing_policies.subset",
-                     "category":"envoy.load_balancing_policies",
-                     "type_urls":[
-                        "envoy.extensions.load_balancing_policies.subset.v3.Subset"
-                     ]
-                  },
-                  {
-                     "name":"envoy.retry_host_predicates.omit_canary_hosts",
-                     "category":"envoy.retry_host_predicates",
-                     "type_urls":[
-                        "envoy.extensions.retry.host.omit_canary_hosts.v3.OmitCanaryHostsPredicate"
-                     ]
-                  },
-                  {
-                     "name":"envoy.retry_host_predicates.omit_host_metadata",
-                     "category":"envoy.retry_host_predicates",
-                     "type_urls":[
-                        "envoy.extensions.retry.host.omit_host_metadata.v3.OmitHostMetadataConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.retry_host_predicates.previous_hosts",
-                     "category":"envoy.retry_host_predicates",
-                     "type_urls":[
-                        "envoy.extensions.retry.host.previous_hosts.v3.PreviousHostsPredicate"
-                     ]
-                  },
-                  {
-                     "name":"envoy.path.match.uri_template.uri_template_matcher",
-                     "category":"envoy.path.match",
-                     "type_urls":[
-                        "envoy.extensions.path.match.uri_template.v3.UriTemplateMatchConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.alts",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.alts.v3.Alts"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.http_11_proxy",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.http_11_proxy.v3.Http11ProxyUpstreamTransport"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.internal_upstream",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.internal_upstream.v3.InternalUpstreamTransport"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.quic",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.quic.v3.QuicUpstreamTransport"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.raw_buffer",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.starttls",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.starttls.v3.UpstreamStartTlsConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tap",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tap.v3.Tap"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tcp_stats",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tls",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.upstream_proxy_protocol",
-                     "category":"envoy.transport_sockets.upstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.proxy_protocol.v3.ProxyProtocolUpstreamTransport"
-                     ]
-                  },
-                  {
-                     "name":"raw_buffer",
-                     "category":"envoy.transport_sockets.upstream"
-                  },
-                  {
-                     "name":"starttls",
-                     "category":"envoy.transport_sockets.upstream"
-                  },
-                  {
-                     "name":"tls",
-                     "category":"envoy.transport_sockets.upstream"
-                  },
-                  {
-                     "name":"envoy.bandwidth_limit",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.buffer",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.cors",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.csrf",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.ext_authz",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.ext_proc",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.fault",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.filters.http.adaptive_concurrency",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.adaptive_concurrency.v3.AdaptiveConcurrency"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.admission_control",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.alternate_protocols_cache",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.alternate_protocols_cache.v3.FilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.aws_lambda",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.aws_lambda.v3.Config",
-                        "envoy.extensions.filters.http.aws_lambda.v3.PerRouteConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.aws_request_signing",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigning",
-                        "envoy.extensions.filters.http.aws_request_signing.v3.AwsRequestSigningPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.bandwidth_limit",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.bandwidth_limit.v3.BandwidthLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.buffer",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.buffer.v3.Buffer",
-                        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.cache",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.cache.v3.CacheConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.cdn_loop",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.cdn_loop.v3.CdnLoopConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.composite",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.composite.v3.Composite"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.compressor",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.compressor.v3.Compressor",
-                        "envoy.extensions.filters.http.compressor.v3.CompressorPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.connect_grpc_bridge",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.connect_grpc_bridge.v3.FilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.cors",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.cors.v3.Cors",
-                        "envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.csrf",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.csrf.v3.CsrfPolicy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.custom_response",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.custom_response.v3.CustomResponse"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.decompressor",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.decompressor.v3.Decompressor"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.dynamic_forward_proxy",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.FilterConfig",
-                        "envoy.extensions.filters.http.dynamic_forward_proxy.v3.PerRouteConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.ext_authz",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                        "envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.ext_proc",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.ext_proc.v3.ExtProcPerRoute",
-                        "envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.fault",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.fault.v3.HTTPFault"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.file_system_buffer",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.file_system_buffer.v3.FileSystemBufferFilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.gcp_authn",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.gcp_authn.v3.GcpAuthnFilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.geoip",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.geoip.v3.Geoip"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_field_extraction",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_field_extraction.v3.GrpcFieldExtractionConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_http1_bridge",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_http1_bridge.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_http1_reverse_bridge",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfig",
-                        "envoy.extensions.filters.http.grpc_http1_reverse_bridge.v3.FilterConfigPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_json_transcoder",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_stats",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_stats.v3.FilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.grpc_web",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.grpc_web.v3.GrpcWeb"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.header_mutation",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
-                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.header_to_metadata",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.header_to_metadata.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.health_check",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.health_check.v3.HealthCheck"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.ip_tagging",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.ip_tagging.v3.IPTagging"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.jwt_authn",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.jwt_authn.v3.JwtAuthentication",
-                        "envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.local_ratelimit",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.lua",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.lua.v3.Lua",
-                        "envoy.extensions.filters.http.lua.v3.LuaPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.match_delegate",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.common.matching.v3.ExtensionWithMatcher",
-                        "envoy.extensions.common.matching.v3.ExtensionWithMatcherPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.oauth2",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.oauth2.v3.OAuth2"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.on_demand",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.on_demand.v3.OnDemand",
-                        "envoy.extensions.filters.http.on_demand.v3.PerRouteConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.original_src",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.original_src.v3.OriginalSrc"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.rate_limit_quota",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaFilterConfig",
-                        "envoy.extensions.filters.http.rate_limit_quota.v3.RateLimitQuotaOverride"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.ratelimit",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-                        "envoy.extensions.filters.http.ratelimit.v3.RateLimitPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.rbac",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.rbac.v3.RBAC",
-                        "envoy.extensions.filters.http.rbac.v3.RBACPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.router",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.router.v3.Router"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.set_metadata",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.set_metadata.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.stateful_session",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.stateful_session.v3.StatefulSession",
-                        "envoy.extensions.filters.http.stateful_session.v3.StatefulSessionPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.tap",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.tap.v3.Tap"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.wasm",
-                     "category":"envoy.filters.http",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.wasm.v3.Wasm"
-                     ]
-                  },
-                  {
-                     "name":"envoy.geoip",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.grpc_http1_bridge",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.grpc_json_transcoder",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.grpc_web",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.health_check",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.ip_tagging",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.local_rate_limit",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.lua",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.rate_limit",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.router",
-                     "category":"envoy.filters.http"
-                  },
-                  {
-                     "name":"envoy.matching.common_inputs.environment_variable",
-                     "category":"envoy.matching.common_inputs",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.environment_variable.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.tls.cert_validator.default",
-                     "category":"envoy.tls.cert_validator"
-                  },
-                  {
-                     "name":"envoy.tls.cert_validator.spiffe",
-                     "category":"envoy.tls.cert_validator"
-                  },
-                  {
-                     "name":"envoy.config_mux.delta_grpc_mux_factory",
-                     "category":"envoy.config_mux"
-                  },
-                  {
-                     "name":"envoy.config_mux.grpc_mux_factory",
-                     "category":"envoy.config_mux"
-                  },
-                  {
-                     "name":"envoy.config_mux.new_grpc_mux_factory",
-                     "category":"envoy.config_mux"
-                  },
-                  {
-                     "name":"envoy.config_mux.sotw_grpc_mux_factory",
-                     "category":"envoy.config_mux"
-                  },
-                  {
-                     "name":"envoy.buffer",
-                     "category":"envoy.filters.http.upstream"
-                  },
-                  {
-                     "name":"envoy.filters.http.admission_control",
-                     "category":"envoy.filters.http.upstream",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.admission_control.v3.AdmissionControl"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.buffer",
-                     "category":"envoy.filters.http.upstream",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.buffer.v3.Buffer",
-                        "envoy.extensions.filters.http.buffer.v3.BufferPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.header_mutation",
-                     "category":"envoy.filters.http.upstream",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutation",
-                        "envoy.extensions.filters.http.header_mutation.v3.HeaderMutationPerRoute"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.http.upstream_codec",
-                     "category":"envoy.filters.http.upstream",
-                     "type_urls":[
-                        "envoy.extensions.filters.http.upstream_codec.v3.UpstreamCodec"
-                     ]
-                  },
-                  {
-                     "name":"envoy.wasm.runtime.null",
-                     "category":"envoy.wasm.runtime"
-                  },
-                  {
-                     "name":"envoy.wasm.runtime.v8",
-                     "category":"envoy.wasm.runtime"
-                  },
-                  {
-                     "name":"envoy.internal_redirect_predicates.allow_listed_routes",
-                     "category":"envoy.internal_redirect_predicates",
-                     "type_urls":[
-                        "envoy.extensions.internal_redirect.allow_listed_routes.v3.AllowListedRoutesConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.internal_redirect_predicates.previous_routes",
-                     "category":"envoy.internal_redirect_predicates",
-                     "type_urls":[
-                        "envoy.extensions.internal_redirect.previous_routes.v3.PreviousRoutesConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.internal_redirect_predicates.safe_cross_scheme",
-                     "category":"envoy.internal_redirect_predicates",
-                     "type_urls":[
-                        "envoy.extensions.internal_redirect.safe_cross_scheme.v3.SafeCrossSchemeConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.alts",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.alts.v3.Alts"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.quic",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.quic.v3.QuicDownstreamTransport"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.raw_buffer",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.raw_buffer.v3.RawBuffer"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.starttls",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.starttls.v3.StartTlsConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tap",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tap.v3.Tap"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tcp_stats",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tcp_stats.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.transport_sockets.tls",
-                     "category":"envoy.transport_sockets.downstream",
-                     "type_urls":[
-                        "envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext"
-                     ]
-                  },
-                  {
-                     "name":"raw_buffer",
-                     "category":"envoy.transport_sockets.downstream"
-                  },
-                  {
-                     "name":"starttls",
-                     "category":"envoy.transport_sockets.downstream"
-                  },
-                  {
-                     "name":"tls",
-                     "category":"envoy.transport_sockets.downstream"
-                  },
-                  {
-                     "name":"envoy.config.validators.minimum_clusters",
-                     "category":"envoy.config.validators"
-                  },
-                  {
-                     "name":"envoy.config.validators.minimum_clusters_validator",
-                     "category":"envoy.config.validators",
-                     "type_urls":[
-                        "envoy.extensions.config.validators.minimum_clusters.v3.MinimumClustersValidator"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.file",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.file.v3.FileAccessLog"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.http_grpc",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.grpc.v3.HttpGrpcAccessLogConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.open_telemetry",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.open_telemetry.v3.OpenTelemetryAccessLogConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.stderr",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.stream.v3.StderrAccessLog"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.stdout",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.stream.v3.StdoutAccessLog"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.tcp_grpc",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.grpc.v3.TcpGrpcAccessLogConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.wasm",
-                     "category":"envoy.access_loggers",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.wasm.v3.WasmAccessLog"
-                     ]
-                  },
-                  {
-                     "name":"envoy.file_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.http_grpc_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.open_telemetry_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.stderr_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.stdout_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.tcp_grpc_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"envoy.wasm_access_log",
-                     "category":"envoy.access_loggers"
-                  },
-                  {
-                     "name":"dubbo",
-                     "category":"envoy.dubbo_proxy.protocols"
-                  },
-                  {
-                     "name":"auto",
-                     "category":"envoy.thrift_proxy.protocols"
-                  },
-                  {
-                     "name":"binary",
-                     "category":"envoy.thrift_proxy.protocols"
-                  },
-                  {
-                     "name":"binary/non-strict",
-                     "category":"envoy.thrift_proxy.protocols"
-                  },
-                  {
-                     "name":"compact",
-                     "category":"envoy.thrift_proxy.protocols"
-                  },
-                  {
-                     "name":"twitter",
-                     "category":"envoy.thrift_proxy.protocols"
-                  },
-                  {
-                     "name":"envoy.route.early_data_policy.default",
-                     "category":"envoy.route.early_data_policy",
-                     "type_urls":[
-                        "envoy.extensions.early_data.v3.DefaultEarlyDataPolicy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.brotli.decompressor",
-                     "category":"envoy.compression.decompressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.brotli.decompressor.v3.Brotli"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.gzip.decompressor",
-                     "category":"envoy.compression.decompressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.gzip.decompressor.v3.Gzip"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.zstd.decompressor",
-                     "category":"envoy.compression.decompressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.zstd.decompressor.v3.Zstd"
-                     ]
-                  },
-                  {
-                     "name":"envoy.health_check.event_sink.file",
-                     "category":"envoy.health_check.event_sinks",
-                     "type_urls":[
-                        "envoy.extensions.health_check.event_sinks.file.v3.HealthCheckEventFileSink"
-                     ]
-                  },
-                  {
-                     "name":"default",
-                     "category":"network.connection.client"
-                  },
-                  {
-                     "name":"envoy_internal",
-                     "category":"network.connection.client"
-                  },
-                  {
-                     "name":"envoy.regex_engines.google_re2",
-                     "category":"envoy.regex_engines",
-                     "type_urls":[
-                        "envoy.extensions.regex_engines.v3.GoogleRE2"
-                     ]
-                  },
-                  {
-                     "name":"envoy.access_loggers.extension_filters.cel",
-                     "category":"envoy.access_loggers.extension_filters",
-                     "type_urls":[
-                        "envoy.extensions.access_loggers.filters.cel.v3.ExpressionFilter"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.early_header_mutation.header_mutation",
-                     "category":"envoy.http.early_header_mutation",
-                     "type_urls":[
-                        "envoy.extensions.http.early_header_mutation.header_mutation.v3.HeaderMutation"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.cel_data_input",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "xds.type.matcher.v3.HttpAttributesCelMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.destination_ip",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.destination_port",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.direct_source_ip",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.dns_san",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.request_headers",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpRequestHeaderMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.request_trailers",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpRequestTrailerMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.response_headers",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpResponseHeaderMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.response_trailers",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpResponseTrailerMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.server_name",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_ip",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_port",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_type",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.status_code_class_input",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpResponseStatusCodeClassMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.status_code_input",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpResponseStatusCodeMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.subject",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.uri_san",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
-                     ]
-                  },
-                  {
-                     "name":"query_params",
-                     "category":"envoy.matching.http.input",
-                     "type_urls":[
-                        "envoy.type.matcher.v3.HttpRequestQueryParamMatchInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.formatter.cel",
-                     "category":"envoy.formatter",
-                     "type_urls":[
-                        "envoy.extensions.formatter.cel.v3.Cel"
-                     ]
-                  },
-                  {
-                     "name":"envoy.formatter.metadata",
-                     "category":"envoy.formatter",
-                     "type_urls":[
-                        "envoy.extensions.formatter.metadata.v3.Metadata"
-                     ]
-                  },
-                  {
-                     "name":"envoy.formatter.req_without_query",
-                     "category":"envoy.formatter",
-                     "type_urls":[
-                        "envoy.extensions.formatter.req_without_query.v3.ReqWithoutQuery"
-                     ]
-                  },
-                  {
-                     "name":"envoy.ip",
-                     "category":"envoy.resolvers"
-                  },
-                  {
-                     "name":"envoy.filters.dubbo.router",
-                     "category":"envoy.dubbo_proxy.filters",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.dubbo_proxy.router.v3.Router"
-                     ]
-                  },
-                  {
-                     "name":"envoy.bootstrap.internal_listener",
-                     "category":"envoy.bootstrap",
-                     "type_urls":[
-                        "envoy.extensions.bootstrap.internal_listener.v3.InternalListener"
-                     ]
-                  },
-                  {
-                     "name":"envoy.bootstrap.wasm",
-                     "category":"envoy.bootstrap",
-                     "type_urls":[
-                        "envoy.extensions.wasm.v3.WasmService"
-                     ]
-                  },
-                  {
-                     "name":"envoy.extensions.network.socket_interface.default_socket_interface",
-                     "category":"envoy.bootstrap",
-                     "type_urls":[
-                        "envoy.extensions.network.socket_interface.v3.DefaultSocketInterface"
-                     ]
-                  },
-                  {
-                     "name":"envoy.udp_packet_writer.default",
-                     "category":"envoy.udp_packet_writer",
-                     "type_urls":[
-                        "envoy.extensions.udp_packet_writer.v3.UdpDefaultWriterFactory"
-                     ]
-                  },
-                  {
-                     "name":"envoy.udp_packet_writer.gso",
-                     "category":"envoy.udp_packet_writer",
-                     "type_urls":[
-                        "envoy.extensions.udp_packet_writer.v3.UdpGsoBatchWriterFactory"
-                     ]
-                  },
-                  {
-                     "name":"envoy.retry_priorities.previous_priorities",
-                     "category":"envoy.retry_priorities",
-                     "type_urls":[
-                        "envoy.extensions.retry.priority.previous_priorities.v3.PreviousPrioritiesConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.listener_manager_impl.default",
-                     "category":"envoy.listener_manager_impl",
-                     "type_urls":[
-                        "envoy.config.listener.v3.ListenerManager"
-                     ]
-                  },
-                  {
-                     "name":"envoy.listener_manager_impl.validation",
-                     "category":"envoy.listener_manager_impl",
-                     "type_urls":[
-                        "envoy.config.listener.v3.ValidationListenerManager"
-                     ]
-                  },
-                  {
-                     "name":"envoy.quic.proof_source.filter_chain",
-                     "category":"envoy.quic.proof_source",
-                     "type_urls":[
-                        "envoy.extensions.quic.proof_source.v3.ProofSourceConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.brotli.compressor",
-                     "category":"envoy.compression.compressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.brotli.compressor.v3.Brotli"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.gzip.compressor",
-                     "category":"envoy.compression.compressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.gzip.compressor.v3.Gzip"
-                     ]
-                  },
-                  {
-                     "name":"envoy.compression.zstd.compressor",
-                     "category":"envoy.compression.compressor",
-                     "type_urls":[
-                        "envoy.extensions.compression.zstd.compressor.v3.Zstd"
-                     ]
-                  },
-                  {
-                     "name":"envoy.quic.deterministic_connection_id_generator",
-                     "category":"envoy.quic.connection_id_generator",
-                     "type_urls":[
-                        "envoy.extensions.quic.connection_id_generator.v3.DeterministicConnectionIdGeneratorConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.watchdog.abort_action",
-                     "category":"envoy.guarddog_actions",
-                     "type_urls":[
-                        "envoy.watchdog.v3.AbortActionConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.watchdog.profile_action",
-                     "category":"envoy.guarddog_actions",
-                     "type_urls":[
-                        "envoy.extensions.watchdog.profile_action.v3.ProfileActionConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.cluster.eds",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.cluster.logical_dns",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.cluster.original_dst",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.cluster.static",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.cluster.strict_dns",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.clusters.aggregate",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.clusters.dynamic_forward_proxy",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.clusters.redis",
-                     "category":"envoy.clusters"
-                  },
-                  {
-                     "name":"envoy.extensions.http.cache.file_system_http_cache",
-                     "category":"envoy.http.cache",
-                     "type_urls":[
-                        "envoy.extensions.http.cache.file_system_http_cache.v3.FileSystemHttpCacheConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.extensions.http.cache.simple",
-                     "category":"envoy.http.cache",
-                     "type_urls":[
-                        "envoy.extensions.http.cache.simple_http_cache.v3.SimpleHttpCacheConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.custom_matchers.trie_matcher",
-                     "category":"envoy.matching.network.custom_matchers",
-                     "type_urls":[
-                        "xds.type.matcher.v3.IPMatcher"
-                     ]
-                  },
-                  {
-                     "name":"envoy.quic.crypto_stream.server.quiche",
-                     "category":"envoy.quic.server.crypto_stream",
-                     "type_urls":[
-                        "envoy.extensions.quic.crypto_stream.v3.CryptoServerStreamConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.request_id.uuid",
-                     "category":"envoy.request_id",
-                     "type_urls":[
-                        "envoy.extensions.request_id.uuid.v3.UuidRequestIdConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.actions.format_string",
-                     "category":"envoy.matching.action",
-                     "type_urls":[
-                        "envoy.config.core.v3.SubstitutionFormatString"
-                     ]
-                  },
-                  {
-                     "name":"filter-chain-name",
-                     "category":"envoy.matching.action",
-                     "type_urls":[
-                        "google.protobuf.StringValue"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.thrift.header_to_metadata",
-                     "category":"envoy.thrift_proxy.filters",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.thrift_proxy.filters.header_to_metadata.v3.HeaderToMetadata"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.thrift.payload_to_metadata",
-                     "category":"envoy.thrift_proxy.filters",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.thrift_proxy.filters.payload_to_metadata.v3.PayloadToMetadata"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.thrift.rate_limit",
-                     "category":"envoy.thrift_proxy.filters",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.thrift.router",
-                     "category":"envoy.thrift_proxy.filters",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.thrift_proxy.router.v3.Router"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.application_protocol",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.ApplicationProtocolInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.destination_ip",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DestinationIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.destination_port",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DestinationPortInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.direct_source_ip",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.DirectSourceIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.dns_san",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.DnsSanInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.filter_state",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.FilterStateInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.server_name",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.ServerNameInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_ip",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourceIPInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_port",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourcePortInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.source_type",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.SourceTypeInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.subject",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.SubjectInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.transport_protocol",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.network.v3.TransportProtocolInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.matching.inputs.uri_san",
-                     "category":"envoy.matching.network.input",
-                     "type_urls":[
-                        "envoy.extensions.matching.common_inputs.ssl.v3.UriSanInput"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.stateful_session.cookie",
-                     "category":"envoy.http.stateful_session",
-                     "type_urls":[
-                        "envoy.extensions.http.stateful_session.cookie.v3.CookieBasedSessionState"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http.stateful_session.header",
-                     "category":"envoy.http.stateful_session",
-                     "type_urls":[
-                        "envoy.extensions.http.stateful_session.header.v3.HeaderBasedSessionState"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.http_inspector",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.http_inspector.v3.HttpInspector"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.local_ratelimit",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.local_ratelimit.v3.LocalRateLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.original_dst",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.original_dst.v3.OriginalDst"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.original_src",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.original_src.v3.OriginalSrc"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.proxy_protocol",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.proxy_protocol.v3.ProxyProtocol"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.listener.tls_inspector",
-                     "category":"envoy.filters.listener",
-                     "type_urls":[
-                        "envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
-                     ]
-                  },
-                  {
-                     "name":"envoy.listener.http_inspector",
-                     "category":"envoy.filters.listener"
-                  },
-                  {
-                     "name":"envoy.listener.original_dst",
-                     "category":"envoy.filters.listener"
-                  },
-                  {
-                     "name":"envoy.listener.original_src",
-                     "category":"envoy.filters.listener"
-                  },
-                  {
-                     "name":"envoy.listener.proxy_protocol",
-                     "category":"envoy.filters.listener"
-                  },
-                  {
-                     "name":"envoy.listener.tls_inspector",
-                     "category":"envoy.filters.listener"
-                  },
-                  {
-                     "name":"envoy.rbac.matchers.upstream_ip_port",
-                     "category":"envoy.rbac.matchers",
-                     "type_urls":[
-                        "envoy.extensions.rbac.matchers.upstream_ip_port.v3.UpstreamIpPortMatcher"
-                     ]
-                  },
-                  {
-                     "name":"quic.server_preferred_address.fixed",
-                     "category":"envoy.quic.server_preferred_address",
-                     "type_urls":[
-                        "envoy.extensions.quic.server_preferred_address.v3.FixedServerPreferredAddressConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.echo",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.ext_authz",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.filters.network.connection_limit",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.connection_limit.v3.ConnectionLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.direct_response",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.direct_response.v3.Config"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.dubbo_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.dubbo_proxy.v3.DubboProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.echo",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.echo.v3.Echo"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.ext_authz",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.ext_authz.v3.ExtAuthz"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.http_connection_manager",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.local_ratelimit",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.local_ratelimit.v3.LocalRateLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.mongo_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.mongo_proxy.v3.MongoProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.ratelimit",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.ratelimit.v3.RateLimit"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.rbac",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.rbac.v3.RBAC"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.redis_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.redis_proxy.v3.RedisProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.sni_cluster",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.sni_cluster.v3.SniCluster"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.sni_dynamic_forward_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.sni_dynamic_forward_proxy.v3.FilterConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.tcp_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.tcp_proxy.v3.TcpProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.thrift_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.thrift_proxy.v3.ThriftProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.wasm",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.wasm.v3.Wasm"
-                     ]
-                  },
-                  {
-                     "name":"envoy.filters.network.zookeeper_proxy",
-                     "category":"envoy.filters.network",
-                     "type_urls":[
-                        "envoy.extensions.filters.network.zookeeper_proxy.v3.ZooKeeperProxy"
-                     ]
-                  },
-                  {
-                     "name":"envoy.http_connection_manager",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.mongo_proxy",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.ratelimit",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.redis_proxy",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"envoy.tcp_proxy",
-                     "category":"envoy.filters.network"
-                  },
-                  {
-                     "name":"dubbo.hessian2",
-                     "category":"envoy.dubbo_proxy.serializers"
-                  },
-                  {
-                     "name":"quic.http_server_connection.default",
-                     "category":"quic.http_server_connection"
-                  },
-                  {
-                     "name":"envoy.dog_statsd",
-                     "category":"envoy.stats_sinks"
-                  },
-                  {
-                     "name":"envoy.graphite_statsd",
-                     "category":"envoy.stats_sinks"
-                  },
-                  {
-                     "name":"envoy.metrics_service",
-                     "category":"envoy.stats_sinks"
-                  },
-                  {
-                     "name":"envoy.open_telemetry_stat_sink",
-                     "category":"envoy.stats_sinks"
-                  },
-                  {
-                     "name":"envoy.stat_sinks.dog_statsd",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.config.metrics.v3.DogStatsdSink"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.graphite_statsd",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.extensions.stat_sinks.graphite_statsd.v3.GraphiteStatsdSink"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.hystrix",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.config.metrics.v3.HystrixSink"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.metrics_service",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.config.metrics.v3.MetricsServiceConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.open_telemetry",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.extensions.stat_sinks.open_telemetry.v3.SinkConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.statsd",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.config.metrics.v3.StatsdSink"
-                     ]
-                  },
-                  {
-                     "name":"envoy.stat_sinks.wasm",
-                     "category":"envoy.stats_sinks",
-                     "type_urls":[
-                        "envoy.extensions.stat_sinks.wasm.v3.Wasm"
-                     ]
-                  },
-                  {
-                     "name":"envoy.statsd",
-                     "category":"envoy.stats_sinks"
-                  },
-                  {
-                     "name":"envoy.resource_monitors.fixed_heap",
-                     "category":"envoy.resource_monitors",
-                     "type_urls":[
-                        "envoy.extensions.resource_monitors.fixed_heap.v3.FixedHeapConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.resource_monitors.injected_resource",
-                     "category":"envoy.resource_monitors",
-                     "type_urls":[
-                        "envoy.extensions.resource_monitors.injected_resource.v3.InjectedResourceConfig"
-                     ]
-                  },
-                  {
-                     "name":"auto",
-                     "category":"envoy.thrift_proxy.transports"
-                  },
-                  {
-                     "name":"framed",
-                     "category":"envoy.thrift_proxy.transports"
-                  },
-                  {
-                     "name":"header",
-                     "category":"envoy.thrift_proxy.transports"
-                  },
-                  {
-                     "name":"unframed",
-                     "category":"envoy.thrift_proxy.transports"
-                  },
-                  {
-                     "name":"envoy.http.header_validators.envoy_default",
-                     "category":"envoy.http.header_validators",
-                     "type_urls":[
-                        "envoy.extensions.http.header_validators.envoy_default.v3.HeaderValidatorConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.path.rewrite.uri_template.uri_template_rewriter",
-                     "category":"envoy.path.rewrite",
-                     "type_urls":[
-                        "envoy.extensions.path.rewrite.uri_template.v3.UriTemplateRewriteConfig"
-                     ]
-                  },
-                  {
-                     "name":"envoy.key_value.file_based",
-                     "category":"envoy.common.key_value",
-                     "type_urls":[
-                        "envoy.extensions.key_value.file_based.v3.FileBasedKeyValueStoreConfig"
-                     ]
-                  }
-               ]
-            },
-            "static_resources":{
-               "clusters":[
-                  {
-                     "name":"xds_cluster",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"1s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/adapter.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "upstream_connection_options":{
-                        "tcp_keepalive":{
-                           "keepalive_probes":3,
-                           "keepalive_time":300,
-                           "keepalive_interval":30
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"xds_cluster",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"apk-perftest-wso2-apk-adapter-service.apk-perf-test.svc",
-                                             "port_value":18000
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     },
-                     "typed_extension_protocol_options":{
-                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                           "explicit_http_config":{
-                              "http2_protocol_options":{
-                                 
-                              }
-                           }
-                        }
-                     }
-                  },
-                  {
-                     "name":"ext-authz",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"20s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"ext-authz",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"127.0.0.1",
-                                             "port_value":8081
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     },
-                     "typed_extension_protocol_options":{
-                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                           "explicit_http_config":{
-                              "http2_protocol_options":{
-                                 
-                              }
-                           }
-                        }
-                     }
-                  },
-                  {
-                     "name":"access-logger",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"200s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"access-logger",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"127.0.0.1",
-                                             "port_value":18090
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     },
-                     "typed_extension_protocol_options":{
-                        "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                           "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                           "explicit_http_config":{
-                              "http2_protocol_options":{
-                                 
-                              }
-                           }
-                        }
-                     }
-                  },
-                  {
-                     "name":"token_cluster",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"20s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"token_cluster",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"127.0.0.1",
-                                             "port_value":8082
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     }
-                  },
-                  {
-                     "name":"jwks_cluster",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"20s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"jwks_cluster",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"127.0.0.1",
-                                             "port_value":9092
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     }
-                  },
-                  {
-                     "name":"api_definition_cluster",
-                     "type":"STRICT_DNS",
-                     "connect_timeout":"20s",
-                     "transport_socket":{
-                        "name":"envoy.transport_sockets.tls",
-                        "typed_config":{
-                           "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                           "common_tls_context":{
-                              "tls_params":{
-                                 "tls_minimum_protocol_version":"TLSv1_2",
-                                 "tls_maximum_protocol_version":"TLSv1_2"
-                              },
-                              "tls_certificates":[
-                                 {
-                                    "certificate_chain":{
-                                       "filename":"/home/wso2/security/keystore/router.crt"
-                                    },
-                                    "private_key":{
-                                       "filename":"[redacted]"
-                                    }
-                                 }
-                              ],
-                              "validation_context":{
-                                 "trusted_ca":{
-                                    "filename":"/home/wso2/security/truststore/enforcer.crt"
-                                 }
-                              }
-                           }
-                        }
-                     },
-                     "load_assignment":{
-                        "cluster_name":"api_definition_cluster",
-                        "endpoints":[
-                           {
-                              "lb_endpoints":[
-                                 {
-                                    "endpoint":{
-                                       "address":{
-                                          "socket_address":{
-                                             "address":"127.0.0.1",
-                                             "port_value":8084
-                                          }
-                                       }
-                                    }
-                                 }
-                              ]
-                           }
-                        ]
-                     }
-                  }
-               ]
-            },
-            "dynamic_resources":{
-               "lds_config":{
-                  "ads":{
-                     
-                  },
-                  "resource_api_version":"V3"
-               },
-               "cds_config":{
-                  "ads":{
-                     
-                  },
-                  "resource_api_version":"V3"
-               },
-               "ads_config":{
-                  "api_type":"GRPC",
-                  "grpc_services":[
-                     {
-                        "envoy_grpc":{
-                           "cluster_name":"xds_cluster"
-                        }
-                     }
-                  ],
-                  "transport_api_version":"V3"
-               }
-            },
-            "admin":{
-               "address":{
-                  "socket_address":{
-                     "address":"0.0.0.0",
-                     "port_value":9000
-                  }
-               }
-            },
-            "layered_runtime":{
-               "layers":[
-                  {
-                     "name":"deprecation",
-                     "static_layer":{
-                        "re2.max_program_size.error_level":1000
-                     }
-                  },
-                  {
-                     "name":"globalMaxConnections",
-                     "static_layer":{
-                        "overload.global_downstream_max_connections":2147483647
-                     }
-                  }
-               ]
-            }
-         },
-         "last_updated":"2023-08-23T06:41:52.684Z"
-      },
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.ClustersConfigDump",
-         "version_info":"71006550",
-         "static_clusters":[
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"access-logger",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"200s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"access-logger",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"127.0.0.1",
-                                          "port_value":18090
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http2_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.692Z"
-            },
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"api_definition_cluster",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"api_definition_cluster",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"127.0.0.1",
-                                          "port_value":8084
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.695Z"
-            },
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"ext-authz",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"ext-authz",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"127.0.0.1",
-                                          "port_value":8081
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http2_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.691Z"
-            },
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"jwks_cluster",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"jwks_cluster",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"127.0.0.1",
-                                          "port_value":9092
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.694Z"
-            },
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"token_cluster",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/enforcer.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"token_cluster",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"127.0.0.1",
-                                          "port_value":8082
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.693Z"
-            },
-            {
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"xds_cluster",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"1s",
-                  "transport_socket":{
-                     "name":"envoy.transport_sockets.tls",
-                     "typed_config":{
-                        "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                        "common_tls_context":{
-                           "tls_params":{
-                              "tls_minimum_protocol_version":"TLSv1_2",
-                              "tls_maximum_protocol_version":"TLSv1_2"
-                           },
-                           "tls_certificates":[
-                              {
-                                 "certificate_chain":{
-                                    "filename":"/home/wso2/security/keystore/router.crt"
-                                 },
-                                 "private_key":{
-                                    "filename":"[redacted]"
-                                 }
-                              }
-                           ],
-                           "validation_context":{
-                              "trusted_ca":{
-                                 "filename":"/home/wso2/security/truststore/adapter.crt"
-                              }
-                           }
-                        }
-                     }
-                  },
-                  "upstream_connection_options":{
-                     "tcp_keepalive":{
-                        "keepalive_probes":3,
-                        "keepalive_time":300,
-                        "keepalive_interval":30
-                     }
-                  },
-                  "load_assignment":{
-                     "cluster_name":"xds_cluster",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-adapter-service.apk-perf-test.svc",
-                                          "port_value":18000
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http2_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.690Z"
-            }
-         ],
-         "dynamic_active_clusters":[
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__api.am.wso2.com_WSO2APKConfigDeployerAPI1.0.0_f1ddda8c-e084-487f-9981-90d5f676d7d10",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__api.am.wso2.com_WSO2APKConfigDeployerAPI1.0.0_f1ddda8c-e084-487f-9981-90d5f676d7d10",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpVENDQW5HZ0F3SUJBZ0lRTUVqV25QM0o1Rnd6TGtUWjhkTDEvREFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYwpNUm93R0FZRFZRUURFeEZqYjI1bWFXY3RaSE10YzJWeWRtbGpaVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTHV6V24yU2ZNR1k3TVgwZjBDSkxHeXpuUXM3akY5dzJzMitaV2h4bzF3RmNtWWsKRS96Q2pSajNQTE00amFUbndQUkxtTWpIR0RxQVJxV2J1aFVwOEUxTXhKakc1eVlhNnFKRWV1eUVPSjhFNktXYgphWmNpVFFpUEVBRjNpZ29nb0JhdWQzUFVvRU45dE1iQ2lQam15MitnLytxMlFQTVl6WEpUQzhpVEpMOGFGcG54CkdnMVdGUVJzbEZYaFhSRnMzVzJDVkZUNVhOb2Mvam5TWDc4cDU4Y0l4ekR3QUdTV2dtSGtXcEV3d0RUMTZkL1oKRU1DUk9RM01PM2x3Tm9hMXJBZU5qK2t2QTNlY1krZWl0MUVweUNsQk4yV0xIRGtsUHdCcnZCU2V1TVoxaEovNwpZbGl6TlN5b1BGV2ttSzMweEVhMUlBR1ZSc0sramxPQlVja2J2Z2NDQXdFQUFhT0IxRENCMFRBT0JnTlZIUThCCkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmwKaHVMWFVKYVBCekNCandZRFZSMFJCSUdITUlHRWdqbGhjR3N0Y0dWeVpuUmxjM1F0ZDNOdk1pMWhjR3N0WTI5dQpabWxuTFdSekxYTmxjblpwWTJVdVlYQnJMWEJsY21ZdGRHVnpkQzV6ZG1PQ1IyRndheTF3WlhKbWRHVnpkQzEzCmMyOHlMV0Z3YXkxamIyNW1hV2N0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnoKZEdWeUxteHZZMkZzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCaHZ0Wk53TG1lUnIzTE9uNmhYT2R4anpHRwpjZXNsQUc0RHYwak1BT1lHNnNVbnA4UGx4cmdEeWsvcTJuWEFvbTl5d0lOczMrTHZCMytxeHJkOWJXOUZLRFJjClZ6OWR1dlIvOW05NHFtcnU2d3ZWS3Nlb1VLWTFrZlhBZm0zeVQwd0gzOFdxWFIzMWtheU9CUDdRQmdIbUF3OXQKWVpzL01JSTNHWjhJdnlzRzhVaEtrYWM0aSsxKzkrcCsvOFVBblM3NGt5b3FyQnVBdjBLNnZqNDhvd3Y5TmpCSwprcnlqdzVCU01LcXN6WXpJVDJPeUFMK3FDcXIvTjhIVEc0VHBIRTNGMXBwbXNwdlJHZWM1OWVSV2lNZGJkY1h6CkdoTkhxcjZIR1o3OWVCWnFwdTdwbndoSGduTEdHZEc3VmJzQTRBTWd0OTErUVVVMFVVbG9XZk9jVUJDbgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.957Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__api.am.wso2.com_WSO2APKConfigGeneratorAPI1.0.0_3fb1c6a2-e9a1-4f1c-94d1-e69f81fc0f9c0",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__api.am.wso2.com_WSO2APKConfigGeneratorAPI1.0.0_3fb1c6a2-e9a1-4f1c-94d1-e69f81fc0f9c0",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURpVENDQW5HZ0F3SUJBZ0lRTUVqV25QM0o1Rnd6TGtUWjhkTDEvREFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYwpNUm93R0FZRFZRUURFeEZqYjI1bWFXY3RaSE10YzJWeWRtbGpaVENDQVNJd0RRWUpLb1pJaHZjTkFRRUJCUUFECmdnRVBBRENDQVFvQ2dnRUJBTHV6V24yU2ZNR1k3TVgwZjBDSkxHeXpuUXM3akY5dzJzMitaV2h4bzF3RmNtWWsKRS96Q2pSajNQTE00amFUbndQUkxtTWpIR0RxQVJxV2J1aFVwOEUxTXhKakc1eVlhNnFKRWV1eUVPSjhFNktXYgphWmNpVFFpUEVBRjNpZ29nb0JhdWQzUFVvRU45dE1iQ2lQam15MitnLytxMlFQTVl6WEpUQzhpVEpMOGFGcG54CkdnMVdGUVJzbEZYaFhSRnMzVzJDVkZUNVhOb2Mvam5TWDc4cDU4Y0l4ekR3QUdTV2dtSGtXcEV3d0RUMTZkL1oKRU1DUk9RM01PM2x3Tm9hMXJBZU5qK2t2QTNlY1krZWl0MUVweUNsQk4yV0xIRGtsUHdCcnZCU2V1TVoxaEovNwpZbGl6TlN5b1BGV2ttSzMweEVhMUlBR1ZSc0sramxPQlVja2J2Z2NDQXdFQUFhT0IxRENCMFRBT0JnTlZIUThCCkFmOEVCQU1DQmFBd0RBWURWUjBUQVFIL0JBSXdBREFmQmdOVkhTTUVHREFXZ0JUUEZ3RHh4NElYbTM2ODk0NmwKaHVMWFVKYVBCekNCandZRFZSMFJCSUdITUlHRWdqbGhjR3N0Y0dWeVpuUmxjM1F0ZDNOdk1pMWhjR3N0WTI5dQpabWxuTFdSekxYTmxjblpwWTJVdVlYQnJMWEJsY21ZdGRHVnpkQzV6ZG1PQ1IyRndheTF3WlhKbWRHVnpkQzEzCmMyOHlMV0Z3YXkxamIyNW1hV2N0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnoKZEdWeUxteHZZMkZzTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFCaHZ0Wk53TG1lUnIzTE9uNmhYT2R4anpHRwpjZXNsQUc0RHYwak1BT1lHNnNVbnA4UGx4cmdEeWsvcTJuWEFvbTl5d0lOczMrTHZCMytxeHJkOWJXOUZLRFJjClZ6OWR1dlIvOW05NHFtcnU2d3ZWS3Nlb1VLWTFrZlhBZm0zeVQwd0gzOFdxWFIzMWtheU9CUDdRQmdIbUF3OXQKWVpzL01JSTNHWjhJdnlzRzhVaEtrYWM0aSsxKzkrcCsvOFVBblM3NGt5b3FyQnVBdjBLNnZqNDhvd3Y5TmpCSwprcnlqdzVCU01LcXN6WXpJVDJPeUFMK3FDcXIvTjhIVEc0VHBIRTNGMXBwbXNwdlJHZWM1OWVSV2lNZGJkY1h6CkdoTkhxcjZIR1o3OWVCWnFwdTdwbndoSGduTEdHZEc3VmJzQTRBTWd0OTErUVVVMFVVbG9XZk9jVUJDbgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-config-ds-service.apk-perf-test"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.964Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__api.am.wso2.com_jwks-domain-service1.0.0_84c6b716-f097-430b-a774-9dc03789f6c10",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__api.am.wso2.com_jwks-domain-service1.0.0_84c6b716-f097-430b-a774-9dc03789f6c10",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc",
-                                          "port_value":9092
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURoakNDQW02Z0F3SUJBZ0lRR3hQcHh5MTFleVVoWVVBZTZveGFOekFOQmdrcWhraUc5dzBCQVFzRkFEQU8KTVF3d0NnWURWUVFEREFOaGNHc3dIaGNOTWpNd09ERTNNVEV4TnpVeFdoY05Nak14TVRFMU1URXhOelV4V2pBYgpNUmt3RndZRFZRUURFeEJsYm1admNtTmxjaTF6WlhKMmFXTmxNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DCkFROEFNSUlCQ2dLQ0FRRUF6WDR1NW9Db1E1aytVM3E5Ymp5WEFFNEI5QUc4T2wwa0pjRU03Z2ZoNWpGQzI2VUkKcmJKVlBGcUlqemtsTXdPbFBHMXBkS3J4SXVpS2RON3FGa01xMW5rbnNyMUR0RVR5UDhLYXZwbVhaTzlvVWNGTgoreFlYV05XM0Q0YXBnTXAxZDhUMFN3a09Ea3JxR0dJVjBFTnViTndzckI1bXRRdWF2RWhKZ1JSczFyNVVkcVpUClpkby9aNllGdVVNemd5d0ptK2FzbmVkZmJaSFpFNnVFdHVjMWNvSG5veTRkSExCRVh5VWtjMnFMcHkxNDFwYmcKMDJRR2l5M0s2aXdXZlpybFJubVl6WmlwdmpVVy9nMDdNcG1GUUZ3V3J4YWZFblp6akVuME5xMUlUTUZSU3RaNgpDMXVodXFtc0tCeDcyVUJYd1VsZjV3QWQzem5KOTZoS2xzbWIrUUlEQVFBQm80SFNNSUhQTUE0R0ExVWREd0VCCi93UUVBd0lGb0RBTUJnTlZIUk1CQWY4RUFqQUFNQjhHQTFVZEl3UVlNQmFBRk04WEFQSEhnaGViZnJ6M2pxV0cKNHRkUWxvOEhNSUdOQmdOVkhSRUVnWVV3Z1lLQ09HRndheTF3WlhKbWRHVnpkQzEzYzI4eUxXRndheTFsYm1adgpjbU5sY2kxelpYSjJhV05sTG1Gd2F5MXdaWEptTFhSbGMzUXVjM1pqZ2taaGNHc3RjR1Z5Wm5SbGMzUXRkM052Ck1pMWhjR3N0Wlc1bWIzSmpaWEl0YzJWeWRtbGpaUzVoY0dzdGNHVnlaaTEwWlhOMExuTjJZeTVqYkhWemRHVnkKTG14dlkyRnNNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUJBUUNibkUvYkdMdVpwciszdDJXTGc3bjBWVDkzRVdmYwp4T2tUVkRaMHpkVDRNSXJwRkFCSjhibmF0NXMwTVhackdDallBRTFJSS8zOGg1bTZMQjlNVFVlOXU1TGlndGN6Ck9MQkhabCtvRmczMGY2K2xLeEgyTkkyVUJQL1hRSHhOd1VQeGZmN3E5bTRUL3YwZnFEWUV3N1NjWS9zaUVyVWwKSisyVkd4WUhDaG43U0JUdGhDM1JBaHNxQzFVTVczZGxqRGJFNC9QcWVYNjYrZU5ZUkkxLzQ0ZnJQMTh5Y3BNagpQYnRpMEhGbmd6ZlhtQlVHb3FWU1grUUQ0MnQ1TzVkLzhmNDRBdjR0L2UrNVlGaEh2eWV4S0tGemJmcjIxLzhpCkpoSnRiQTdNaE1Db00rQlVlQjVKWU43U1VadURQQWlGamdmTkN2UEVqNjZCaEpIcVpJUWRYdjkzCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-enforcer-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.963Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__idp.am.wso2.com_authenticationEndpoint-domain-service1.0.0_d5411075-1b43-4bb5-84bc-4878b2acc0110",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__idp.am.wso2.com_authenticationEndpoint-domain-service1.0.0_d5411075-1b43-4bb5-84bc-4878b2acc0110",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.961Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__idp.am.wso2.com_commonoauth-api1.0.0_7474e658-3105-4b28-9235-d9c356a4ce0c0",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__idp.am.wso2.com_commonoauth-api1.0.0_7474e658-3105-4b28-9235-d9c356a4ce0c0",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.955Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__idp.am.wso2.com_dcr-api1.0.0_25e09b17-0aab-4fa8-bd78-07798fb6137b0",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__idp.am.wso2.com_dcr-api1.0.0_25e09b17-0aab-4fa8-bd78-07798fb6137b0",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.962Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"apk-system__idp.am.wso2.com_oauth-api1.0.0_53c14cf2-8114-436d-8ae4-259b270c91c20",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"apk-system__idp.am.wso2.com_oauth-api1.0.0_53c14cf2-8114-436d-8ae4-259b270c91c20",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc",
-                                          "port_value":9443
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "inline_bytes":"LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURnRENDQW1pZ0F3SUJBZ0lSQU54NGh1TGxoeUJOT2VxU0U4eVVETFl3RFFZSktvWklodmNOQVFFTEJRQXcKRGpFTU1Bb0dBMVVFQXd3RFlYQnJNQjRYRFRJek1EZ3hOekV4TVRjMU1Wb1hEVEl6TVRFeE5URXhNVGMxTVZvdwpHVEVYTUJVR0ExVUVBeE1PYVdSd0xXUnpMWE5sY25acFkyVXdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCCkR3QXdnZ0VLQW9JQkFRRFlpWTE5ek95bHh2c2xnZEFvZnljOGtJcmxzdnNpL0swa3pPZmlZdEpOSmJnbE5NSW8KRDRYb2F1M0M5Qk40WktoNjVkSmJvYzB0WURQbWNaSjFDQUxtSVJZNGV1NzFtUDFpeDcyUTczRHBTdUlqaUc5ZApDNDRvVThwTWhHc0U3MTRiR3JhV25qTDltRklPYlY3WXhhZXVRVnhnZXZzdTFCOFhvTGgxUkhBend3dTk2RW5YCkR5ZXJubThncUVaRHdsUWd6L3BGWlRHVVZ0UWFYZHNQVThqb29yMTh2R3YyOFJ3RzVNTVZiWDhCdW5uMkltNmsKaFh4TlB4dnJ2NE4vWTlWbmxhUUt1ejFaOXV0UEsxck45SUxDaU9FTWtUbUdSaU4xaTRCa1pZbWc0R3JYSm5XcgpGK0RwdnliS1dSOEdoaWozeVlYTHJMNGF3aWdIZWthSFlUMkhBZ01CQUFHamdjMHdnY293RGdZRFZSMFBBUUgvCkJBUURBZ1dnTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVenhjQThjZUNGNXQrdlBlT3BZYmkKMTFDV2p3Y3dnWWdHQTFVZEVRU0JnREIrZ2paaGNHc3RjR1Z5Wm5SbGMzUXRkM052TWkxaGNHc3RhV1J3TFdSegpMWE5sY25acFkyVXVZWEJyTFhCbGNtWXRkR1Z6ZEM1emRtT0NSR0Z3YXkxd1pYSm1kR1Z6ZEMxM2MyOHlMV0Z3CmF5MXBaSEF0WkhNdGMyVnlkbWxqWlM1aGNHc3RjR1Z5WmkxMFpYTjBMbk4yWXk1amJIVnpkR1Z5TG14dlkyRnMKTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFEQmk5di9xQnVGWXowWW1QWGpBK1ZYV1hPM3UzZHVJTFNZTzMwdgpBNG92SjJIRlp3b1FKZVZXZ3hYdWZWMEtkYWhqNmU0Y3BUQStjYTRVUnJYR0FHVTVUaHRxVTlFeUorSkQ0UVBCCk4yaDVqQUVoYUFEMWdPWUplVFVyRit5dEY5UjliOG55dU5DRzJQVyt3dmF4Vjk0UEVIUFhMR1pqWVVOK2czSHUKVEppZ2tYM2FydllienRSeHhsK2xsdXE5L1Fib0FNRGxwRnU4S0lCNjVLSzgvN1BOUnVUVlhRV2Y0STN5K2VBSgpCMHkyNDBVMUk0ZFZURWhmRlJCM2hXdWZwOVYvMnpEYUorR1A5eml3SndkbGxiOG5vMHFXRGpJVnpKOWpwT2NjCnJncHZBUXN3WElqTEZPc3cwTlJVaE1Oa3BjdFNGZWQzQ1VKWjllNUk3OFVCcklTTQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-                                    },
-                                    "match_typed_subject_alt_names":[
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "exact":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                          }
-                                       },
-                                       {
-                                          "san_type":"DNS",
-                                          "matcher":{
-                                             "safe_regex":{
-                                                "regex":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                                             }
-                                          }
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-idp-ds-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.960Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"default__default.gw.wso2.com_APIDefinitionEndpointDefault3.14_0d0d978c-6250-453e-be04-eba41146a8460",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"default__default.gw.wso2.com_APIDefinitionEndpointDefault3.14_0d0d978c-6250-453e-be04-eba41146a8460",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"backend",
-                                          "port_value":80
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "explicit_http_config":{
-                           "http_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  }
-               },
-               "last_updated":"2023-08-23T06:41:52.957Z"
-            },
-            {
-               "version_info":"71006550",
-               "cluster":{
-                  "@type":"type.googleapis.com/envoy.config.cluster.v3.Cluster",
-                  "name":"ratelimit",
-                  "type":"STRICT_DNS",
-                  "connect_timeout":"20s",
-                  "dns_refresh_rate":"5s",
-                  "dns_lookup_family":"V4_ONLY",
-                  "load_assignment":{
-                     "cluster_name":"ratelimit",
-                     "endpoints":[
-                        {
-                           "lb_endpoints":[
-                              {
-                                 "endpoint":{
-                                    "address":{
-                                       "socket_address":{
-                                          "address":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc",
-                                          "port_value":8091
-                                       }
-                                    }
-                                 },
-                                 "metadata":{
-                                    "filter_metadata":{
-                                       "envoy.transport_socket_match":{
-                                          "lb_id":"0"
-                                       }
-                                    }
-                                 }
-                              }
-                           ]
-                        }
-                     ]
-                  },
-                  "typed_extension_protocol_options":{
-                     "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":{
-                        "@type":"type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions",
-                        "upstream_http_protocol_options":{
-                           "auto_sni":true
-                        },
-                        "explicit_http_config":{
-                           "http2_protocol_options":{
-                              
-                           }
-                        }
-                     }
-                  },
-                  "transport_socket_matches":[
-                     {
-                        "name":"ts0",
-                        "match":{
-                           "lb_id":"0"
-                        },
-                        "transport_socket":{
-                           "name":"envoy.transport_sockets.tls",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext",
-                              "common_tls_context":{
-                                 "tls_params":{
-                                    "tls_minimum_protocol_version":"TLSv1_1",
-                                    "tls_maximum_protocol_version":"TLSv1_2",
-                                    "cipher_suites":[
-                                       "ECDHE-ECDSA-AES128-GCM-SHA256",
-                                       "ECDHE-RSA-AES128-GCM-SHA256",
-                                       "ECDHE-ECDSA-AES128-SHA",
-                                       "ECDHE-RSA-AES128-SHA",
-                                       "AES128-GCM-SHA256",
-                                       "AES128-SHA",
-                                       "ECDHE-ECDSA-AES256-GCM-SHA384",
-                                       "ECDHE-RSA-AES256-GCM-SHA384",
-                                       "ECDHE-ECDSA-AES256-SHA",
-                                       "ECDHE-RSA-AES256-SHA",
-                                       "AES256-GCM-SHA384",
-                                       "AES256-SHA"
-                                    ]
-                                 },
-                                 "tls_certificates":[
-                                    {
-                                       "certificate_chain":{
-                                          "filename":"/home/wso2/security/keystore/router.crt"
-                                       },
-                                       "private_key":{
-                                          "filename":"[redacted]"
-                                       }
-                                    }
-                                 ],
-                                 "validation_context":{
-                                    "trusted_ca":{
-                                       "filename":"/home/wso2/security/truststore/ratelimiter.crt"
-                                    },
-                                    "match_subject_alt_names":[
-                                       {
-                                          "exact":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc"
-                                       }
-                                    ]
-                                 }
-                              },
-                              "sni":"apk-perftest-wso2-apk-ratelimiter-service.apk-perf-test.svc"
-                           }
-                        }
-                     }
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:52.958Z"
-            }
-         ]
-      },
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.ListenersConfigDump",
-         "version_info":"71006550",
-         "dynamic_listeners":[
-            {
-               "name":"httpslistener",
-               "active_state":{
-                  "version_info":"71006550",
-                  "listener":{
-                     "@type":"type.googleapis.com/envoy.config.listener.v3.Listener",
-                     "name":"httpslistener",
-                     "address":{
-                        "socket_address":{
-                           "address":"0.0.0.0",
-                           "port_value":9095
-                        }
-                     },
-                     "filter_chains":[
-                        {
-                           "filter_chain_match":{
-                              "server_names":[
-                                 "api.am.wso2.com"
-                              ]
-                           },
-                           "filters":[
-                              {
-                                 "name":"envoy.filters.network.http_connection_manager",
-                                 "typed_config":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-                                    "stat_prefix":"ingress_http",
-                                    "rds":{
-                                       "config_source":{
-                                          "ads":{
-                                             
-                                          },
-                                          "resource_api_version":"V3"
-                                       },
-                                       "route_config_name":"httpslistener"
-                                    },
-                                    "http_filters":[
-                                       {
-                                          "name":"envoy.filters.http.cors",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ext_authz",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                             "grpc_service":{
-                                                "envoy_grpc":{
-                                                   "cluster_name":"ext-authz"
-                                                },
-                                                "timeout":"20s",
-                                                "initial_metadata":[
-                                                   {
-                                                      "key":"x-request-id",
-                                                      "value":"%REQ(x-request-id)%"
-                                                   }
-                                                ]
-                                             },
-                                             "with_request_body":{
-                                                "max_request_bytes":102400
-                                             },
-                                             "clear_route_cache":true,
-                                             "include_peer_certificate":true,
-                                             "transport_api_version":"V3"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.local",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.global",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ratelimit",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-                                             "domain":"Default",
-                                             "rate_limit_service":{
-                                                "grpc_service":{
-                                                   "envoy_grpc":{
-                                                      "cluster_name":"ratelimit"
-                                                   },
-                                                   "timeout":"0.080s"
-                                                },
-                                                "transport_api_version":"V3"
-                                             },
-                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.compressor",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
-                                             "compressor_library":{
-                                                "name":"text_optimized",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
-                                                   "memory_level":3,
-                                                   "compression_level":"COMPRESSION_LEVEL_9",
-                                                   "window_bits":12,
-                                                   "chunk_size":4096
-                                                }
-                                             },
-                                             "request_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":false,
-                                                      "runtime_key":"request_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                }
-                                             },
-                                             "response_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":true,
-                                                      "runtime_key":"response_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                },
-                                                "disable_on_etag_header":true
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.router",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                             "suppress_envoy_headers":true
-                                          }
-                                       }
-                                    ],
-                                    "http_protocol_options":{
-                                       
-                                    },
-                                    "use_remote_address":false,
-                                    "upgrade_configs":[
-                                       {
-                                          "upgrade_type":"websocket",
-                                          "filters":[
-                                             {
-                                                "name":"envoy.filters.http.cors",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.ext_authz",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                                   "grpc_service":{
-                                                      "envoy_grpc":{
-                                                         "cluster_name":"ext-authz"
-                                                      },
-                                                      "timeout":"20s",
-                                                      "initial_metadata":[
-                                                         {
-                                                            "key":"x-request-id",
-                                                            "value":"%REQ(x-request-id)%"
-                                                         }
-                                                      ]
-                                                   },
-                                                   "with_request_body":{
-                                                      "max_request_bytes":102400
-                                                   },
-                                                   "clear_route_cache":true,
-                                                   "include_peer_certificate":true,
-                                                   "transport_api_version":"V3"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
-                                                   "config":{
-                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                      "root_id":"mgw_WASM_websocket_root",
-                                                      "vm_config":{
-                                                         "vm_id":"mgw_WASM_vm",
-                                                         "runtime":"envoy.wasm.runtime.v8",
-                                                         "code":{
-                                                            "local":{
-                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
-                                                            }
-                                                         },
-                                                         "allow_precompiled":true
-                                                      },
-                                                      "configuration":{
-                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
-                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
-                                                      }
-                                                   }
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.router",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                                   "suppress_envoy_headers":true
-                                                }
-                                             }
-                                          ],
-                                          "enabled":true
-                                       }
-                                    ],
-                                    "stream_idle_timeout":"300s",
-                                    "request_timeout":"0s",
-                                    "common_http_protocol_options":{
-                                       "idle_timeout":"3600s"
-                                    },
-                                    "local_reply_config":{
-                                       "mappers":[
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":404,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"404",
-                                                   "message":"Not Found",
-                                                   "description":"The requested resource is not available."
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UT"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":504,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102504",
-                                                   "message":"Upstream connection timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102507",
-                                                   "message":"Upstream not configured for the resource",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102509",
-                                                   "message":"Upstream connection reset by the remote",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "IH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":400,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102512",
-                                                   "message":"Strictly checked header validation failure"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "DPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102514",
-                                                   "message":"HTTP protocol error in downstream request"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UO"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102505",
-                                                   "message":"Upstream overflow",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "URX"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102506",
-                                                   "message":"Upstream maximum connect attempts reached",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "LR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102511",
-                                                   "message":"Connection reset by the gateway",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "SI"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102513",
-                                                   "message":"Stream idle timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UF"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102503",
-                                                   "message":"Upstream connection failed",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102508",
-                                                   "message":"No healthy upstream",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102510",
-                                                   "message":"Upstream connection termination",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102515",
-                                                   "message":"HTTP protocol error in upstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UMSDR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102516",
-                                                   "message":"Upstream request reached max stream duration",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "and_filter":{
-                                                   "filters":[
-                                                      {
-                                                         "metadata_filter":{
-                                                            "matcher":{
-                                                               "filter":"envoy.filters.http.ext_authz",
-                                                               "path":[
-                                                                  {
-                                                                     "key":"apk-enforcer-reply"
-                                                                  }
-                                                               ],
-                                                               "value":{
-                                                                  "string_match":{
-                                                                     "exact":"Not Matching"
-                                                                  }
-                                                               }
-                                                            },
-                                                            "match_if_key_not_found":true
-                                                         }
-                                                      },
-                                                      {
-                                                         "response_flag_filter":{
-                                                            "flags":[
-                                                               "UAEX"
-                                                            ]
-                                                         }
-                                                      }
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102500",
-                                                   "message":"Unclassified Validation Failure",
-                                                   "description":"Error during validating the request"
-                                                }
-                                             }
-                                          }
-                                       ]
-                                    },
-                                    "request_headers_timeout":"0s"
-                                 }
-                              }
-                           ],
-                           "transport_socket":{
-                              "name":"envoy.transport_sockets.tls",
-                              "typed_config":{
-                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-                                 "common_tls_context":{
-                                    "tls_certificates":[
-                                       {
-                                          "certificate_chain":{
-                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDDDCCAfSgAwIBAgIRAMlsTlo1a5+He+91kWjgwlgwDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgxNzExMTc1MVoXDTIzMTExNTExMTc1MVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANvP0RneZ6LFC6H+mMzJ\nHyKT9khxASLz0GNH95A1NNHNx5iDdrYfj5PO6xtjpYMLFMIc1SqpR1dlfwKeDARu\n9b4d7yItZVeM7vf9ATh76e+ve7aGJWzlxbJUcD1hTL2b6AF37WeFUsSxWEuhenGE\nXM4jz9La9jesER4jVbpN+08WOIhrwh64LZd/NsmsQ2MKECMJNTVwbQ0aXFdHp2kv\nzOD0SUXi9XjaBT+jA9JqpynNeCarkhal4/VHCEcGhD2tGtuAsaY5gAbV8R+MExSV\nvuh2lFM/nfDYr7CTXJa3t4vBY5Xig4PEG/8Ge31/n9WZBFrLW4jCuushhbuAZoIG\nO2kCAwEAAaNzMHEwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHwYDVR0j\nBBgwFoAUzxcA8ceCF5t+vPeOpYbi11CWjwcwMAYDVR0RAQH/BCYwJIIRKi5hcGku\nYW0ud3NvMi5jb22CD2FwaS5hbS53c28yLmNvbTANBgkqhkiG9w0BAQsFAAOCAQEA\naQxV6uytm250vR/K652THisabn1ovjaELYjxRMoN+zhMUGPuRRfzZwe9tRcPIWpf\n6lNxn8q5AOsChP99bUrDS5xRnCtFE5clHGq0vvflIBYawJQUvp93R5GrbWpXcp/f\nWIgfheQF7wGmIgGYOQITAotQWR7UJdKm0o1FiEXRTEHmzvM4Goz4B/DuY+8A6oW6\nJCS3prIHB1004Rl+lx/TXwzaYH2KZPwXhI8HcQpLPHRY4lFxjy6QgCpaMmfg+7RA\nQt+U0e859kBP6bgGNR3D+FdX9XLFYjaaEAYR8w6FI7r7svKl878X6VuqBmcQMmGt\n3BV1QhDXMiAFW5Tz8KHuwg==\n-----END CERTIFICATE-----\n"
-                                          },
-                                          "private_key":{
-                                             "inline_string":"[redacted]"
-                                          }
-                                       }
-                                    ],
-                                    "alpn_protocols":[
-                                       "h2",
-                                       "http/1.1"
-                                    ]
-                                 }
-                              }
-                           }
-                        },
-                        {
-                           "filter_chain_match":{
-                              "server_names":[
-                                 "idp.am.wso2.com"
-                              ]
-                           },
-                           "filters":[
-                              {
-                                 "name":"envoy.filters.network.http_connection_manager",
-                                 "typed_config":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-                                    "stat_prefix":"ingress_http",
-                                    "rds":{
-                                       "config_source":{
-                                          "ads":{
-                                             
-                                          },
-                                          "resource_api_version":"V3"
-                                       },
-                                       "route_config_name":"httpslistener"
-                                    },
-                                    "http_filters":[
-                                       {
-                                          "name":"envoy.filters.http.cors",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ext_authz",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                             "grpc_service":{
-                                                "envoy_grpc":{
-                                                   "cluster_name":"ext-authz"
-                                                },
-                                                "timeout":"20s",
-                                                "initial_metadata":[
-                                                   {
-                                                      "key":"x-request-id",
-                                                      "value":"%REQ(x-request-id)%"
-                                                   }
-                                                ]
-                                             },
-                                             "with_request_body":{
-                                                "max_request_bytes":102400
-                                             },
-                                             "clear_route_cache":true,
-                                             "include_peer_certificate":true,
-                                             "transport_api_version":"V3"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.local",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.global",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ratelimit",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-                                             "domain":"Default",
-                                             "rate_limit_service":{
-                                                "grpc_service":{
-                                                   "envoy_grpc":{
-                                                      "cluster_name":"ratelimit"
-                                                   },
-                                                   "timeout":"0.080s"
-                                                },
-                                                "transport_api_version":"V3"
-                                             },
-                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.compressor",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
-                                             "compressor_library":{
-                                                "name":"text_optimized",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
-                                                   "memory_level":3,
-                                                   "compression_level":"COMPRESSION_LEVEL_9",
-                                                   "window_bits":12,
-                                                   "chunk_size":4096
-                                                }
-                                             },
-                                             "request_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":false,
-                                                      "runtime_key":"request_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                }
-                                             },
-                                             "response_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":true,
-                                                      "runtime_key":"response_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                },
-                                                "disable_on_etag_header":true
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.router",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                             "suppress_envoy_headers":true
-                                          }
-                                       }
-                                    ],
-                                    "http_protocol_options":{
-                                       
-                                    },
-                                    "use_remote_address":false,
-                                    "upgrade_configs":[
-                                       {
-                                          "upgrade_type":"websocket",
-                                          "filters":[
-                                             {
-                                                "name":"envoy.filters.http.cors",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.ext_authz",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                                   "grpc_service":{
-                                                      "envoy_grpc":{
-                                                         "cluster_name":"ext-authz"
-                                                      },
-                                                      "timeout":"20s",
-                                                      "initial_metadata":[
-                                                         {
-                                                            "key":"x-request-id",
-                                                            "value":"%REQ(x-request-id)%"
-                                                         }
-                                                      ]
-                                                   },
-                                                   "with_request_body":{
-                                                      "max_request_bytes":102400
-                                                   },
-                                                   "clear_route_cache":true,
-                                                   "include_peer_certificate":true,
-                                                   "transport_api_version":"V3"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
-                                                   "config":{
-                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                      "root_id":"mgw_WASM_websocket_root",
-                                                      "vm_config":{
-                                                         "vm_id":"mgw_WASM_vm",
-                                                         "runtime":"envoy.wasm.runtime.v8",
-                                                         "code":{
-                                                            "local":{
-                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
-                                                            }
-                                                         },
-                                                         "allow_precompiled":true
-                                                      },
-                                                      "configuration":{
-                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
-                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
-                                                      }
-                                                   }
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.router",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                                   "suppress_envoy_headers":true
-                                                }
-                                             }
-                                          ],
-                                          "enabled":true
-                                       }
-                                    ],
-                                    "stream_idle_timeout":"300s",
-                                    "request_timeout":"0s",
-                                    "common_http_protocol_options":{
-                                       "idle_timeout":"3600s"
-                                    },
-                                    "local_reply_config":{
-                                       "mappers":[
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "LR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Connection reset by the gateway",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102511"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UO"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102505",
-                                                   "message":"Upstream overflow",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "URX"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Upstream maximum connect attempts reached",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102506"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "SI"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102513",
-                                                   "message":"Stream idle timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102510",
-                                                   "message":"Upstream connection termination",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102515",
-                                                   "message":"HTTP protocol error in upstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UMSDR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102516",
-                                                   "message":"Upstream request reached max stream duration",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UF"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Upstream connection failed",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102503"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"No healthy upstream",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102508"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102507",
-                                                   "message":"Upstream not configured for the resource",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102509",
-                                                   "message":"Upstream connection reset by the remote",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "IH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":400,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Strictly checked header validation failure",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102512"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "DPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102514",
-                                                   "message":"HTTP protocol error in downstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":404,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"404",
-                                                   "message":"Not Found",
-                                                   "description":"The requested resource is not available."
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UT"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":504,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102504",
-                                                   "message":"Upstream connection timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "and_filter":{
-                                                   "filters":[
-                                                      {
-                                                         "metadata_filter":{
-                                                            "matcher":{
-                                                               "filter":"envoy.filters.http.ext_authz",
-                                                               "path":[
-                                                                  {
-                                                                     "key":"apk-enforcer-reply"
-                                                                  }
-                                                               ],
-                                                               "value":{
-                                                                  "string_match":{
-                                                                     "exact":"Not Matching"
-                                                                  }
-                                                               }
-                                                            },
-                                                            "match_if_key_not_found":true
-                                                         }
-                                                      },
-                                                      {
-                                                         "response_flag_filter":{
-                                                            "flags":[
-                                                               "UAEX"
-                                                            ]
-                                                         }
-                                                      }
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Unclassified Validation Failure",
-                                                   "description":"Error during validating the request",
-                                                   "code":"102500"
-                                                }
-                                             }
-                                          }
-                                       ]
-                                    },
-                                    "request_headers_timeout":"0s"
-                                 }
-                              }
-                           ],
-                           "transport_socket":{
-                              "name":"envoy.transport_sockets.tls",
-                              "typed_config":{
-                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-                                 "common_tls_context":{
-                                    "tls_certificates":[
-                                       {
-                                          "certificate_chain":{
-                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIQAmuvzL4HSi32nAtfRm7emjANBgkqhkiG9w0BAQsFADAO\nMQwwCgYDVQQDDANhcGswHhcNMjMwODE3MTExNzUxWhcNMjMxMTE1MTExNzUxWjAA\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA21oPZfJAHRS1zcHM1olH\nfkNWIojeu7o5y+KK0EaqdGjJSWNvaM5WMuA+pUROpe6pWgVr1zMic/fGWmMySvQ2\ntVBT7GQ2yAbGTqtfDHRUcUamdJzor/uVurxQEJmidV1rA2jf3b+Zpl2W3fomi2v3\nc3hQDRoFiG3B9whnx2eqdQ4TW6f1a0KT1JedLvZH+F4Vykr6Z4xeE4g6kTclvUNP\naUz+x99ujDG1m4K17l6FK1bkCW1Bs/U2z7gKlwsEiG1VawXVlt5tiqyr99Me2H+i\nQZwJIbm/1NXUbWTTiSnGyXJNw1gJK4JUASChYHHIAhjyEr8PuhJ2u8nGsVTVsRNN\nPQIDAQABo3MwcTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAfBgNVHSME\nGDAWgBTPFwDxx4IXm368946lhuLXUJaPBzAwBgNVHREBAf8EJjAkghEqLmlkcC5h\nbS53c28yLmNvbYIPaWRwLmFtLndzbzIuY29tMA0GCSqGSIb3DQEBCwUAA4IBAQBb\nYPA4w16WJBTKjvWOXoMBP5AIpp8nvqTpgjlrTNr7v0CpET2SPWpTZ+QlImLUFKrH\nxhdhRd9rkd9FWYY1tZU+CIeX/QmGZ/kWFvtghcKWoj2ku1zCOZk2PvAWiBEqfY6S\nZhfZU+vtdl8b9tSO/BzUPDRm3ZbAmxE78h+TzIjd5Nn0IX0m4qEERDD1SBKZiNsJ\nD1ta0D375MdITh5DQVPbs7C5hHSS6oao5DotGHPTJVC7A3tfolx8Zc+IvJaefjk1\nonioNDF5iKUxdEvFBFjnv85JzH94aqGF7ct/0zdMnkIS3i663MEQ67MbuHn+migF\nQZ3sfW6eeucRQ6QHa+1s\n-----END CERTIFICATE-----\n"
-                                          },
-                                          "private_key":{
-                                             "inline_string":"[redacted]"
-                                          }
-                                       }
-                                    ],
-                                    "alpn_protocols":[
-                                       "h2",
-                                       "http/1.1"
-                                    ]
-                                 }
-                              }
-                           }
-                        },
-                        {
-                           "filter_chain_match":{
-                              "server_names":[
-                                 "*.gw.wso2.com"
-                              ]
-                           },
-                           "filters":[
-                              {
-                                 "name":"envoy.filters.network.http_connection_manager",
-                                 "typed_config":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-                                    "stat_prefix":"ingress_http",
-                                    "rds":{
-                                       "config_source":{
-                                          "ads":{
-                                             
-                                          },
-                                          "resource_api_version":"V3"
-                                       },
-                                       "route_config_name":"httpslistener"
-                                    },
-                                    "http_filters":[
-                                       {
-                                          "name":"envoy.filters.http.cors",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ext_authz",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                             "grpc_service":{
-                                                "envoy_grpc":{
-                                                   "cluster_name":"ext-authz"
-                                                },
-                                                "timeout":"20s",
-                                                "initial_metadata":[
-                                                   {
-                                                      "key":"x-request-id",
-                                                      "value":"%REQ(x-request-id)%"
-                                                   }
-                                                ]
-                                             },
-                                             "with_request_body":{
-                                                "max_request_bytes":102400
-                                             },
-                                             "clear_route_cache":true,
-                                             "include_peer_certificate":true,
-                                             "transport_api_version":"V3"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.local",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.global",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":""
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ratelimit",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-                                             "domain":"Default",
-                                             "rate_limit_service":{
-                                                "grpc_service":{
-                                                   "envoy_grpc":{
-                                                      "cluster_name":"ratelimit"
-                                                   },
-                                                   "timeout":"0.080s"
-                                                },
-                                                "transport_api_version":"V3"
-                                             },
-                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.compressor",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
-                                             "compressor_library":{
-                                                "name":"text_optimized",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
-                                                   "memory_level":3,
-                                                   "compression_level":"COMPRESSION_LEVEL_9",
-                                                   "window_bits":12,
-                                                   "chunk_size":4096
-                                                }
-                                             },
-                                             "request_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":false,
-                                                      "runtime_key":"request_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                }
-                                             },
-                                             "response_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":true,
-                                                      "runtime_key":"response_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                },
-                                                "disable_on_etag_header":true
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.router",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                             "suppress_envoy_headers":true
-                                          }
-                                       }
-                                    ],
-                                    "http_protocol_options":{
-                                       
-                                    },
-                                    "use_remote_address":false,
-                                    "upgrade_configs":[
-                                       {
-                                          "upgrade_type":"websocket",
-                                          "filters":[
-                                             {
-                                                "name":"envoy.filters.http.cors",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.ext_authz",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                                   "grpc_service":{
-                                                      "envoy_grpc":{
-                                                         "cluster_name":"ext-authz"
-                                                      },
-                                                      "timeout":"20s",
-                                                      "initial_metadata":[
-                                                         {
-                                                            "key":"x-request-id",
-                                                            "value":"%REQ(x-request-id)%"
-                                                         }
-                                                      ]
-                                                   },
-                                                   "with_request_body":{
-                                                      "max_request_bytes":102400
-                                                   },
-                                                   "clear_route_cache":true,
-                                                   "include_peer_certificate":true,
-                                                   "transport_api_version":"V3"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
-                                                   "config":{
-                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                      "root_id":"mgw_WASM_websocket_root",
-                                                      "vm_config":{
-                                                         "vm_id":"mgw_WASM_vm",
-                                                         "runtime":"envoy.wasm.runtime.v8",
-                                                         "code":{
-                                                            "local":{
-                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
-                                                            }
-                                                         },
-                                                         "allow_precompiled":true
-                                                      },
-                                                      "configuration":{
-                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
-                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
-                                                      }
-                                                   }
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.router",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                                   "suppress_envoy_headers":true
-                                                }
-                                             }
-                                          ],
-                                          "enabled":true
-                                       }
-                                    ],
-                                    "stream_idle_timeout":"300s",
-                                    "request_timeout":"0s",
-                                    "common_http_protocol_options":{
-                                       "idle_timeout":"3600s"
-                                    },
-                                    "local_reply_config":{
-                                       "mappers":[
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UMSDR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Upstream request reached max stream duration",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102516"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UF"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102503",
-                                                   "message":"Upstream connection failed"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102508",
-                                                   "message":"No healthy upstream",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102510",
-                                                   "message":"Upstream connection termination",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102515",
-                                                   "message":"HTTP protocol error in upstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "IH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":400,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Strictly checked header validation failure",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102512"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "DPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102514",
-                                                   "message":"HTTP protocol error in downstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":404,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"The requested resource is not available.",
-                                                   "code":"404",
-                                                   "message":"Not Found"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UT"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":504,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102504",
-                                                   "message":"Upstream connection timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102507",
-                                                   "message":"Upstream not configured for the resource",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102509",
-                                                   "message":"Upstream connection reset by the remote",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UO"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102505",
-                                                   "message":"Upstream overflow",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "URX"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102506",
-                                                   "message":"Upstream maximum connect attempts reached",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "LR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102511",
-                                                   "message":"Connection reset by the gateway",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "SI"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102513",
-                                                   "message":"Stream idle timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "and_filter":{
-                                                   "filters":[
-                                                      {
-                                                         "metadata_filter":{
-                                                            "matcher":{
-                                                               "filter":"envoy.filters.http.ext_authz",
-                                                               "path":[
-                                                                  {
-                                                                     "key":"apk-enforcer-reply"
-                                                                  }
-                                                               ],
-                                                               "value":{
-                                                                  "string_match":{
-                                                                     "exact":"Not Matching"
-                                                                  }
-                                                               }
-                                                            },
-                                                            "match_if_key_not_found":true
-                                                         }
-                                                      },
-                                                      {
-                                                         "response_flag_filter":{
-                                                            "flags":[
-                                                               "UAEX"
-                                                            ]
-                                                         }
-                                                      }
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102500",
-                                                   "message":"Unclassified Validation Failure",
-                                                   "description":"Error during validating the request"
-                                                }
-                                             }
-                                          }
-                                       ]
-                                    },
-                                    "request_headers_timeout":"0s"
-                                 }
-                              }
-                           ],
-                           "transport_socket":{
-                              "name":"envoy.transport_sockets.tls",
-                              "typed_config":{
-                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-                                 "common_tls_context":{
-                                    "tls_certificates":[
-                                       {
-                                          "certificate_chain":{
-                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIDIjCCAgqgAwIBAgIRAJpsWyg4q4H3sX8YkqNmPvgwDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgyMjA3NTgwOVoXDTIzMTEyMDA3NTgwOVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM8064rt0fDiWbiyL9vn\nIluW1FAREW0Bfld7I5eOFFc3aMrt3+rTqTmtuoK+Ynm7I7yUoBuOveS7PSEWrZ65\nxyHQjelDyO5Nm0dTNwkpogzHsH2m5mqbHeYIQnd82g/COO5BZE5p/nUU53EBeOia\n+UAhH9rgzXe1eFJSufNK2Ti+B2TVEifW6qYu5d4C6tdpwoRveDr3eSG0CrwmWe9t\n4omdmZUKBOXGwPgaM74J7hadHPIhGGdzfGvypbQldD14deCcmSR2bEhJh6qNRdO3\nafCLng5bNLo0u/5+5wL/l457uMpRt9EoQ0scHWK13YAS516Et0W5r2HO7rs3OHkH\nLYsCAwEAAaOBiDCBhTAOBgNVHQ8BAf8EBAMCBaAwDAYDVR0TAQH/BAIwADAfBgNV\nHSMEGDAWgBTPFwDxx4IXm368946lhuLXUJaPBzBEBgNVHREBAf8EOjA4gg0qLmd3\nLndzbzIuY29tghUqLnNhbmRib3guZ3cud3NvMi5jb22CEHByb2QuZ3cud3NvMi5j\nb20wDQYJKoZIhvcNAQELBQADggEBAKQGXi/Q5GMtWy7Suy89eaCjzEFHmGF15a4y\npp5FQ63qhOfHRywo8ui9SHSNn2nm/gzCj3o9szw75QkrvxXTm3OarT0UH32T6pvg\nseeCVpp21WRIqshKfDjBKJG1GdIlHt7jbkRTpV+qiN2Hsq+VohVUWW1FQNt1ppsj\ngDhNjT4ePAxQFJfHxTFWhebghPUafa38Ia4YbUlXGPSMoG7DSj4jNLQ9TgwSoNjT\nPAAc/pcYlmCCEggrABPcFaQpXXaLlSiZZmfZR0gIzIbc5d3uPcj6j3dc9d+v5iPS\nphTYexwA7B33/cbK9gVJaePxf+u7pvjm8GxJEIJc6gNA8rLa214=\n-----END CERTIFICATE-----\n"
-                                          },
-                                          "private_key":{
-                                             "inline_string":"[redacted]"
-                                          }
-                                       }
-                                    ],
-                                    "alpn_protocols":[
-                                       "h2",
-                                       "http/1.1"
-                                    ]
-                                 }
-                              }
-                           }
-                        },
-                        {
-                           "filter_chain_match":{
-                              "server_names":[
-                                 "localhost"
-                              ]
-                           },
-                           "filters":[
-                              {
-                                 "name":"envoy.filters.network.http_connection_manager",
-                                 "typed_config":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager",
-                                    "stat_prefix":"ingress_http",
-                                    "rds":{
-                                       "config_source":{
-                                          "ads":{
-                                             
-                                          },
-                                          "resource_api_version":"V3"
-                                       },
-                                       "route_config_name":"httpslistener"
-                                    },
-                                    "http_filters":[
-                                       {
-                                          "name":"envoy.filters.http.cors",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ext_authz",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                             "grpc_service":{
-                                                "envoy_grpc":{
-                                                   "cluster_name":"ext-authz"
-                                                },
-                                                "timeout":"20s",
-                                                "initial_metadata":[
-                                                   {
-                                                      "key":"x-request-id",
-                                                      "value":"%REQ(x-request-id)%"
-                                                   }
-                                                ]
-                                             },
-                                             "with_request_body":{
-                                                "max_request_bytes":102400
-                                             },
-                                             "clear_route_cache":true,
-                                             "include_peer_certificate":true,
-                                             "transport_api_version":"V3"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.local",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.lua.global",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua",
-                                             "default_source_code":{
-                                                "inline_string":"\nfunction envoy_on_request(request_handle)\nend\nfunction envoy_on_response(response_handle)\nend"
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.ratelimit",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit",
-                                             "domain":"Default",
-                                             "rate_limit_service":{
-                                                "grpc_service":{
-                                                   "envoy_grpc":{
-                                                      "cluster_name":"ratelimit"
-                                                   },
-                                                   "timeout":"0.080s"
-                                                },
-                                                "transport_api_version":"V3"
-                                             },
-                                             "enable_x_ratelimit_headers":"DRAFT_VERSION_03"
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.compressor",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.compressor.v3.Compressor",
-                                             "compressor_library":{
-                                                "name":"text_optimized",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.compression.gzip.compressor.v3.Gzip",
-                                                   "memory_level":3,
-                                                   "compression_level":"COMPRESSION_LEVEL_9",
-                                                   "window_bits":12,
-                                                   "chunk_size":4096
-                                                }
-                                             },
-                                             "request_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":false,
-                                                      "runtime_key":"request_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                }
-                                             },
-                                             "response_direction_config":{
-                                                "common_config":{
-                                                   "enabled":{
-                                                      "default_value":true,
-                                                      "runtime_key":"response_compressor_enabled"
-                                                   },
-                                                   "min_content_length":30,
-                                                   "content_type":[
-                                                      "application/javascript",
-                                                      "application/json",
-                                                      "application/xhtml+xml",
-                                                      "image/svg+xml",
-                                                      "text/css",
-                                                      "text/html",
-                                                      "text/plain",
-                                                      "text/xml"
-                                                   ]
-                                                },
-                                                "disable_on_etag_header":true
-                                             }
-                                          }
-                                       },
-                                       {
-                                          "name":"envoy.filters.http.router",
-                                          "typed_config":{
-                                             "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                             "suppress_envoy_headers":true
-                                          }
-                                       }
-                                    ],
-                                    "http_protocol_options":{
-                                       
-                                    },
-                                    "use_remote_address":false,
-                                    "upgrade_configs":[
-                                       {
-                                          "upgrade_type":"websocket",
-                                          "filters":[
-                                             {
-                                                "name":"envoy.filters.http.cors",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.ext_authz",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz",
-                                                   "grpc_service":{
-                                                      "envoy_grpc":{
-                                                         "cluster_name":"ext-authz"
-                                                      },
-                                                      "timeout":"20s",
-                                                      "initial_metadata":[
-                                                         {
-                                                            "key":"x-request-id",
-                                                            "value":"%REQ(x-request-id)%"
-                                                         }
-                                                      ]
-                                                   },
-                                                   "with_request_body":{
-                                                      "max_request_bytes":102400
-                                                   },
-                                                   "clear_route_cache":true,
-                                                   "include_peer_certificate":true,
-                                                   "transport_api_version":"V3"
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
-                                                   "config":{
-                                                      "name":"envoy.filters.http.mgw_WASM_websocket",
-                                                      "root_id":"mgw_WASM_websocket_root",
-                                                      "vm_config":{
-                                                         "vm_id":"mgw_WASM_vm",
-                                                         "runtime":"envoy.wasm.runtime.v8",
-                                                         "code":{
-                                                            "local":{
-                                                               "filename":"/home/wso2/wasm/websocket/mgw-websocket.wasm"
-                                                            }
-                                                         },
-                                                         "allow_precompiled":true
-                                                      },
-                                                      "configuration":{
-                                                         "@type":"type.googleapis.com/google.protobuf.StringValue",
-                                                         "value":"{\n\t\t\t\"node_id\": \"apk_node_1\",\n\t\t\t\"rate_limit_service\": \"ext-authz\",\n\t\t\t\"timeout\": \"20s\",\n\t\t\t\"failure_mode_deny\": \"true\"\n\t\t}"
-                                                      }
-                                                   }
-                                                }
-                                             },
-                                             {
-                                                "name":"envoy.filters.http.router",
-                                                "typed_config":{
-                                                   "@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router",
-                                                   "suppress_envoy_headers":true
-                                                }
-                                             }
-                                          ],
-                                          "enabled":true
-                                       }
-                                    ],
-                                    "stream_idle_timeout":"300s",
-                                    "request_timeout":"0s",
-                                    "common_http_protocol_options":{
-                                       "idle_timeout":"3600s"
-                                    },
-                                    "local_reply_config":{
-                                       "mappers":[
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UF"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102503",
-                                                   "message":"Upstream connection failed",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102508",
-                                                   "message":"No healthy upstream",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102510",
-                                                   "message":"Upstream connection termination"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102515",
-                                                   "message":"HTTP protocol error in upstream request",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UMSDR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102516",
-                                                   "message":"Upstream request reached max stream duration",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":404,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"The requested resource is not available.",
-                                                   "code":"404",
-                                                   "message":"Not Found"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UT"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":504,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102504",
-                                                   "message":"Upstream connection timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "NC"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102507",
-                                                   "message":"Upstream not configured for the resource",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "message":"Upstream connection reset by the remote",
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102509"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "IH"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":400,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102512",
-                                                   "message":"Strictly checked header validation failure",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "DPE"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "description":"%LOCAL_REPLY_BODY%",
-                                                   "code":"102514",
-                                                   "message":"HTTP protocol error in downstream request"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "UO"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102505",
-                                                   "message":"Upstream overflow",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "URX"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102506",
-                                                   "message":"Upstream maximum connect attempts reached",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "LR"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":503,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102511",
-                                                   "message":"Connection reset by the gateway",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "response_flag_filter":{
-                                                   "flags":[
-                                                      "SI"
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102513",
-                                                   "message":"Stream idle timeout",
-                                                   "description":"%LOCAL_REPLY_BODY%"
-                                                }
-                                             }
-                                          },
-                                          {
-                                             "filter":{
-                                                "and_filter":{
-                                                   "filters":[
-                                                      {
-                                                         "metadata_filter":{
-                                                            "matcher":{
-                                                               "filter":"envoy.filters.http.ext_authz",
-                                                               "path":[
-                                                                  {
-                                                                     "key":"apk-enforcer-reply"
-                                                                  }
-                                                               ],
-                                                               "value":{
-                                                                  "string_match":{
-                                                                     "exact":"Not Matching"
-                                                                  }
-                                                               }
-                                                            },
-                                                            "match_if_key_not_found":true
-                                                         }
-                                                      },
-                                                      {
-                                                         "response_flag_filter":{
-                                                            "flags":[
-                                                               "UAEX"
-                                                            ]
-                                                         }
-                                                      }
-                                                   ]
-                                                }
-                                             },
-                                             "status_code":500,
-                                             "body_format_override":{
-                                                "json_format":{
-                                                   "code":"102500",
-                                                   "message":"Unclassified Validation Failure",
-                                                   "description":"Error during validating the request"
-                                                }
-                                             }
-                                          }
-                                       ]
-                                    },
-                                    "request_headers_timeout":"0s"
-                                 }
-                              }
-                           ],
-                           "transport_socket":{
-                              "name":"envoy.transport_sockets.tls",
-                              "typed_config":{
-                                 "@type":"type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext",
-                                 "common_tls_context":{
-                                    "tls_certificates":[
-                                       {
-                                          "certificate_chain":{
-                                             "inline_string":"-----BEGIN CERTIFICATE-----\nMIIC8jCCAdqgAwIBAgIRALsZUAF5+8SisHwMIDW5Q44wDQYJKoZIhvcNAQELBQAw\nDjEMMAoGA1UEAwwDYXBrMB4XDTIzMDgxNzExMTc1MVoXDTIzMTExNTExMTc1MVow\nADCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMXpOlTxP/FikjSt6ha+\nZ6bpd3q6VLvX7IhP5ymA+J3F7+efDhP+cDCmRJ4iw3kGqi/AxzZW6EkLxEGCdSzR\n6oY1HF3M6PMuveM3wZugdmNiGC/oKFQNIL+yYXjpkzAv2115+w7faoLBx2x2fx0i\nTr8IfGfgeBKUiK5vWS1yU1n8g3p7lvq649/OZpHke2dWlRNI7azgjG6VrPBOX1DS\nuGbaZAhkIc6KjhchfkERfqkb4OSSWUe4q/6Fj3KOmm4yR4TmrzYSAgJX0Qtru10j\nwjXWkWqfE2f5NLj7+mBcgzlPTDO7L4LTSKUIVOUpZNDNoUk/RduSedQpnHkz7dkj\nblcCAwEAAaNZMFcwDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQCMAAwHwYDVR0j\nBBgwFoAUzxcA8ceCF5t+vPeOpYbi11CWjwcwFgYDVR0RAQH/BAwwCoIIbG9jYWhv\nc3QwDQYJKoZIhvcNAQELBQADggEBALnB2yCIxPreQSyfuAzGFq9OxjbZA0r2Tyhq\nYAiGg59u/otZm0tzCVtykNyrCPE6J055yFuXRKBzgjfXWRpWNhuSKu9iblHf99vi\nAsPy/crc+Ht3BpvapbdIU0qj05FG8XptH5Fr1UlqstT3imNtB6RsqmnOFKHyVsLv\nHbrEPF1RrtUTply1hkNaovWeT5hLof/oqptX9t4btivcxfRfxRvUu3g5pA23rfzt\n3WjpfWXLUBzY0FiHCN54G7qT8iOBXBF3EYkD6q+vaw+HAEj9A2SkPa7Apzrl1mkD\n/AfjCZNag/GhIPCYUElXA1u/8do5LRIemBxJKuTPbECCKPvkwCY=\n-----END CERTIFICATE-----\n"
-                                          },
-                                          "private_key":{
-                                             "inline_string":"[redacted]"
-                                          }
-                                       }
-                                    ],
-                                    "alpn_protocols":[
-                                       "h2",
-                                       "http/1.1"
-                                    ]
-                                 }
-                              }
-                           }
-                        }
-                     ],
-                     "listener_filters":[
-                        {
-                           "name":"envoy.filters.listener.tls_inspector",
-                           "typed_config":{
-                              "@type":"type.googleapis.com/envoy.extensions.filters.listener.tls_inspector.v3.TlsInspector"
-                           }
-                        }
-                     ]
-                  },
-                  "last_updated":"2023-08-23T06:41:53.816Z"
-               }
-            }
-         ]
-      },
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.ScopedRoutesConfigDump"
-      },
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.RoutesConfigDump",
-         "dynamic_route_configs":[
-            {
-               "version_info":"71006550",
-               "route_config":{
-                  "@type":"type.googleapis.com/envoy.config.route.v3.RouteConfiguration",
-                  "name":"httpslistener",
-                  "virtual_hosts":[
-                     {
-                        "name":"idp.am.wso2.com",
-                        "domains":[
-                           "idp.am.wso2.com",
-                           "idp.am.wso2.com:*"
-                        ],
-                        "routes":[
-                           {
-                              "match":{
-                                 "path":"/authenticationEndpoint/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/authenticationEndpoint/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/authenticationEndpoint/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/authenticationEndpoint/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/authenticationEndpoint/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "path":"/dcr/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/dcr/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/dcr/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/dcr/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/dcr/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/dcr/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/dcr/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/dcr((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/dcr((?:/.*)*)"
-                                    },
-                                    "substitution":"/dcr\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/dcr((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/dcr"
-                           },
-                           {
-                              "match":{
-                                 "path":"/commonoauth/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/commonoauth/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/commonoauth/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/commonoauth/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/commonoauth/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/commonoauth/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/commonoauth/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/commonoauth((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/commonoauth((?:/.*)*)"
-                                    },
-                                    "substitution":"/commonoauth\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/commonoauth((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/commonoauth"
-                           },
-                           {
-                              "match":{
-                                 "path":"/oauth2/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/oauth2/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/oauth2/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/oauth2/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/oauth2/1.0.0/idp.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/oauth2/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/oauth2/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/oauth2"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/oauth2((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/oauth2((?:/.*)*)"
-                                    },
-                                    "substitution":"/oauth2\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"idp.am.wso2.com:^/oauth2((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/oauth2"
-                           }
-                        ]
-                     },
-                     {
-                        "name":"api.am.wso2.com",
-                        "domains":[
-                           "api.am.wso2.com",
-                           "api.am.wso2.com:*"
-                        ],
-                        "routes":[
-                           {
-                              "match":{
-                                 "path":"/.wellknown/jwks/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/.wellknown/jwks/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/.wellknown/jwks/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/.wellknown/jwks/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/.wellknown/jwks/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/.wellknown/jwks/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks/1\\.0\\.0((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PATCH$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^HEAD$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^OPTIONS$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/\\.wellknown/jwks((?:/.*)*)"
-                                    },
-                                    "substitution":"/jwks\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/\\.wellknown/jwks((?:/.*)*)"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/.wellknown/jwks"
-                           },
-                           {
-                              "match":{
-                                 "path":"/api/deployer/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/api/deployer/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/api/deployer/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/api/deployer/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/api/deployer/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/api/deployer/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
-                                    },
-                                    "substitution":"/api/deployer/apis/deploy"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/deployer/1.0.0/apis/deploy([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/api/deployer/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/deployer/apis/deploy([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/deployer/apis/deploy([/]{0,1})"
-                                    },
-                                    "substitution":"/api/deployer/apis/deploy"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/deployer/apis/deploy([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/api/deployer"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
-                                    },
-                                    "substitution":"/api/deployer/apis/undeploy"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/deployer/1.0.0/apis/undeploy([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/api/deployer/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/deployer/apis/undeploy([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/deployer/apis/undeploy([/]{0,1})"
-                                    },
-                                    "substitution":"/api/deployer/apis/undeploy"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/deployer/apis/undeploy([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/api/deployer"
-                           },
-                           {
-                              "match":{
-                                 "path":"/api/configurator/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/api/configurator/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/api/configurator/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/api/configurator/1.0.0/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/api/configurator/1.0.0/api.am.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/api/configurator/1.0.0"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
-                                    },
-                                    "substitution":"/api/configurator/apis/generate-configuration"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/configurator/1.0.0/apis/generate-configuration([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api/configurator/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/configurator/apis/generate-configuration([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/configurator/apis/generate-configuration([/]{0,1})"
-                                    },
-                                    "substitution":"/api/configurator/apis/generate-configuration"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/configurator/apis/generate-configuration([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api/configurator"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
-                                    },
-                                    "substitution":"/api/configurator/apis/generate-k8s-resources"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/configurator/1.0.0/apis/generate-k8s-resources([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api/configurator/1.0.0"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
-                                    },
-                                    "substitution":"/api/configurator/apis/generate-k8s-resources"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"api.am.wso2.com:^/api/configurator/apis/generate-k8s-resources([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api/configurator"
-                           }
-                        ]
-                     },
-                     {
-                        "name":"default.gw.wso2.com",
-                        "domains":[
-                           "default.gw.wso2.com",
-                           "default.gw.wso2.com:*"
-                        ],
-                        "routes":[
-                           {
-                              "match":{
-                                 "path":"/test-definition-default/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/test-definition-default/3.14/default.gw.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/test-definition-default/3.14"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "path":"/test-definition-default/3.14/api-definition",
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster":"api_definition_cluster",
-                                 "prefix_rewrite":"/test-definition-default/3.14/default.gw.wso2.com?OAS",
-                                 "auto_host_rewrite":true
-                              },
-                              "decorator":{
-                                 "operation":"/test-definition-default/3.14"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/api-definition"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/test-definition-default/3.14"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^GET$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/employee([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/employee([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/test-definition-default"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/3.14/employee([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/test-definition-default/3.14"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^POST$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/employee([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/employee([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/test-definition-default"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee/\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/test-definition-default/3.14"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^PUT$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee/\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee/(.*)([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 },
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 }
-                              },
-                              "name":"/test-definition-default"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee/\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/3.14/employee/(.*)([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/test-definition-default/3.14"
-                           },
-                           {
-                              "match":{
-                                 "headers":[
-                                    {
-                                       "name":":method",
-                                       "string_match":{
-                                          "safe_regex":{
-                                             "regex":"^DELETE$"
-                                          }
-                                       }
-                                    }
-                                 ],
-                                 "safe_regex":{
-                                    "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
-                                 },
-                                 "dynamic_metadata":[
-                                    {
-                                       "filter":"envoy.filters.http.ext_authz",
-                                       "path":[
-                                          {
-                                             "key":"method-rewrite"
-                                          }
-                                       ],
-                                       "value":{
-                                          "present_match":true
-                                       },
-                                       "invert":true
-                                    }
-                                 ]
-                              },
-                              "route":{
-                                 "cluster_header":"x-wso2-cluster-header",
-                                 "auto_host_rewrite":true,
-                                 "upgrade_configs":[
-                                    {
-                                       "upgrade_type":"websocket",
-                                       "enabled":false
-                                    }
-                                 ],
-                                 "regex_rewrite":{
-                                    "pattern":{
-                                       "regex":"^/test-definition-default/employee/(.*)([/]{0,1})"
-                                    },
-                                    "substitution":"/anything/employee/\\1"
-                                 }
-                              },
-                              "decorator":{
-                                 "operation":"default.gw.wso2.com:^/test-definition-default/employee/(.*)([/]{0,1})"
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.cors":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy"
-                                 },
-                                 "envoy.filters.http.lua.local":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.lua.v3.LuaPerRoute",
-                                    "disabled":true
-                                 },
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "check_settings":{
-                                       "context_extensions":{
-                                          "basePath":"[redacted]",
-                                          "clusterName":"[redacted]",
-                                          "method":"[redacted]",
-                                          "name":"[redacted]",
-                                          "path":"[redacted]",
-                                          "vHost":"[redacted]",
-                                          "version":"[redacted]"
-                                       },
-                                       "disable_request_body_buffering":true
-                                    }
-                                 }
-                              },
-                              "name":"/test-definition-default"
-                           }
-                        ]
-                     },
-                     {
-                        "name":"localhost",
-                        "domains":[
-                           "localhost",
-                           "localhost:*"
-                        ],
-                        "routes":[
-                           {
-                              "match":{
-                                 "path":"/health"
-                              },
-                              "decorator":{
-                                 "operation":"/health"
-                              },
-                              "direct_response":{
-                                 "status":200,
-                                 "body":{
-                                    "inline_string":"{\"status\": \"healthy\"}"
-                                 }
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/health"
-                           },
-                           {
-                              "match":{
-                                 "path":"/ready"
-                              },
-                              "decorator":{
-                                 "operation":"/ready"
-                              },
-                              "direct_response":{
-                                 "status":200,
-                                 "body":{
-                                    "inline_string":"{\"status\": \"ready\"}"
-                                 }
-                              },
-                              "typed_per_filter_config":{
-                                 "envoy.filters.http.ext_authz":{
-                                    "@type":"type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute",
-                                    "disabled":true
-                                 }
-                              },
-                              "name":"/ready"
-                           }
-                        ]
-                     }
-                  ],
-                  "request_headers_to_remove":[
-                     "x-wso2-cluster-header"
-                  ]
-               },
-               "last_updated":"2023-08-23T06:41:53.824Z"
-            }
-         ]
-      },
-      {
-         "@type":"type.googleapis.com/envoy.admin.v3.SecretsConfigDump"
-      }
-   ]
-}
\ No newline at end of file
diff --git a/adapter/test.yaml b/adapter/test.yaml
deleted file mode 100644
index a31321400..000000000
--- a/adapter/test.yaml
+++ /dev/null
@@ -1,92 +0,0 @@
-apiVersion: dp.wso2.com/v1alpha2
-kind: API
-metadata:
-  name: test-api-with-different-listener
-  namespace: apk
-spec:
-  apiName: API with Different Listener
-  apiType: REST
-  apiVersion: 1.0.0
-  basePath: /test-api-with-different-listener/v1.0.0
-  #definitionFileRef: definition-file
-  production:
-    - routeRefs:
-      - backend
-  organization: wso2-org
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: backend
-  namespace: apk
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: backend
-  namespace: apk
-  labels:
-    app: backend
-    service: backend
-spec:
-  ports:
-    - name: http
-      port: 3000
-      targetPort: 3000
-  selector:
-    app: backend
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backend
-  namespace: apk
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: backend
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: backend
-        version: v1
-    spec:
-      serviceAccountName: backend
-      containers:
-        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
-          imagePullPolicy: IfNotPresent
-          name: backend
-          ports:
-            - containerPort: 3000
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: backend
-  namespace: apk
-spec:
-  parentRefs:
-    - name: wso2-apk-default
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: backend
-          port: 3000
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /backend-path
-          method: GET
\ No newline at end of file
diff --git a/common-controller/build.gradle b/common-controller/build.gradle
index 0050837e7..7982534fc 100644
--- a/common-controller/build.gradle
+++ b/common-controller/build.gradle
@@ -69,8 +69,8 @@ tasks.named('go_revive_run').configure {
 }
 
 tasks.named('go_build').configure {
-    // dependsOn go_revive_run
-    // dependsOn go_vet
+    dependsOn go_revive_run
+    dependsOn go_vet
     println("Running go build")
     finalizedBy docker_build
 }
diff --git a/common-controller/go.mod b/common-controller/go.mod
index e59a3f7d1..65c8047d0 100644
--- a/common-controller/go.mod
+++ b/common-controller/go.mod
@@ -6,9 +6,9 @@ require (
 	github.com/jackc/pgx/v5 v5.5.4
 	github.com/onsi/ginkgo/v2 v2.14.0
 	github.com/onsi/gomega v1.30.0
-	github.com/prometheus/client_golang v1.19.0 // indirect
+	github.com/prometheus/client_golang v1.18.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/sirupsen/logrus v1.9.3
+	github.com/sirupsen/logrus v1.9.0
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2
 	sigs.k8s.io/controller-runtime v0.17.2
@@ -51,6 +51,7 @@ require (
 	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -77,7 +78,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
@@ -87,7 +88,7 @@ require (
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
@@ -103,7 +104,7 @@ require (
 	github.com/prometheus/client_model v0.6.0 // indirect
 	github.com/prometheus/common v0.45.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/testify v1.9.0
+	github.com/stretchr/testify v1.8.4
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/net v0.25.0 // indirect
@@ -112,7 +113,7 @@ require (
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.17.0 // indirect
+	golang.org/x/tools v0.16.1 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
diff --git a/common-controller/go.sum b/common-controller/go.sum
index 2598979ee..499f6ef21 100644
--- a/common-controller/go.sum
+++ b/common-controller/go.sum
@@ -52,10 +52,10 @@ github.com/envoyproxy/go-control-plane v0.13.0/go.mod h1:GRaKG3dwvFoTg4nj7aXdZnv
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU4zdyUgIUNhlgg0A=
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
-github.com/evanphx/json-patch v5.9.0+incompatible h1:fBXyNpNMuTTDdquAq/uisOr2lShz4oaXpDTX2bLe7ls=
-github.com/evanphx/json-patch v5.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
-github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
+github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
@@ -157,6 +157,8 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -183,8 +185,8 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
-github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
@@ -206,8 +208,8 @@ github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
+github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -224,9 +226,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -248,8 +249,8 @@ go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
-go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go.uber.org/zap v1.26.0 h1:sI7k6L95XOKS281NhVKOFCUNIvv9e0w4BF8N3u+tCRo=
+go.uber.org/zap v1.26.0/go.mod h1:dtElttAiwGvoJ/vj4IwHBS/gXsEu/pZ50mUIRWuG0so=
 golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
 golang.org/x/arch v0.3.0 h1:02VY4/ZcO/gBOH6PUaoiptASxtXU10jazRCP865E97k=
 golang.org/x/arch v0.3.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
@@ -299,6 +300,7 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

From 522b38bff2f9fcfea7311866b8cecadecb37bba7 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Wed, 14 Aug 2024 15:18:07 +0530
Subject: [PATCH 11/40] Support API basePath

---
 .../gateway-api/provider/kubernetes/routes.go | 35 +++++++++++++++++++
 .../gateway-api/translator/extauth.go         |  3 +-
 2 files changed, 37 insertions(+), 1 deletion(-)

diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
index ad32f43cc..ebacf44ad 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -198,7 +198,42 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 		}
 
 		for _, api := range apiList.Items {
+			ns := api.GetNamespace()
 			resourceTree.APIs = append(resourceTree.APIs, &api)
+			for _, hr := range resourceTree.HTTPRoutes {
+				for _, prods := range api.Spec.Production {
+					for _, routeName := range prods.RouteRefs {
+						expectedRouteNamespacedName := types.NamespacedName{
+							Namespace: ns,
+							Name:      routeName,
+						}.String()
+						routeNamespacedName := types.NamespacedName{
+							Namespace: hr.GetNamespace(),
+							Name:      hr.GetName(),
+						}.String()
+						if expectedRouteNamespacedName == routeNamespacedName {
+							rules := hr.Spec.Rules
+							newRules := make([]gwapiv1.HTTPRouteRule, 0)
+							for _, rule := range rules {
+								newMatches := make([]gwapiv1.HTTPRouteMatch, 0)
+								for _, match := range rule.Matches {
+									if match.Path.Value != nil {
+										newPath := api.Spec.BasePath  +  *match.Path.Value
+										match.Path.Value = &newPath
+									} else {
+										newPath := api.Spec.BasePath
+										match.Path.Value = &newPath
+									}
+									newMatches = append(newMatches, match)
+								}
+								rule.Matches = newMatches
+								newRules = append(newRules, rule)
+							}
+							hr.Spec.Rules = newRules
+						}
+					}
+				}
+			}
 		}
 	}
 	resourceTree.APIs = gatewayapi.RemoveDuplicates(resourceTree.APIs)
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index 5813b9491..1cc8b47e7 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -104,7 +104,8 @@ func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
 
 	return &hcmv3.HttpFilter{
 		Name:     extAuthFilterName(extAuth),
-		Disabled: false,
+		// TODO make it false after fixing the ext auth
+		Disabled: true,   
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
 		},

From b120ba7d14ccb5698c7452af26cd29b8b27d83a7 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Wed, 14 Aug 2024 19:07:53 +0530
Subject: [PATCH 12/40] Add default version support

---
 .../gateway-api/provider/kubernetes/routes.go | 43 ++++++++++++++++++-
 1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
index ebacf44ad..94a3f8503 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -20,14 +20,16 @@ package kubernetes
 import (
 	"context"
 	"errors"
+	"fmt"
+	"strings"
 
 	"github.com/wso2/apk/adapter/internal/loggers"
 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	"k8s.io/apimachinery/pkg/fields"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
-	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 )
 
 // processHTTPRoutes finds HTTPRoutes corresponding to a gatewayNamespaceName, further checks for
@@ -230,6 +232,29 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 								newRules = append(newRules, rule)
 							}
 							hr.Spec.Rules = newRules
+
+							// Manipulate for default version feature
+							if api.Spec.IsDefaultVersion {
+								newRulesForDefaultVersion := make([]gwapiv1.HTTPRouteRule, 0)
+								for _, rule := range rules {
+									newMatches := make([]gwapiv1.HTTPRouteMatch, 0)
+									for _, match := range rule.Matches {
+										matchCopied := match.DeepCopy()
+										if match.Path.Value != nil {
+											newPath := removeFirstSubstring(*match.Path.Value, fmt.Sprintf("/%s",api.Spec.APIVersion)) 
+											matchCopied.Path.Value = &newPath
+										} else {
+											newPath := removeSuffix(api.Spec.BasePath, api.Spec.APIVersion)
+											matchCopied.Path.Value = &newPath
+										}
+										newMatches = append(newMatches, *matchCopied)
+									}
+									ruleCopied := rule.DeepCopy()
+									ruleCopied.Matches = newMatches
+									newRulesForDefaultVersion = append(newRulesForDefaultVersion, *ruleCopied)
+								}
+								hr.Spec.Rules = append(hr.Spec.Rules, newRulesForDefaultVersion...)
+							}
 						}
 					}
 				}
@@ -239,3 +264,19 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 	resourceTree.APIs = gatewayapi.RemoveDuplicates(resourceTree.APIs)
 	return nil
 }
+
+
+func removeSuffix(str, suffix string) string {
+	if strings.HasSuffix(str, suffix) {
+		return str[:len(str)-len(suffix)]
+	}
+	return str
+}
+
+func removeFirstSubstring(str, substr string) string {
+	index := strings.Index(str, substr)
+	if index == -1 {
+		return str // Substring not found, return the original string
+	}
+	return str[:index] + str[index+len(substr):]
+}

From 1bc6dc1f092063964d29f52ffaa374af1627560c Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Wed, 14 Aug 2024 16:13:37 +0530
Subject: [PATCH 13/40] add feature flag and add enforcer ports

---
 adapter/config/types.go                       |   9 +-
 .../gateway-api/bootstrap/bootstrap.yaml.tpl  |  13 +-
 .../kubernetes/proxy/resource.go              |  24 +-
 .../kubernetes/proxy/resource_test.go         |   2 +-
 .../kubernetes/proxy_configmap_test.go        |   6 +-
 .../kubernetes/resource/resource_test.go      |   8 +-
 .../adapter/adapter-deployment.yaml           |  11 +-
 .../gateway-components/log-conf.yaml          |  16 +-
 .../gateway-runtime-autoscaller.yaml          |  51 ++
 .../gateway-runtime-deployment.yaml           | 478 ++++++++++++++++++
 .../gateway-runtime/gateway-service.yaml      |  43 ++
 helm-charts/values.yaml                       |   3 +-
 12 files changed, 626 insertions(+), 38 deletions(-)
 create mode 100644 helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml
 create mode 100644 helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml
 create mode 100644 helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml

diff --git a/adapter/config/types.go b/adapter/config/types.go
index 9638af9ef..2f062414d 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -97,7 +97,8 @@ type adapter struct {
 	// Metric represents configurations to expose/export go metrics
 	Metrics Metrics
 	// ControlPlane represents the connection configuration of ControlPlane
-	ControlPlane controlplane
+	ControlPlane                 controlplane
+	EnableGatewayClassController bool
 }
 
 // Envoy Listener Component related configurations.
@@ -338,6 +339,12 @@ type gateway struct {
 	EnforcerXDSMaxRetries    string
 	JavaOpts                 string
 	Volumes                  volumes
+	EnforcerPorts            []enforcerPorts
+}
+
+type enforcerPorts struct {
+	Name          string
+	ContainerPort int32
 }
 
 type volumes struct {
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
index a997a2884..30fa27815 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -85,15 +85,6 @@ static_resources:
               - name: ":path"
                 string_match:
                   exact: {{ .ReadyServer.ReadinessPath }}
-          - name: envoy.filters.http.ext_authz
-            typed_config:
-              "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
-              clear_route_cache: true
-              include_peer_certificate: true
-              transport_api_version: 2
-              grpc_service: 
-                  envoy_grpc: 
-                    cluster_name: ext-authz
           - name: envoy.filters.http.router
             typed_config:
               "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
@@ -155,7 +146,7 @@ static_resources:
           validation_context:
             trusted_ca:
               filename: '/home/wso2/security/truststore/adapter.crt'
-  - name: ext-authz
+              - name: ext-authz
     type: STRICT_DNS
     connect_timeout: 20s
     typed_extension_protocol_options:
@@ -188,4 +179,4 @@ static_resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 8081
-  
\ No newline at end of file
+                      
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 13e51d323..185431064 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -85,7 +85,7 @@ func EnvoyAppLabel() map[string]string {
 	return map[string]string{
 		"app.kubernetes.io/name":       "envoy",
 		"app.kubernetes.io/component":  "proxy",
-		"app.kubernetes.io/managed-by": "envoy-gateway",
+		"app.kubernetes.io/managed-by": "apk-gateway",
 	}
 }
 
@@ -94,7 +94,7 @@ func EnvoyAppLabelSelector() []string {
 	return []string{
 		"app.kubernetes.io/name=envoy",
 		"app.kubernetes.io/component=proxy",
-		"app.kubernetes.io/managed-by=envoy-gateway",
+		"app.kubernetes.io/managed-by=apk-gateway",
 	}
 }
 
@@ -406,16 +406,6 @@ func expectedEnforcerPorts() []corev1.ContainerPort {
 			ContainerPort: int32(8081),
 			Protocol:      corev1.ProtocolTCP,
 		},
-		{
-			// Name:          "ExtAuthServer",
-			ContainerPort: int32(9001),
-			Protocol:      corev1.ProtocolTCP,
-		},
-		{
-			Name:          "debug",
-			ContainerPort: int32(5006),
-			Protocol:      corev1.ProtocolTCP,
-		},
 		{
 			Name:          "jwks",
 			ContainerPort: int32(9092),
@@ -428,6 +418,16 @@ func expectedEnforcerPorts() []corev1.ContainerPort {
 		},
 	}
 
+	for _, port := range config.ReadConfigs().Deployment.Gateway.EnforcerPorts {
+		ports = append(ports,
+			corev1.ContainerPort{
+				Name:          port.Name,
+				ContainerPort: port.ContainerPort,
+				Protocol:      corev1.ProtocolTCP,
+			},
+		)
+	}
+
 	return ports
 }
 
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
index de4881c03..c26af4f0e 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_test.go
@@ -41,7 +41,7 @@ func TestEnvoyPodSelector(t *testing.T) {
 				"foo":                          "bar",
 				"app.kubernetes.io/name":       "envoy",
 				"app.kubernetes.io/component":  "proxy",
-				"app.kubernetes.io/managed-by": "envoy-gateway",
+				"app.kubernetes.io/managed-by": "apk-gateway",
 			},
 		},
 	}
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
index 6a04adc8b..9457e9459 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy_configmap_test.go
@@ -59,7 +59,7 @@ var (
 // 					Labels: map[string]string{
 // 						"app.kubernetes.io/name":               "envoy",
 // 						"app.kubernetes.io/component":          "proxy",
-// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						"app.kubernetes.io/managed-by":         "apk-gateway",
 // 						gatewayapi.OwningGatewayNamespaceLabel: "default",
 // 						gatewayapi.OwningGatewayNameLabel:      "test",
 // 					},
@@ -79,7 +79,7 @@ var (
 // 					Labels: map[string]string{
 // 						"app.kubernetes.io/name":               "envoy",
 // 						"app.kubernetes.io/component":          "proxy",
-// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						"app.kubernetes.io/managed-by":         "apk-gateway",
 // 						gatewayapi.OwningGatewayNamespaceLabel: "default",
 // 						gatewayapi.OwningGatewayNameLabel:      "test",
 // 					},
@@ -93,7 +93,7 @@ var (
 // 					Labels: map[string]string{
 // 						"app.kubernetes.io/name":               "envoy",
 // 						"app.kubernetes.io/component":          "proxy",
-// 						"app.kubernetes.io/managed-by":         "envoy-gateway",
+// 						"app.kubernetes.io/managed-by":         "apk-gateway",
 // 						gatewayapi.OwningGatewayNamespaceLabel: "default",
 // 						gatewayapi.OwningGatewayNameLabel:      "test",
 // 					},
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
index 619459000..9b953839e 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource/resource_test.go
@@ -136,12 +136,12 @@ func TestGetSelector(t *testing.T) {
 			in: map[string]string{
 				"app.kubernetes.io/name":       "envoy",
 				"app.kubernetes.io/component":  "proxy",
-				"app.kubernetes.io/managed-by": "envoy-gateway",
+				"app.kubernetes.io/managed-by": " apk-gateway",
 			},
 			expected: map[string]string{
 				"app.kubernetes.io/name":       "envoy",
 				"app.kubernetes.io/component":  "proxy",
-				"app.kubernetes.io/managed-by": "envoy-gateway",
+				"app.kubernetes.io/managed-by": " apk-gateway",
 			},
 		},
 		{
@@ -149,12 +149,12 @@ func TestGetSelector(t *testing.T) {
 			in: map[string]string{
 				"app.kubernetes.io/name":       "envoy-ratelimit",
 				"app.kubernetes.io/component":  "ratelimit",
-				"app.kubernetes.io/managed-by": "envoy-gateway",
+				"app.kubernetes.io/managed-by": " apk-gateway",
 			},
 			expected: map[string]string{
 				"app.kubernetes.io/name":       "envoy-ratelimit",
 				"app.kubernetes.io/component":  "ratelimit",
-				"app.kubernetes.io/managed-by": "envoy-gateway",
+				"app.kubernetes.io/managed-by": " apk-gateway",
 			},
 		},
 	}
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
index 3416b7cdd..421fb94df 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
@@ -88,7 +88,7 @@ spec:
             {{- else }}
               subPath: ca.crt
             {{- end }}
-            - name: envoy-truststore-secret-volume
+            - name: router-truststore-secret-volume
               mountPath: /home/wso2/security/truststore/router.crt
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
               subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
@@ -158,9 +158,16 @@ spec:
         #   secret:
         #     secretName: {{ template "apk-helm.resource.prefix" . }}-webhook-server-cert
         #     defaultMode: 420
-        - name: envoy-truststore-secret-volume
+        - name: router-truststore-secret-volume
           secret: 
+          {{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController }}
             secretName: envoy-cert
+          {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
+            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.secretName | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
+          {{- else }}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
+          {{- end }}
+          {{- end }}
         - name: enforcer-truststore-secret-volume
           secret: 
             {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index c04aa0e7a..eebbbe8a0 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -13,9 +13,16 @@ data:
       commonControllerHostName = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
       commonControllerHost = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
       enforcerServerName = "{{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc"
-      {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}
+      {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs }}
+      {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}
         javaOpts = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}"
       {{- end }}
+      {{- range .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.ports}}
+      [[deployment.gateway.enforcerPorts]]
+        name = "{{ .name }}"
+        containerPort = {{ .value }}     
+      {{- end }} 
+      {{- end }} 
 
     [deployment.gateway.volumes]
       ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"
@@ -31,10 +38,13 @@ data:
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}
       environment = "{{ .Values.wso2.apk.dp.environment.name }}"
       {{- end }}
-    {{ if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
+    {{ if .Values.wso2.apk.dp.adapter.deployment.configs }}
+      enableGatewayClassController = {{ .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController | default false }}
+    {{ if .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces }}
     [adapter.operator]
       namespaces = [{{ include "commaJoinedQuotedList" .Values.wso2.apk.dp.adapter.deployment.configs.apiNamespaces}}]
-    {{ end}}    
+    {{ end}} 
+    {{ end}} 
     {{if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled}}
     [adapter.metrics]
       enabled = {{.Values.wso2.apk.metrics.enabled}}
diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml b/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml
new file mode 100644
index 000000000..5bac825d8
--- /dev/null
+++ b/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml
@@ -0,0 +1,51 @@
+# --------------------------------------------------------------------
+# Copyright (c) 2022, WSO2 LLC. (http://wso2.com) All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# -----------------------------------------------------------------------
+{{- if .Values.wso2.apk.dp.enabled }}
+{{- if and .Values.wso2.apk.dp.gateway.autoscaling .Values.wso2.apk.dp.gateway.autoscaling.enabled -}}
+{{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs (not .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController) }}
+
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-autoscaller
+  namespace: {{ .Release.Namespace }}
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
+  minReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.minReplicas }}
+  maxReplicas: {{ .Values.wso2.apk.dp.gateway.autoscaling.maxReplicas }}
+  metrics:
+    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
+    - type: Resource
+      resource:
+        name: memory
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetMemory }}
+    {{- end }}
+    {{- if .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: {{ .Values.wso2.apk.dp.gateway.autoscaling.targetCPU }}
+    {{- end }}
+{{- end }}
+{{- end}}
+{{- end}}
\ No newline at end of file
diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml b/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml
new file mode 100644
index 000000000..c2b16457a
--- /dev/null
+++ b/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml
@@ -0,0 +1,478 @@
+# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
+#
+# WSO2 LLC. licenses this file to you under the Apache License,
+# Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+{{- if .Values.wso2.apk.dp.enabled }}
+{{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs (not .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.replicas }}
+  strategy:
+    type: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.strategy }}
+  selector:
+    matchLabels:
+{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 6}}
+  template:
+    metadata:
+      labels:
+{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 8}}
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/data-plane/gateway-components/log-conf.yaml") . | sha256sum }}
+    spec:
+      affinity: {{- include "apk-helm.deployment.affinity" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.affinity "app" "gateway-runtime" "context" $) | nindent 8 }}
+      {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector }}
+      nodeSelector: {{- include "apk-helm.deployment.nodeSelector" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector "context" $) | nindent 8 }}
+      {{- end }}
+      automountServiceAccountToken: false
+      containers:
+        - name: enforcer
+          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.image }}
+          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.imagePullPolicy }}
+          ports:
+            - containerPort: 8081
+              protocol: "TCP"
+            - containerPort: 9001
+              protocol: "TCP"
+            - containerPort: 5006	
+              protocol: "TCP"
+            - containerPort: 8084
+              protocol: "TCP"
+            - containerPort: 9092
+              protocol: "TCP"
+            - containerPort: 18002
+              protocol: "TCP"
+            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled}}
+            - containerPort: 18006
+              protocol: "TCP"
+            {{- end }}
+{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.resources | indent 10 }}
+{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.env | indent 10 }}
+            - name: ADAPTER_HOST_NAME
+              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
+            - name: ADAPTER_HOST
+              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
+            - name: COMMON_CONTROLLER_HOST_NAME
+              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
+            - name: COMMON_CONTROLLER_HOST
+              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
+            - name: ENFORCER_PRIVATE_KEY_PATH
+              value: /home/wso2/security/keystore/enforcer.key  
+            - name: ENFORCER_PUBLIC_CERT_PATH
+              value: /home/wso2/security/keystore/enforcer.crt
+            - name: ENFORCER_SERVER_NAME
+              value: {{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc
+            - name: TRUSTED_CA_CERTS_PATH
+              value: "/home/wso2/security/truststore"
+            - name: ADAPTER_XDS_PORT
+              value : "18000"
+            - name: COMMON_CONTROLLER_XDS_PORT
+              value : "18002"
+            - name: COMMON_CONTROLLER_REST_PORT
+              value : "18003"
+            - name: ENFORCER_LABEL
+              value : {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
+            - name: ENFORCER_REGION
+              value: UNKNOWN
+            - name: XDS_MAX_MSG_SIZE
+              value: "4194304"
+            - name: XDS_MAX_RETRIES 
+              value: "3"
+            - name: enforcer_admin_pwd
+              value: admin
+            - name: JAVA_OPTS
+            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
+              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2 -Dapk.jmx.metrics.enabled=true -javaagent:/home/wso2/lib/jmx_prometheus_javaagent-0.20.0.jar=18006:/tmp/metrics/prometheus-jmx-config-enforcer.yml
+            {{- else }}
+              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2
+            {{- end }}
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.analytics .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
+            {{- $defaultPublisherSecretName := "" }}
+            {{- $moesifPublisherSecretName := "" }}
+            {{- range .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
+              {{- if eq .type "default" }}
+                {{- $defaultPublisherSecretName = .secretName }}
+              {{- end }}
+              {{- if eq .type "moesif" }}
+                {{- $moesifPublisherSecretName = .secretName }}
+              {{- end }}
+            {{- end }}
+            {{- if $defaultPublisherSecretName }}
+            - name: CHOREO_ANALYTICS_AUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $defaultPublisherSecretName }}
+                  key: "authToken"
+            - name: CHOREO_ANALYTICS_AUTH_URL
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $defaultPublisherSecretName }}
+                  key: "authURL"
+            {{- end }}
+            {{- if $moesifPublisherSecretName }}
+            - name: MOESIF_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: {{ $moesifPublisherSecretName }}
+                  key: "moesifToken"
+            {{- end }}
+            {{- end }}
+            {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis }}
+            - name: REDIS_USERNAME
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.username | default "default" }}
+            - name: REDIS_PASSWORD
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.password | default "" }}
+            - name: REDIS_HOST
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.host | default "redis-master" }}
+            - name: REDIS_PORT
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.port | default "6379" }}
+            - name: IS_REDIS_TLS_ENABLED
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tlsEnabled | default "false" }}
+            - name: REDIS_REVOKED_TOKENS_CHANNEL
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.channelName | default "wso2-apk-revoked-tokens-channel" }}
+            - name: REDIS_KEY_FILE
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userKeyPath | default "/home/wso2/security/redis/redis.key" }}
+            - name: REDIS_CERT_FILE
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userCertPath | default "/home/wso2/security/redis/redis.crt" }}
+            - name: REDIS_CA_CERT_FILE
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.redisCaCertPath | default "/home/wso2/security/redis/redis-ca.key" }}
+            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
+              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tokenCleanupInterval | default "3600" }}
+            {{- else }}
+            - name: REDIS_USERNAME
+              value: "default"
+            - name: REDIS_PASSWORD
+              value: ""
+            - name: REDIS_HOST
+              value: "redis-master"
+            - name: REDIS_PORT
+              value: "6379"
+            - name: IS_REDIS_TLS_ENABLED
+              value: "false"
+            - name: REDIS_REVOKED_TOKENS_CHANNEL
+              value: "wso2-apk-revoked-tokens-channel"
+            - name: REDIS_KEY_FILE
+              value: "/home/wso2/security/redis/redis.key"
+            - name: REDIS_CERT_FILE
+              value: "/home/wso2/security/redis/redis.crt"
+            - name: REDIS_CA_CERT_FILE
+              value: "/home/wso2/security/redis/redis-ca.key"
+            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
+              value: "3600"
+            {{- end }}
+          volumeMounts:
+            - name: tmp
+              mountPath: /tmp
+            - name: enforcer-keystore-secret-volume
+              mountPath: /home/wso2/security/keystore/enforcer.key
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certKeyFilename | default "tls.key" }}
+            {{- else }}
+              subPath: tls.key
+            {{- end }}
+            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
+            - name: prometheus-jmx-config-volume
+              mountPath: /tmp/metrics/prometheus-jmx-config-enforcer.yml
+              subPath: prometheus-jmx-config-enforcer.yml
+            {{- end }}
+            - name: enforcer-keystore-secret-volume
+              mountPath: /home/wso2/security/keystore/enforcer.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: enforcer-keystore-secret-volume
+              mountPath: /home/wso2/security/truststore/apk.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.caCertFileName | default "ca.crt" }}
+            {{- else }}
+              subPath: ca.crt
+            {{- end }}
+            - name: enforcer-keystore-secret-volume
+              mountPath: /home/wso2/security/truststore/enforcer.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: adapter-truststore-secret-volume
+              mountPath: /home/wso2/security/truststore/adapter.crt
+            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            # - name: common-controller-truststore-secret-volume
+            #   mountPath: /home/wso2/security/truststore/adapter.pem
+            - name: router-keystore-secret-volume
+              mountPath: /home/wso2/security/truststore/router.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: log-conf-volume
+              mountPath: /home/wso2/conf/
+            - name: enforcer-jwt-secret-volume
+              mountPath: /home/wso2/security/keystore/mg.pem
+              subPath: mg.pem
+            - name: enforcer-jwt-secret-volume
+              mountPath: /home/wso2/security/truststore/mg.pem
+              subPath: mg.pem
+            - name: enforcer-jwt-secret-volume
+              mountPath: /home/wso2/security/keystore/mg.key
+              subPath: mg.key
+            - name: enforcer-trusted-certs
+              mountPath: /home/wso2/security/truststore/wso2carbon.pem
+              subPath: wso2carbon.pem
+            - name: enforcer-apikey-cert
+              mountPath: /home/wso2/security/truststore/wso2-apim-carbon.pem
+              subPath: wso2-apim-carbon.pem
+            - name: idp-certificate-secret-volume
+              mountPath: /home/wso2/security/truststore/idp.pem
+            {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.fileName }}
+              subPath: {{ .Values.wso2.apk.idp.signing.fileName }}
+            {{ else }}
+              subPath: wso2carbon.pem
+            {{ end }}
+            {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.fileName }}
+            - name: idp-tls-certificate-secret-volume
+              mountPath: /home/wso2/security/truststore/idp-tls.pem
+              subPath: {{ .Values.wso2.apk.idp.tls.fileName }}
+            {{ end }}
+          readinessProbe:
+            exec:
+              command: [ "sh", "check_health.sh" ]
+            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.failureThreshold }}
+          livenessProbe:
+            exec:
+              command: [ "sh", "check_health.sh" ]
+            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.failureThreshold }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+        - name: router
+          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.image }}
+          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.imagePullPolicy }}
+          ports:
+            {{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
+            - containerPort: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080}}
+              protocol: "TCP"
+            {{ end }}
+            - containerPort: 9095
+              protocol: "TCP"
+            - containerPort: 9090
+              protocol: "TCP"
+            - containerPort: 9091
+              protocol: "TCP"
+            - containerPort: 9000
+              protocol: "TCP"
+{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.resources | indent 10 }}
+{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.env | indent 10 }}
+            - name: ADAPTER_HOST_NAME
+              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
+            - name: ADAPTER_HOST
+              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
+            - name: ENFORCER_HOST
+              value: "127.0.0.1"
+            - name: ENFORCER_ANALYTICS_HOST
+              value: "127.0.0.1"
+            - name: ROUTER_ADMIN_HOST
+              value: "0.0.0.0"
+            - name: ROUTER_ADMIN_PORT
+              value: "9000"
+            - name: ROUTER_PORT
+              value: "9095"
+            - name: ROUTER_CLUSTER
+              value: "apk_router_cluster"
+            - name: ROUTER_LABEL
+              value: {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
+            - name: ROUTER_PRIVATE_KEY_PATH
+              value: "/home/wso2/security/keystore/router.key"
+            - name: ROUTER_PUBLIC_CERT_PATH
+              value: "/home/wso2/security/keystore/router.crt"
+            - name: ADAPTER_PORT
+              value: "18000"
+            - name: ADAPTER_CA_CERT_PATH
+              value: "/home/wso2/security/truststore/adapter.crt"
+            - name: ENFORCER_PORT
+              value: "8081"
+            - name: ENFORCER_ANALYTICS_RECEIVER_PORT
+              value: "18090"
+            - name: ENFORCER_CA_CERT_PATH
+              value: "/home/wso2/security/truststore/enforcer.crt"
+            - name: CONCURRENCY
+              value: "2"
+          volumeMounts:
+            - name: router-keystore-secret-volume
+              mountPath: /home/wso2/security/keystore/router.key
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certKeyFilename | default "tls.key" }}
+            {{- else }}
+              subPath: tls.key
+            {{- end }}
+            - name: router-keystore-secret-volume
+              mountPath: /home/wso2/security/keystore/router.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: adapter-truststore-secret-volume
+              mountPath: /home/wso2/security/truststore/adapter.crt
+            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: enforcer-keystore-secret-volume
+              mountPath: /home/wso2/security/truststore/enforcer.crt
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: log-conf-volume
+              mountPath: /home/wso2/conf/
+            {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
+            - name: ratelimiter-truststore-secret-volume
+              mountPath: /home/wso2/security/truststore/ratelimiter.crt
+            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certFilename | default "tls.crt" }}
+            {{- else }}
+              subPath: tls.crt
+            {{- end }}
+            - name: ratelimiter-truststore-secret-volume
+              mountPath: /home/wso2/security/truststore/ratelimiter-ca.crt
+            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
+              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certCAFilename | default "ca.crt" }}
+            {{- else }}
+              subPath: ca.crt
+            {{- end }}
+            {{ end }}
+          livenessProbe:
+            exec:
+              command: [ "sh", "router_check_health.sh", "health" ]
+            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.failureThreshold }}
+          readinessProbe:
+            exec:
+              command: [ "sh", "router_check_health.sh", "ready" ]
+            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+          startupProbe:
+            exec:
+              command: [ "sh", "router_check_health.sh", "ready" ]
+            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
+            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
+            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
+      {{- if and .Values.wso2.subscription .Values.wso2.subscription.imagePullSecrets}}
+      imagePullSecrets:
+        - name: {{ .Values.wso2.subscription.imagePullSecrets }}
+      {{ end }}
+      securityContext:
+        seccompProfile:
+          type: "RuntimeDefault"
+      volumes:
+      {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
+        - name: ratelimiter-truststore-secret-volume
+          secret:
+            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
+            secretName: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certificatesSecret | default (printf "%s-ratelimiter-server-cert" (include "apk-helm.resource.prefix" .)) }}
+          {{- else }}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert
+          {{- end }}
+      {{ end }}
+        # - name: common-controller-truststore-secret-volume
+        #   secret:
+        #   {{- if and .Values.wso2.apk.dp.commonController.configs .Values.wso2.apk.dp.commonController.configs.tls }}
+        #     secretName: {{ .Values.wso2.apk.dp.commonController.configs.tls.secretName | default (printf "%s-common-controller-server-cert" (include "apk-helm.resource.prefix" .)) }}
+        #   {{- else }}
+        #     secretName: {{ template "apk-helm.resource.prefix" . }}-common-controller-server-cert
+        #   {{- end }}
+        #     defaultMode: 420
+        {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
+        - name: prometheus-jmx-config-volume
+          configMap: 
+            name: prometheus-jmx-config-enforcer
+        {{- end }}
+        - name: enforcer-keystore-secret-volume
+          secret: 
+          {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
+            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certificatesSecret | default (printf "%s-enforcer-server-cert" (include "apk-helm.resource.prefix" .)) }}
+          {{- else }}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert
+          {{- end }}
+        - name: log-conf-volume
+          configMap: 
+            name: {{ template "apk-helm.resource.prefix" . }}-log-conf
+        - name: router-keystore-secret-volume
+          secret: 
+            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
+            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certificatesSecret | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
+          {{- else }}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
+          {{- end }}
+        - name: adapter-truststore-secret-volume
+          secret: 
+          {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
+            secretName: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.secretName | default (printf "%s-adapter-server-cert" (include "apk-helm.resource.prefix" .)) }}
+          {{- else }}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-adapter-server-cert
+          {{- end }}
+        - name: enforcer-jwt-secret-volume
+          secret: 
+            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret
+        - name: enforcer-trusted-certs
+          secret: 
+            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
+        - name: enforcer-apikey-cert
+          secret: 
+            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
+        - name: idp-certificate-secret-volume
+          secret:
+          {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.secretName }}
+            secretName: {{ .Values.wso2.apk.idp.signing.secretName }}
+            {{else}}
+            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret
+          {{ end}}
+          {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.secretName }}
+        - name: idp-tls-certificate-secret-volume
+          secret:
+            secretName: {{ .Values.wso2.apk.idp.tls.secretName }}
+          {{ end }}
+        - name: tmp
+          emptyDir: {}
+          {{end}}
+{{- end}}
\ No newline at end of file
diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml b/helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml
new file mode 100644
index 000000000..8abac5ed0
--- /dev/null
+++ b/helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml
@@ -0,0 +1,43 @@
+# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
+#
+# WSO2 LLC. licenses this file to you under the Apache License,
+# Version 2.0 (the "License"); you may not use this file except
+# in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+{{- if .Values.wso2.apk.dp.enabled }}
+{{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs (not .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController) }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "apk-helm.resource.prefix" . }}-gateway-service
+  namespace : {{ .Release.Namespace }}
+{{if and .Values.wso2.apk.dp.gatewayRuntime.service .Values.wso2.apk.dp.gatewayRuntime.service.annotations }}
+  annotations:
+{{ toYaml .Values.wso2.apk.dp.gatewayRuntime.service.annotations | indent 4 }}
+{{ end }}
+spec:
+  type: {{ .Values.wso2.apk.dp.gateway.service.type | default "LoadBalancer" }}
+  # label keys and values that must match in order to receive traffic for this service
+  selector:
+{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 4}}
+  ports:
+{{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
+  - name: "http-endpoint"
+    protocol: TCP
+    port: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080 }}
+{{ end }}
+  - name: "https-endpoint"
+    protocol: TCP
+    port: 9095
+{{- end -}}
+{{- end -}}
\ No newline at end of file
diff --git a/helm-charts/values.yaml b/helm-charts/values.yaml
index d1664f9d0..a1e5e2ac6 100644
--- a/helm-charts/values.yaml
+++ b/helm-charts/values.yaml
@@ -128,7 +128,8 @@ wso2:
           logging:
             level: "DEBG" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
         # #          logFormat: "TEXT" # Values can be "JSON", "TEXT"
-        # configs:
+          configs: 
+            enableGatewayClassController: true
         #   apiNamespaces:
         #     - "apk-v12"
         #   tls:

From 64f9b2a398d0d9ea816855a2f11256be56160940 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Thu, 15 Aug 2024 14:02:41 +0530
Subject: [PATCH 14/40] Honor gatewayClassEnabled flag

---
 adapter/internal/adapter/adapter.go      |  9 +++++++--
 adapter/internal/discovery/xds/server.go | 21 ++++++++++++---------
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 7c46efcd9..36e5952e4 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -39,6 +39,7 @@ import (
 	"github.com/wso2/apk/adapter/pkg/health"
 	healthservice "github.com/wso2/apk/adapter/pkg/health/api/wso2/health/service"
 	"github.com/wso2/apk/adapter/pkg/utils/tlsutils"
+	"github.com/wso2/apk/adapter/internal/operator"
 
 	"context"
 	"flag"
@@ -251,9 +252,13 @@ func Run(conf *config.Config) {
 
 	// Set enforcer startup configs
 	xds.UpdateEnforcerConfig(conf)
+	if !conf.Adapter.EnableGatewayClassController {
+		go operator.InitOperator(conf.Adapter.Metrics)
+	}
 
-	// go operator.InitOperator(conf.Adapter.Metrics)
-	SetupRunners(conf)
+	if conf.Adapter.EnableGatewayClassController {
+		SetupRunners(conf)
+	}
 
 OUTER:
 	for {
diff --git a/adapter/internal/discovery/xds/server.go b/adapter/internal/discovery/xds/server.go
index 310269f82..3f627cefe 100644
--- a/adapter/internal/discovery/xds/server.go
+++ b/adapter/internal/discovery/xds/server.go
@@ -227,16 +227,19 @@ func UpdateXdsCacheOnAPIChange(labels map[string]struct{}) bool {
 	revisionStatus := false
 	// TODO: (VirajSalaka) check possible optimizations, Since the number of labels are low by design it should not be an issue
 	for newLabel := range labels {
-		_, _, _, _, apis := GenerateEnvoyResoucesForGateway(newLabel)
+		listeners, clusters, routes, endpoints, apis := GenerateEnvoyResoucesForGateway(newLabel)
 		UpdateEnforcerApis(newLabel, apis, "")
-		// success := UpdateXdsCacheWithLock(newLabel, endpoints, clusters, routes, listeners)
-		logger.LoggerXds.Debugf("Xds Cache is updated for the label : %v", newLabel)
-		// if success {
-		// 	// if even one label was updated with latest revision, we take the revision as deployed.
-		// 	// (other labels also will get updated successfully)
-		// 	revisionStatus = success
-		// 	continue
-		// }
+		if !config.ReadConfigs().Adapter.EnableGatewayClassController {
+			success := UpdateXdsCacheWithLock(newLabel, endpoints, clusters, routes, listeners)
+			logger.LoggerXds.Debugf("Xds Cache is updated for the label : %v", newLabel)
+			if success {
+				// if even one label was updated with latest revision, we take the revision as deployed.
+				// (other labels also will get updated successfully)
+				revisionStatus = success
+				continue
+			}
+		}
+		
 	}
 	return revisionStatus
 }

From eeb09e2cf937b792cf9c9b89db8859fb8d1171d1 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Fri, 16 Aug 2024 09:43:09 +0530
Subject: [PATCH 15/40] Fix port

---
 adapter/internal/adapter/adapter.go                             | 2 +-
 .../gateway-api/infrastructure/kubernetes/proxy/resource.go     | 2 +-
 adapter/resources/check_health.sh                               | 2 +-
 .../adapter/adapter-grpc-probe-script-conf.yaml                 | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 36e5952e4..8a02b81ed 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -77,7 +77,7 @@ const (
 func init() {
 	flag.BoolVar(&debug, "debug", true, "Use debug logging")
 	flag.BoolVar(&onlyLogging, "onlyLogging", false, "Only demo AccessLogging Service")
-	flag.UintVar(&port, "port", 18001, "Management server port")
+	flag.UintVar(&port, "port", 18000, "Management server port")
 	flag.UintVar(&alsPort, "als", 18090, "Accesslog server port")
 	flag.StringVar(&mode, "ads", ads, "Management server type (ads, xds, rest)")
 }
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 185431064..adec409a2 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -662,7 +662,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: "18001",
+			Value: "18000",
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
diff --git a/adapter/resources/check_health.sh b/adapter/resources/check_health.sh
index 93c56cad5..8d5e18abd 100755
--- a/adapter/resources/check_health.sh
+++ b/adapter/resources/check_health.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 # -----------------------------------------------------------------------
 
-ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
+ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
 ADAPTER_SERVER_NAME="${ADAPTER_SERVER_NAME:-adapter}"
 grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
     -tls \
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
index abecda2fa..9d1d9bde9 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
@@ -38,7 +38,7 @@ data:
     # limitations under the License.
     # -----------------------------------------------------------------------
 
-    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
+    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
     grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
         -tls \
         -tls-ca-cert "${ADAPTER_PUBLIC_CERT_PATH}" \

From b48e6b174c6b6450be1ca9cd5c143b3b3cd763d5 Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Fri, 16 Aug 2024 14:47:05 +0530
Subject: [PATCH 16/40] fix revive errors

---
 adapter/internal/operator/gateway-api/api.go     | 16 ++++++++--------
 .../internal/operator/gateway-api/constants.go   |  4 ++--
 .../gateway-api/provider/kubernetes/indexers.go  |  5 +----
 .../operator/gateway-api/translator/basicauth.go |  5 +----
 .../operator/gateway-api/translator/extauth.go   |  5 +----
 .../operator/gateway-api/translator/oidc.go      |  5 +----
 6 files changed, 14 insertions(+), 26 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/api.go b/adapter/internal/operator/gateway-api/api.go
index 2ae268548..9d2896dfe 100644
--- a/adapter/internal/operator/gateway-api/api.go
+++ b/adapter/internal/operator/gateway-api/api.go
@@ -27,19 +27,19 @@ import (
 
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
-	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	"k8s.io/apimachinery/pkg/types"
+	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 )
 
 func (t *Translator) ProcessAPIs(apis []*dpv1alpha2.API, httpRoutes []*gwapiv1.HTTPRoute, gateways []*GatewayContext, httpRouteContexts []*HTTPRouteContext, resources *Resources, xdsIR XdsIRMap) {
 	for _, api := range apis {
 		// For each API find all the related httproutes. If not found any continue.
-		routeNamespacedNames := make([]string,0) 
+		routeNamespacedNames := make([]string, 0)
 		for _, httpRouteProds := range api.Spec.Production {
 			for _, httpRouteRef := range httpRouteProds.RouteRefs {
 				routeNamespacedNames = append(routeNamespacedNames, types.NamespacedName{
 					Namespace: api.GetNamespace(),
-					Name: httpRouteRef,
+					Name:      httpRouteRef,
 				}.String())
 			}
 		}
@@ -47,7 +47,7 @@ func (t *Translator) ProcessAPIs(apis []*dpv1alpha2.API, httpRoutes []*gwapiv1.H
 			for _, httpRouteRef := range httpRouteSands.RouteRefs {
 				routeNamespacedNames = append(routeNamespacedNames, types.NamespacedName{
 					Namespace: api.GetNamespace(),
-					Name: httpRouteRef,
+					Name:      httpRouteRef,
 				}.String())
 			}
 		}
@@ -77,20 +77,20 @@ func (t *Translator) ProcessAPIs(apis []*dpv1alpha2.API, httpRoutes []*gwapiv1.H
 				}
 			}
 		}
-		
+
 	}
 }
 
 func buildExtAuth() *ir.ExtAuth {
 	grpcExtAuthService := ir.GRPCExtAuthService{
 		Destination: ir.RouteDestination{
-			Name: EXT_AUTH_CLUSTER_NAME,
+			Name: ExtAuthClusterName,
 		},
 	}
 	flag := true
 	extAuth := &ir.ExtAuth{
-		Name: EXT_AUTH_NAME,
-		GRPC: &grpcExtAuthService,
+		Name:                ExtAuthName,
+		GRPC:                &grpcExtAuthService,
 		UseBootstrapCluster: &flag,
 	}
 	return extAuth
diff --git a/adapter/internal/operator/gateway-api/constants.go b/adapter/internal/operator/gateway-api/constants.go
index 7d1ec6742..7617aa44b 100644
--- a/adapter/internal/operator/gateway-api/constants.go
+++ b/adapter/internal/operator/gateway-api/constants.go
@@ -1,4 +1,4 @@
 package gatewayapi
 
-const EXT_AUTH_CLUSTER_NAME = "ext-authz"
-const EXT_AUTH_NAME = "ext-authz"
\ No newline at end of file
+const ExtAuthClusterName = "ext-authz"
+const ExtAuthName = "ext-authz"
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
index 578170f32..c66b31b9e 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/indexers.go
@@ -89,10 +89,7 @@ func addHTTPRouteIndexers(ctx context.Context, mgr manager.Manager) error {
 //   - For Service, ServiceImports objects that are referenced in HTTPRoute objects via `.spec.rules.backendRefs`.
 //     This helps in querying for HTTPRoutes that are affected by a particular Service CRUD.
 func addAPIIndexers(ctx context.Context, mgr manager.Manager) error {
-	if err := mgr.GetFieldIndexer().IndexField(ctx, &dpv1alpha2.API{}, httpRouteAPIIndex, httpRouteAPIIndexFunc); err != nil {
-		return err
-	}
-	return nil
+	return mgr.GetFieldIndexer().IndexField(ctx, &dpv1alpha2.API{}, httpRouteAPIIndex, httpRouteAPIIndexFunc)
 }
 
 func gatewayHTTPRouteIndexFunc(rawObj client.Object) []string {
diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
index 4d88a2790..67fbe0b24 100644
--- a/adapter/internal/operator/gateway-api/translator/basicauth.go
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -146,8 +146,5 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 		return nil
 	}
 	filterName := basicAuthFilterName(irRoute)
-	if err := enableFilterOnRoute(route, filterName); err != nil {
-		return err
-	}
-	return nil
+	return enableFilterOnRoute(route, filterName)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index 1cc8b47e7..d658ee555 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -320,8 +320,5 @@ func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		return nil
 	}
 	// filterName := extAuthFilterName(irRoute.ExtAuth)
-	if err := enableExtAuthFilterOnRoute(route, extAuthFilter); err != nil {
-		return err
-	}
-	return nil
+	return enableExtAuthFilterOnRoute(route, extAuthFilter)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
index 07265ef72..434e91f6e 100644
--- a/adapter/internal/operator/gateway-api/translator/oidc.go
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -357,10 +357,7 @@ func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	}
 
 	filterName := oauth2FilterName(irRoute)
-	if err := enableFilterOnRoute(route, filterName); err != nil {
-		return err
-	}
-	return nil
+	return enableFilterOnRoute(route, filterName)
 }
 
 // buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle

From 052aff8489d2c46fb7c66f2f36f3888e3efe65ea Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Fri, 16 Aug 2024 15:41:56 +0530
Subject: [PATCH 17/40] Revert "Fix port"

This reverts commit 91412f915c049468f58591c49f555298935e16b2.
---
 adapter/internal/adapter/adapter.go                             | 2 +-
 .../gateway-api/infrastructure/kubernetes/proxy/resource.go     | 2 +-
 adapter/resources/check_health.sh                               | 2 +-
 .../adapter/adapter-grpc-probe-script-conf.yaml                 | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 8a02b81ed..36e5952e4 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -77,7 +77,7 @@ const (
 func init() {
 	flag.BoolVar(&debug, "debug", true, "Use debug logging")
 	flag.BoolVar(&onlyLogging, "onlyLogging", false, "Only demo AccessLogging Service")
-	flag.UintVar(&port, "port", 18000, "Management server port")
+	flag.UintVar(&port, "port", 18001, "Management server port")
 	flag.UintVar(&alsPort, "als", 18090, "Accesslog server port")
 	flag.StringVar(&mode, "ads", ads, "Management server type (ads, xds, rest)")
 }
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index adec409a2..185431064 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -662,7 +662,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: "18000",
+			Value: "18001",
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
diff --git a/adapter/resources/check_health.sh b/adapter/resources/check_health.sh
index 8d5e18abd..93c56cad5 100755
--- a/adapter/resources/check_health.sh
+++ b/adapter/resources/check_health.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 # -----------------------------------------------------------------------
 
-ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
 ADAPTER_SERVER_NAME="${ADAPTER_SERVER_NAME:-adapter}"
 grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
     -tls \
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
index 9d1d9bde9..abecda2fa 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
@@ -38,7 +38,7 @@ data:
     # limitations under the License.
     # -----------------------------------------------------------------------
 
-    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
+    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
     grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
         -tls \
         -tls-ca-cert "${ADAPTER_PUBLIC_CERT_PATH}" \

From 3b6dad860bf690831b84535ea7233a8faf315a8a Mon Sep 17 00:00:00 2001
From: Tharsanan1 <tharsanan.15@cse.mrt.ac.lk>
Date: Fri, 16 Aug 2024 15:54:28 +0530
Subject: [PATCH 18/40] Fix unit test failures

---
 .../gateway-api/translator/basicauth.go       |  3 +-
 .../gateway-api/translator/extauth.go         | 90 ++++++++++++-------
 .../operator/gateway-api/translator/oidc.go   |  5 +-
 .../operator/gateway-api/translator/utils.go  | 13 ++-
 4 files changed, 70 insertions(+), 41 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
index 67fbe0b24..5fd4932f9 100644
--- a/adapter/internal/operator/gateway-api/translator/basicauth.go
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -145,6 +145,5 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 	if irRoute.BasicAuth == nil {
 		return nil
 	}
-	filterName := basicAuthFilterName(irRoute)
-	return enableFilterOnRoute(route, filterName)
+	return enableFilterOnRoute(basicAuthFilter, route, irRoute)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index d658ee555..f664ff506 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -71,14 +71,7 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 			continue
 		}
 
-		// Only generates one OAuth2 Envoy filter for each unique name.
-		// For example, if there are two routes under the same gateway with the
-		// same OIDC config, only one OAuth2 filter will be generated.
-		if hcmContainsFilter(mgr, extAuthFilterName(route.ExtAuth)) {
-			continue
-		}
-
-		filter, err := buildHCMExtAuthFilter(route.ExtAuth)
+		filter, err := buildHCMExtAuthFilter(route)
 		if err != nil {
 			errs = errors.Join(errs, err)
 			continue
@@ -91,8 +84,8 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 }
 
 // buildHCMExtAuthFilter returns an ext_authz HTTP filter from the provided IR HTTPRoute.
-func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
-	extAuthProto := extAuthConfig(extAuth)
+func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
+	extAuthProto := extAuthConfig(route.ExtAuth)
 	if err := extAuthProto.ValidateAll(); err != nil {
 		return nil, err
 	}
@@ -103,29 +96,72 @@ func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name:     extAuthFilterName(extAuth),
-		// TODO make it false after fixing the ext auth
-		Disabled: true,   
+		Name:     extAuthFilterName(route),
+		Disabled: true,
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
 		},
-
 	}, nil
 }
 
-func extAuthFilterName(extAuth *ir.ExtAuth) string {
-	return perRouteFilterName(extAuthFilter, extAuth.Name)
+func extAuthFilterName(route *ir.HTTPRoute) string {
+	return perRouteFilterName(extAuthFilter, route.Name)
 }
 
 func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
+	if extAuth.UseBootstrapCluster != nil && *extAuth.UseBootstrapCluster {
+		config := &extauthv3.ExtAuthz{
+			TransportApiVersion: corev3.ApiVersion_V3,
+			FailureModeAllow:    false,
+			ClearRouteCache: true,
+			IncludePeerCertificate: true,
+			WithRequestBody: &extauthv3.BufferSettings{
+				MaxRequestBytes: 102400,
+			},
+		}
+
+		var headersToExtAuth []*matcherv3.StringMatcher
+		for _, header := range extAuth.HeadersToExtAuth {
+			headersToExtAuth = append(headersToExtAuth, &matcherv3.StringMatcher{
+				MatchPattern: &matcherv3.StringMatcher_Exact{
+					Exact: header,
+				},
+			})
+		}
+
+		if len(headersToExtAuth) > 0 {
+			config.AllowedHeaders = &matcherv3.ListStringMatcher{
+				Patterns: headersToExtAuth,
+			}
+		}
+
+		if extAuth.HTTP != nil {
+			config.Services = &extauthv3.ExtAuthz_HttpService{
+				HttpService: httpService(extAuth.HTTP),
+			}
+		} else if extAuth.GRPC != nil {
+			config.Services = &extauthv3.ExtAuthz_GrpcService{
+				GrpcService: &corev3.GrpcService{
+					TargetSpecifier: &corev3.GrpcService_EnvoyGrpc_{
+						EnvoyGrpc: grpcService(extAuth.GRPC),
+					},
+					Timeout: &duration.Duration{
+						Seconds: defaultExtServiceRequestTimeout,
+					},	
+					InitialMetadata: []*corev3.HeaderValue{
+						&corev3.HeaderValue{
+							Key: "x-request-id",
+							Value: "%REQ(x-request-id)%",
+						},
+					},
+				},
+			}
+		}
+		return config
+	}
 	config := &extauthv3.ExtAuthz{
 		TransportApiVersion: corev3.ApiVersion_V3,
 		FailureModeAllow:    false,
-		ClearRouteCache: true,
-		IncludePeerCertificate: true,
-		WithRequestBody: &extauthv3.BufferSettings{
-			MaxRequestBytes: 102400,
-		},
 	}
 
 	var headersToExtAuth []*matcherv3.StringMatcher
@@ -136,13 +172,11 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 			},
 		})
 	}
-
 	if len(headersToExtAuth) > 0 {
 		config.AllowedHeaders = &matcherv3.ListStringMatcher{
 			Patterns: headersToExtAuth,
 		}
 	}
-
 	if extAuth.HTTP != nil {
 		config.Services = &extauthv3.ExtAuthz_HttpService{
 			HttpService: httpService(extAuth.HTTP),
@@ -156,16 +190,9 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 				Timeout: &duration.Duration{
 					Seconds: defaultExtServiceRequestTimeout,
 				},	
-				InitialMetadata: []*corev3.HeaderValue{
-					&corev3.HeaderValue{
-						Key: "x-request-id",
-						Value: "%REQ(x-request-id)%",
-					},
-				},
 			},
 		}
 	}
-
 	return config
 }
 
@@ -319,6 +346,5 @@ func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	if irRoute.ExtAuth == nil {
 		return nil
 	}
-	// filterName := extAuthFilterName(irRoute.ExtAuth)
-	return enableExtAuthFilterOnRoute(route, extAuthFilter)
+	return enableFilterOnRoute(extAuthFilter, route, irRoute)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
index 434e91f6e..08d87017f 100644
--- a/adapter/internal/operator/gateway-api/translator/oidc.go
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -112,7 +112,7 @@ func buildHCMOAuth2Filter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
 }
 
 func oauth2FilterName(route *ir.HTTPRoute) string {
-	return perRouteFilterName(oauth2Filter, route.Name)
+	return fmt.Sprintf("%s_%s", oauth2Filter, route.Name)
 }
 
 func oauth2Config(route *ir.HTTPRoute) (*oauth2v3.OAuth2, error) {
@@ -356,8 +356,7 @@ func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		return nil
 	}
 
-	filterName := oauth2FilterName(irRoute)
-	return enableFilterOnRoute(route, filterName)
+	return enableFilterOnRoute(oauth2Filter, route, irRoute)
 }
 
 // buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle
diff --git a/adapter/internal/operator/gateway-api/translator/utils.go b/adapter/internal/operator/gateway-api/translator/utils.go
index 83b0b7b41..b68619bb7 100644
--- a/adapter/internal/operator/gateway-api/translator/utils.go
+++ b/adapter/internal/operator/gateway-api/translator/utils.go
@@ -29,7 +29,7 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
-
+  "github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	extAuthService "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
 	"google.golang.org/protobuf/types/known/anypb"
@@ -110,18 +110,21 @@ func clusterName(host string, port uint32) string {
 	return fmt.Sprintf("%s_%d", strings.ReplaceAll(host, ".", "_"), port)
 }
 
-// enableFilterOnRoute enables a filterType on the provided route.
-func enableFilterOnRoute(route *routev3.Route, filterName string) error {
+func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	if route == nil {
 		return errors.New("xds route is nil")
 	}
+	if irRoute == nil {
+		return errors.New("ir route is nil")
+	}
 
+	filterName := perRouteFilterName(filterType, irRoute.Name)
 	filterCfg := route.GetTypedPerFilterConfig()
 	if _, ok := filterCfg[filterName]; ok {
 		// This should not happen since this is the only place where the filter
 		// config is added in a route.
 		return fmt.Errorf("route already contains filter config: %s, %+v",
-			filterName, route)
+			filterType, route)
 	}
 
 	// Enable the corresponding filter for this route.
@@ -131,9 +134,11 @@ func enableFilterOnRoute(route *routev3.Route, filterName string) error {
 	if err != nil {
 		return err
 	}
+
 	if filterCfg == nil {
 		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
 	}
+
 	route.TypedPerFilterConfig[filterName] = routeCfgAny
 	return nil
 }

From 26880e22d8c1d8822fd9b521921196d69dea2dc4 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 23 Aug 2024 15:23:30 +0530
Subject: [PATCH 19/40] add config for config.toml vol

---
 adapter/config/default_config.go                              | 1 +
 adapter/config/types.go                                       | 1 +
 .../gateway-api/infrastructure/kubernetes/proxy/resource.go   | 4 ++--
 .../templates/data-plane/gateway-components/log-conf.yaml     | 1 +
 4 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index 8ed335bad..d0231c692 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -302,6 +302,7 @@ var defaultConfig = &Config{
 				EnforcerTrustedCerts:              "",
 				EnforcerApikeyCert:                "",
 				IDPCertificateSecretVolume:        "",
+				LogConfVolume:                     "",
 			},
 		},
 	},
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 2f062414d..c068234d5 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -356,6 +356,7 @@ type volumes struct {
 	EnforcerTrustedCerts              string
 	EnforcerApikeyCert                string
 	IDPCertificateSecretVolume        string
+	LogConfVolume                     string
 }
 
 // Metrics defines the configuration for metrics collection.
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 185431064..58d723bb0 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -525,7 +525,7 @@ func expectedDeploymentVolumes(deploymentSpec *egv1a1.KubernetesDeploymentSpec)
 				ConfigMap: &corev1.ConfigMapVolumeSource{
 					DefaultMode: ptr.To[int32](420),
 					LocalObjectReference: corev1.LocalObjectReference{
-						Name: "apk-test-wso2-apk-log-conf",
+						Name: conf.Deployment.Gateway.Volumes.LogConfVolume,
 					},
 				},
 			},
@@ -662,7 +662,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: "18001",
+			Value: conf.Deployment.Gateway.AdapterXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index eebbbe8a0..d7252ea38 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -33,6 +33,7 @@ data:
       enforcerTrustedCerts = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
       enforcerApikeyCert = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
       iDPCertificateSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret"
+      LogConfVolume = "{{ template "apk-helm.resource.prefix" . }}-log-conf"
 
     [adapter]
       {{- if and .Values.wso2.apk.dp.environment .Values.wso2.apk.dp.environment.name }}

From 64c6d616aeb5b19aaf6283aef3a2dddbc86b5acb Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 23 Aug 2024 15:23:59 +0530
Subject: [PATCH 20/40] add backend support

---
 .../gateway-api/bootstrap/bootstrap.yaml.tpl  |  3 +-
 .../provider/kubernetes/controller.go         | 13 +++++--
 .../provider/kubernetes/predicates.go         | 35 ++++++++++++++++++-
 .../operator/gateway-api/translator.go        |  1 +
 .../internal/operator/gateway-api/validate.go | 12 +++++--
 5 files changed, 57 insertions(+), 7 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
index 30fa27815..70815a8a4 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.yaml.tpl
@@ -146,7 +146,7 @@ static_resources:
           validation_context:
             trusted_ca:
               filename: '/home/wso2/security/truststore/adapter.crt'
-              - name: ext-authz
+  - name: ext-authz
     type: STRICT_DNS
     connect_timeout: 20s
     typed_extension_protocol_options:
@@ -179,4 +179,3 @@ static_resources:
                   socket_address:
                     address: 127.0.0.1
                     port_value: 8081
-                      
\ No newline at end of file
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index f0cdff74d..ec48f5d0b 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -40,6 +40,7 @@ import (
 	"github.com/wso2/apk/adapter/internal/operator/status"
 	"github.com/wso2/apk/adapter/internal/operator/utils"
 	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	discoveryv1 "k8s.io/api/discovery/v1"
 	k8errors "k8s.io/apimachinery/pkg/api/errors"
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -52,7 +53,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/source"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
 	gwapiv1b1 "sigs.k8s.io/gateway-api/apis/v1beta1"
-	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 )
 
 type gatewayReconcilerNew struct {
@@ -492,6 +492,16 @@ func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.M
 		return err
 	}
 
+	// Watch Service CRUDs and process affected *Route objects and services belongs to gateways
+	backendPredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateBackendForReconcile)}
+	if err := c.Watch(
+		source.Kind(mgr.GetCache(), &dpv1alpha1.Backend{}),
+		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
+		backendPredicates...,
+	); err != nil {
+		return err
+	}
+
 	// serviceImportCRDExists := r.serviceImportCRDExists(mgr)
 	// if !serviceImportCRDExists {
 	// 	loggers.LoggerAPKOperator.Info("ServiceImport CRD not found, skipping ServiceImport watch")
@@ -629,7 +639,6 @@ func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.M
 	// 	loggers.LoggerAPKOperator.Info("Watching additional resource", "resource", gvk.String())
 	// }
 
-	
 	return nil
 }
 
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
index 91a523564..c1a4c5bcb 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -25,6 +25,7 @@ import (
 	"github.com/wso2/apk/adapter/internal/loggers"
 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
 	"github.com/wso2/apk/adapter/internal/operator/utils"
+	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	corev1 "k8s.io/api/core/v1"
 	k8errors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/fields"
@@ -99,6 +100,20 @@ func (r *gatewayReconcilerNew) validateServiceForReconcile(obj client.Object) bo
 	}
 
 	nsName := utils.NamespacedName(svc)
+	return r.isRouteReferencingService(&nsName)
+
+}
+
+// validateBackendForReconcile tries finding the owning Gateway of the Service
+// if it exists, finds the Gateway's Deployment, and further updates the Gateway
+// status Ready condition. All Services are pushed for reconciliation.
+func (r *gatewayReconcilerNew) validateBackendForReconcile(obj client.Object) bool {
+	backend, ok := obj.(*dpv1alpha1.Backend)
+	if !ok {
+		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation for object", obj)
+		return false
+	}
+	nsName := utils.NamespacedName(backend)
 	return r.isRouteReferencingBackend(&nsName)
 
 }
@@ -124,13 +139,31 @@ func (r *gatewayReconcilerNew) findOwningGateway(ctx context.Context, labels map
 	return gtw
 }
 
+// isRouteReferencingService returns true if the backend(service and serviceImport) is referenced by any of the xRoutes
+// in the system, else returns false.
+func (r *gatewayReconcilerNew) isRouteReferencingService(nsName *types.NamespacedName) bool {
+	ctx := context.Background()
+	httpRouteList := &gwapiv1.HTTPRouteList{}
+	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
+		FieldSelector: fields.OneTermEqualSelector(serviceHTTPRouteIndex, nsName.String()),
+	}); err != nil {
+		loggers.LoggerAPKOperator.Error("unable to find associated HTTPRoutes for the service ", err)
+		return false
+	}
+
+	// Check how many Route objects refer this Backend
+	allAssociatedRoutes := len(httpRouteList.Items)
+
+	return allAssociatedRoutes != 0
+}
+
 // isRouteReferencingBackend returns true if the backend(service and serviceImport) is referenced by any of the xRoutes
 // in the system, else returns false.
 func (r *gatewayReconcilerNew) isRouteReferencingBackend(nsName *types.NamespacedName) bool {
 	ctx := context.Background()
 	httpRouteList := &gwapiv1.HTTPRouteList{}
 	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
-		FieldSelector: fields.OneTermEqualSelector(serviceHTTPRouteIndex, nsName.String()),
+		FieldSelector: fields.OneTermEqualSelector(backendHTTPRouteIndex, nsName.String()),
 	}); err != nil {
 		loggers.LoggerAPKOperator.Error("unable to find associated HTTPRoutes for the service ", err)
 		return false
diff --git a/adapter/internal/operator/gateway-api/translator.go b/adapter/internal/operator/gateway-api/translator.go
index 4fd2cfe3e..138991ba5 100644
--- a/adapter/internal/operator/gateway-api/translator.go
+++ b/adapter/internal/operator/gateway-api/translator.go
@@ -45,6 +45,7 @@ const (
 	KindSecret           = "Secret"
 	KindBackend          = "Backend"
 
+	DpGroupName              = "dp.wso2.com"
 	GroupMultiClusterService = "multicluster.x-k8s.io"
 	// OwningGatewayNamespaceLabel is the owner reference label used for managed infra.
 	// The value should be the namespace of the accepted Envoy Gateway.
diff --git a/adapter/internal/operator/gateway-api/validate.go b/adapter/internal/operator/gateway-api/validate.go
index 56f13a2c5..7f771bf47 100644
--- a/adapter/internal/operator/gateway-api/validate.go
+++ b/adapter/internal/operator/gateway-api/validate.go
@@ -71,6 +71,10 @@ func (t *Translator) validateBackendRef(backendRefContext BackendRefContext, par
 }
 
 func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Kind != nil && backendRef.Group != nil && *backendRef.Kind == KindBackend && *backendRef.Group == DpGroupName {
+		return true
+	}
+
 	if backendRef.Group != nil && *backendRef.Group != "" && *backendRef.Group != GroupMultiClusterService {
 		parentRef.SetCondition(route,
 			gwapiv1.RouteConditionResolvedRefs,
@@ -84,12 +88,13 @@ func (t *Translator) validateBackendRefGroup(backendRef *gwapiv1a2.BackendRef, p
 }
 
 func (t *Translator) validateBackendRefKind(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
-	if backendRef.Kind != nil && *backendRef.Kind != KindService && *backendRef.Kind != KindServiceImport {
+	if backendRef.Kind != nil && *backendRef.Kind != KindService && *backendRef.Kind != KindServiceImport &&
+		*backendRef.Kind != KindBackend {
 		parentRef.SetCondition(route,
 			gwapiv1.RouteConditionResolvedRefs,
 			metav1.ConditionFalse,
 			gwapiv1.RouteReasonInvalidKind,
-			"Kind is invalid, only Service and MCS ServiceImport are supported",
+			"Kind is invalid, only Service, Backend and MCS ServiceImport are supported",
 		)
 		return false
 	}
@@ -152,6 +157,9 @@ func (t *Translator) validateBackendNamespace(backendRef *gwapiv1a2.BackendRef,
 }
 
 func (t *Translator) validateBackendPort(backendRef *gwapiv1a2.BackendRef, parentRef *RouteParentContext, route RouteContext) bool {
+	if backendRef.Kind != nil && *backendRef.Kind == KindBackend {
+		return true
+	}
 	if backendRef.Port == nil {
 		parentRef.SetCondition(route,
 			gwapiv1.RouteConditionResolvedRefs,

From b73defb4fce7cda4966e6b201adaebd34cc96ee1 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 23 Aug 2024 15:24:26 +0530
Subject: [PATCH 21/40] fix gatewaylevel intercepter

---
 adapter/internal/oasparser/envoyconf/listener.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/adapter/internal/oasparser/envoyconf/listener.go b/adapter/internal/oasparser/envoyconf/listener.go
index 493550539..a7fba0c27 100644
--- a/adapter/internal/oasparser/envoyconf/listener.go
+++ b/adapter/internal/oasparser/envoyconf/listener.go
@@ -99,7 +99,7 @@ func CreateListenerByGateway(gateway *gwapiv1.Gateway, resolvedListenerCerts map
 			var filterChains []*listenerv3.FilterChain
 
 			for _, listenerObj := range listeners {
-				if listenerObj.Name == "gatewaylistener" {
+				if listenerObj.Name == "httpslistener" {
 					httpFilters = getHTTPFilters(gwLuaScript)
 				} else {
 					httpFilters = getHTTPFilters(`

From 35286dd43f91a9ee6f9a42df0ef497bcbeed08e7 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 23 Aug 2024 15:24:59 +0530
Subject: [PATCH 22/40] fix bugs in gateway cr

---
 .../gateway-components/adapter/gateway.yaml   | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/gateway.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/gateway.yaml
index eab8debfc..522e76107 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/gateway.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/gateway.yaml
@@ -21,6 +21,21 @@ spec:
     {{ end }}
     {{- if .Values.wso2.apk.dp.enabled }}
     - name: httpslistener
+      hostname: "*.{{ .Values.wso2.apk.dp.gateway.listener.hostname }}"
+      port: 9095
+      protocol: "HTTPS"
+      allowedRoutes:
+        namespaces: 
+          from: "All"
+      tls:  
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            group: ""
+            name: {{ .Values.wso2.apk.dp.gateway.listener.secretName | default (printf "%s-gw-listener-cert" (include "apk-helm.resource.prefix" .)) }}
+            namespace: {{ .Release.Namespace }}
+    {{ end }}
+    - name: apilistener
       hostname: "{{ .Values.wso2.apk.listener.hostname | default "api.am.wso2.com"}}"
       port: 9095
       protocol: "HTTPS"
@@ -46,18 +61,6 @@ spec:
             namespace: {{ .Release.Namespace }}
     {{ end }}
     {{ if .Values.wso2.apk.dp.enabled }}
-    - name: gatewaylistener
-      hostname: "*.{{ .Values.wso2.apk.dp.gateway.listener.hostname }}"
-      port: 9095
-      protocol: "HTTPS"
-      tls:  
-        mode: Terminate
-        certificateRefs:
-          - kind: Secret
-            group: ""
-            name: {{ .Values.wso2.apk.dp.gateway.listener.secretName | default (printf "%s-gw-listener-cert" (include "apk-helm.resource.prefix" .)) }}
-            namespace: {{ .Release.Namespace }}
-    {{ end }}
     - name: systemlistener
       hostname: "localhost"
       port: 9095

From c1a2eb7668e727fdfa03b4d3ebd68101fec7fc39 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 26 Aug 2024 13:02:52 +0530
Subject: [PATCH 23/40] Establish adapter enforcer xds connection

---
 adapter/config/default_config.go                      |  3 ++-
 adapter/config/types.go                               |  4 +++-
 .../operator/gateway-api/bootstrap/bootstrap.go       |  2 +-
 .../infrastructure/kubernetes/proxy/resource.go       |  4 ++--
 .../kubernetes/proxy/resource_provider.go             | 11 +++++++++++
 .../operator/gateway-api/xds/runner/runner.go         |  4 ++--
 .../operator/gateway-api/xds/runner/runner_test.go    |  2 +-
 .../data-plane/gateway-components/log-conf.yaml       |  3 ++-
 8 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index d0231c692..887958c60 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -285,7 +285,8 @@ var defaultConfig = &Config{
 			EnforcerPublicCertPath:   "/home/wso2/security/keystore/enforcer.crt",
 			EnforcerServerName:       "",
 			AdapterTrustedCAPath:     "/home/wso2/security/truststore",
-			AdapterXDSPort:           "18000",
+			AdapterEnvoyXDSPort:      "18000",
+			AdapterEnforcerXDSPort:   "18001",
 			CommonControllerXDSPort:  "18002",
 			CommonControllerRestPort: "18003",
 			EnforcerLabel:            "wso2-apk-default",
diff --git a/adapter/config/types.go b/adapter/config/types.go
index c068234d5..733bdefd8 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -330,7 +330,8 @@ type gateway struct {
 	EnforcerPublicCertPath   string
 	EnforcerServerName       string
 	AdapterTrustedCAPath     string
-	AdapterXDSPort           string
+	AdapterEnvoyXDSPort      string
+	AdapterEnforcerXDSPort   string
 	CommonControllerXDSPort  string
 	CommonControllerRestPort string
 	EnforcerLabel            string
@@ -345,6 +346,7 @@ type gateway struct {
 type enforcerPorts struct {
 	Name          string
 	ContainerPort int32
+	Expose        bool
 }
 
 type volumes struct {
diff --git a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
index 1e51b63e1..4e0b3fbec 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
+++ b/adapter/internal/operator/gateway-api/bootstrap/bootstrap.go
@@ -190,7 +190,7 @@ func GetRenderedBootstrapConfig(proxyMetrics *egv1a1.ProxyMetrics) (string, erro
 		}
 	}
 	conf := config.ReadConfigs()
-	xdsport, _ := strconv.Atoi(conf.Deployment.Gateway.AdapterXDSPort)
+	xdsport, _ := strconv.Atoi(conf.Deployment.Gateway.AdapterEnvoyXDSPort)
 	cfg := &bootstrapConfig{
 		parameters: bootstrapParameters{
 			XdsServer: xdsServerParameters{
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 58d723bb0..631f4f357 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -662,7 +662,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "ADAPTER_XDS_PORT",
-			Value: conf.Deployment.Gateway.AdapterXDSPort,
+			Value: conf.Deployment.Gateway.AdapterEnforcerXDSPort,
 		},
 		{
 			Name:  "COMMON_CONTROLLER_XDS_PORT",
@@ -690,7 +690,7 @@ func expectedEnforcerEnv(containerSpec *egv1a1.KubernetesContainerSpec) []corev1
 		},
 		{
 			Name:  "JAVA_OPTS",
-			Value: "-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5006 -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2",
+			Value: conf.Deployment.Gateway.JavaOpts,
 		},
 	}
 
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
index e54df5e0b..74cc8b848 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -34,6 +34,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/utils/ptr"
 
+	"github.com/wso2/apk/adapter/config"
 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/bootstrap"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/infrastructure/kubernetes/resource"
@@ -114,6 +115,16 @@ func (r *ResourceRender) Service() (*corev1.Service, error) {
 		}
 	}
 
+	for _, port := range config.ReadConfigs().Deployment.Gateway.EnforcerPorts {
+		p := corev1.ServicePort{
+			Name:       ExpectedResourceHashedName(port.Name),
+			Protocol:   corev1.ProtocolTCP,
+			Port:       port.ContainerPort,
+			TargetPort: intstr.IntOrString{IntVal: port.ContainerPort},
+		}
+		ports = append(ports, p)
+	}
+
 	// Set the labels based on the owning gatewayclass name.
 	labels := envoyLabels(r.infra.GetProxyMetadata().Labels)
 	if OwningGatewayLabelsAbsent(labels) {
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner.go b/adapter/internal/operator/gateway-api/xds/runner/runner.go
index bcb9f7003..d47b959a0 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner.go
@@ -106,10 +106,10 @@ func (r *Runner) Start(ctx context.Context) (err error) {
 
 func (r *Runner) serveXdsServer(ctx context.Context) {
 	conf := config.ReadConfigs()
-	addr := net.JoinHostPort(XdsServerAddress, conf.Deployment.Gateway.AdapterXDSPort)
+	addr := net.JoinHostPort(XdsServerAddress, conf.Deployment.Gateway.AdapterEnvoyXDSPort)
 	l, err := net.Listen("tcp", addr)
 	if err != nil {
-		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", conf.Deployment.Gateway.AdapterXDSPort)
+		loggers.LoggerAPKOperator.Error(err, "failed to listen on port", "address", conf.Deployment.Gateway.AdapterEnvoyXDSPort)
 		return
 	}
 
diff --git a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
index ea2929d53..8c2f0d5a6 100644
--- a/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
+++ b/adapter/internal/operator/gateway-api/xds/runner/runner_test.go
@@ -191,7 +191,7 @@ func peekError(conn net.Conn) error {
 func TestServeXdsServerListenFailed(t *testing.T) {
 	conf := config.ReadConfigs()
 	// Occupy the address to make listening failed
-	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterXDSPort))
+	l, err := net.Listen("tcp", fmt.Sprintf(":%s", conf.Deployment.Gateway.AdapterEnvoyXDSPort))
 	require.NoError(t, err)
 	defer l.Close()
 
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index d7252ea38..7684d975e 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -20,7 +20,8 @@ data:
       {{- range .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.ports}}
       [[deployment.gateway.enforcerPorts]]
         name = "{{ .name }}"
-        containerPort = {{ .value }}     
+        containerPort = {{ .value }} 
+        expose = {{ .expose | default false }}    
       {{- end }} 
       {{- end }} 
 

From 4918a5cc17401fff365f16cccf356de36236b9c7 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Wed, 28 Aug 2024 14:07:17 +0530
Subject: [PATCH 24/40] add ext_authz route filter with metadata

---
 .../gateway-api/translator/basicauth.go       |  2 +-
 .../gateway-api/translator/extauth.go         | 38 +++++----
 .../operator/gateway-api/translator/oidc.go   |  2 +-
 .../operator/gateway-api/translator/route.go  | 18 ++--
 .../operator/gateway-api/translator/utils.go  | 84 +++++--------------
 5 files changed, 56 insertions(+), 88 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/translator/basicauth.go b/adapter/internal/operator/gateway-api/translator/basicauth.go
index 5fd4932f9..7f2862e50 100644
--- a/adapter/internal/operator/gateway-api/translator/basicauth.go
+++ b/adapter/internal/operator/gateway-api/translator/basicauth.go
@@ -145,5 +145,5 @@ func (*basicAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error
 	if irRoute.BasicAuth == nil {
 		return nil
 	}
-	return enableFilterOnRoute(basicAuthFilter, route, irRoute)
+	return enableFilterOnRoute(basicAuthFilter, basicAuthFilterName(irRoute), route)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index f664ff506..58cfbb99b 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -70,8 +70,14 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 		if !routeContainsExtAuth(route) {
 			continue
 		}
+		// Only generates one OAuth2 Envoy filter for each unique name.
+		// For example, if there are two routes under the same gateway with the
+		// same OIDC config, only one OAuth2 filter will be generated.
+		if hcmContainsFilter(mgr, extAuthFilterName(route.ExtAuth)) {
+			continue
+		}
 
-		filter, err := buildHCMExtAuthFilter(route)
+		filter, err := buildHCMExtAuthFilter(route.ExtAuth)
 		if err != nil {
 			errs = errors.Join(errs, err)
 			continue
@@ -84,8 +90,8 @@ func (*extAuth) patchHCM(mgr *hcmv3.HttpConnectionManager, irListener *ir.HTTPLi
 }
 
 // buildHCMExtAuthFilter returns an ext_authz HTTP filter from the provided IR HTTPRoute.
-func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
-	extAuthProto := extAuthConfig(route.ExtAuth)
+func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
+	extAuthProto := extAuthConfig(extAuth)
 	if err := extAuthProto.ValidateAll(); err != nil {
 		return nil, err
 	}
@@ -96,24 +102,24 @@ func buildHCMExtAuthFilter(route *ir.HTTPRoute) (*hcmv3.HttpFilter, error) {
 	}
 
 	return &hcmv3.HttpFilter{
-		Name:     extAuthFilterName(route),
-		Disabled: true,
+		Name:     extAuthFilterName(extAuth),
+		Disabled: false,
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
 		},
 	}, nil
 }
 
-func extAuthFilterName(route *ir.HTTPRoute) string {
-	return perRouteFilterName(extAuthFilter, route.Name)
+func extAuthFilterName(extAuth *ir.ExtAuth) string {
+	return perRouteFilterName(extAuthFilter, extAuth.Name)
 }
 
 func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 	if extAuth.UseBootstrapCluster != nil && *extAuth.UseBootstrapCluster {
 		config := &extauthv3.ExtAuthz{
-			TransportApiVersion: corev3.ApiVersion_V3,
-			FailureModeAllow:    false,
-			ClearRouteCache: true,
+			TransportApiVersion:    corev3.ApiVersion_V3,
+			FailureModeAllow:       false,
+			ClearRouteCache:        true,
 			IncludePeerCertificate: true,
 			WithRequestBody: &extauthv3.BufferSettings{
 				MaxRequestBytes: 102400,
@@ -147,10 +153,10 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 					},
 					Timeout: &duration.Duration{
 						Seconds: defaultExtServiceRequestTimeout,
-					},	
+					},
 					InitialMetadata: []*corev3.HeaderValue{
-						&corev3.HeaderValue{
-							Key: "x-request-id",
+						{
+							Key:   "x-request-id",
 							Value: "%REQ(x-request-id)%",
 						},
 					},
@@ -189,7 +195,7 @@ func extAuthConfig(extAuth *ir.ExtAuth) *extauthv3.ExtAuthz {
 				},
 				Timeout: &duration.Duration{
 					Seconds: defaultExtServiceRequestTimeout,
-				},	
+				},
 			},
 		}
 	}
@@ -276,7 +282,7 @@ func (*extAuth) patchResources(tCtx *types.ResourceVersionTable,
 
 	var errs error
 	for _, route := range routes {
-		if !routeContainsExtAuth(route)  {
+		if !routeContainsExtAuth(route) {
 			continue
 		}
 		if route.ExtAuth.UseBootstrapCluster != nil && *route.ExtAuth.UseBootstrapCluster {
@@ -346,5 +352,5 @@ func (*extAuth) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 	if irRoute.ExtAuth == nil {
 		return nil
 	}
-	return enableFilterOnRoute(extAuthFilter, route, irRoute)
+	return enableFilterOnRoute(extAuthFilter, extAuthFilterName(irRoute.ExtAuth), route)
 }
diff --git a/adapter/internal/operator/gateway-api/translator/oidc.go b/adapter/internal/operator/gateway-api/translator/oidc.go
index 08d87017f..635ab5ac1 100644
--- a/adapter/internal/operator/gateway-api/translator/oidc.go
+++ b/adapter/internal/operator/gateway-api/translator/oidc.go
@@ -356,7 +356,7 @@ func (*oidc) patchRoute(route *routev3.Route, irRoute *ir.HTTPRoute) error {
 		return nil
 	}
 
-	return enableFilterOnRoute(oauth2Filter, route, irRoute)
+	return enableFilterOnRoute(oauth2Filter, oauth2FilterName(irRoute), route)
 }
 
 // buildXdsUpstreamTLSSocket returns an xDS TransportSocket that uses envoyTrustBundle
diff --git a/adapter/internal/operator/gateway-api/translator/route.go b/adapter/internal/operator/gateway-api/translator/route.go
index d0ee7873a..f1f85fc58 100644
--- a/adapter/internal/operator/gateway-api/translator/route.go
+++ b/adapter/internal/operator/gateway-api/translator/route.go
@@ -137,35 +137,35 @@ func buildXdsRoute(httpRoute *ir.HTTPRoute) (*routev3.Route, error) {
 }
 
 func buildXdsRouteMatch(pathMatch *ir.StringMatch, headerMatches []*ir.StringMatch, queryParamMatches []*ir.StringMatch) *routev3.RouteMatch {
-	outMatch := &routev3.RouteMatch{}
+	routeMatch := &routev3.RouteMatch{}
 
 	// Add a prefix match to '/' if no matches are specified
 	if pathMatch == nil {
 		// Setup default path specifier. It may be overwritten by :host:.
-		outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+		routeMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
 			Prefix: "/",
 		}
 	} else {
 		// Path match
 		//nolint:gocritic
 		if pathMatch.Exact != nil {
-			outMatch.PathSpecifier = &routev3.RouteMatch_Path{
+			routeMatch.PathSpecifier = &routev3.RouteMatch_Path{
 				Path: *pathMatch.Exact,
 			}
 		} else if pathMatch.Prefix != nil {
 			if *pathMatch.Prefix == "/" {
-				outMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
+				routeMatch.PathSpecifier = &routev3.RouteMatch_Prefix{
 					Prefix: "/",
 				}
 			} else {
 				// Remove trailing /
 				trimmedPrefix := strings.TrimSuffix(*pathMatch.Prefix, "/")
-				outMatch.PathSpecifier = &routev3.RouteMatch_PathSeparatedPrefix{
+				routeMatch.PathSpecifier = &routev3.RouteMatch_PathSeparatedPrefix{
 					PathSeparatedPrefix: trimmedPrefix,
 				}
 			}
 		} else if pathMatch.SafeRegex != nil {
-			outMatch.PathSpecifier = &routev3.RouteMatch_SafeRegex{
+			routeMatch.PathSpecifier = &routev3.RouteMatch_SafeRegex{
 				SafeRegex: &matcherv3.RegexMatcher{
 					Regex: *pathMatch.SafeRegex,
 				},
@@ -182,7 +182,7 @@ func buildXdsRouteMatch(pathMatch *ir.StringMatch, headerMatches []*ir.StringMat
 				StringMatch: stringMatcher,
 			},
 		}
-		outMatch.Headers = append(outMatch.Headers, headerMatcher)
+		routeMatch.Headers = append(routeMatch.Headers, headerMatcher)
 	}
 
 	// Query param matches
@@ -195,10 +195,10 @@ func buildXdsRouteMatch(pathMatch *ir.StringMatch, headerMatches []*ir.StringMat
 				StringMatch: stringMatcher,
 			},
 		}
-		outMatch.QueryParameters = append(outMatch.QueryParameters, queryParamMatcher)
+		routeMatch.QueryParameters = append(routeMatch.QueryParameters, queryParamMatcher)
 	}
 
-	return outMatch
+	return routeMatch
 }
 
 func buildXdsStringMatcher(irMatch *ir.StringMatch) *matcherv3.StringMatcher {
diff --git a/adapter/internal/operator/gateway-api/translator/utils.go b/adapter/internal/operator/gateway-api/translator/utils.go
index b68619bb7..8f6ae8fa2 100644
--- a/adapter/internal/operator/gateway-api/translator/utils.go
+++ b/adapter/internal/operator/gateway-api/translator/utils.go
@@ -29,25 +29,11 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
-  "github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
+
 	routev3 "github.com/envoyproxy/go-control-plane/envoy/config/route/v3"
 	extAuthService "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/http/ext_authz/v3"
-	"google.golang.org/protobuf/types/known/anypb"
 	hcmv3 "github.com/envoyproxy/go-control-plane/envoy/extensions/filters/network/http_connection_manager/v3"
-)
-
-// Context Extensions which are set in ExtAuthzPerRoute Config
-// These values are shared between the adapter and enforcer, hence if it is required to change
-// these values, modifications should be done in the both adapter and enforcer.
-const (
-	pathContextExtension            string = "path"
-	vHostContextExtension           string = "vHost"
-	basePathContextExtension        string = "basePath"
-	methodContextExtension          string = "method"
-	apiVersionContextExtension      string = "version"
-	apiNameContextExtension         string = "name"
-	clusterNameContextExtension     string = "clusterName"
-	retryPolicyRetriableStatusCodes string = "retriable-status-codes"
+	"google.golang.org/protobuf/types/known/anypb"
 )
 
 const (
@@ -110,70 +96,46 @@ func clusterName(host string, port uint32) string {
 	return fmt.Sprintf("%s_%d", strings.ReplaceAll(host, ".", "_"), port)
 }
 
-func enableFilterOnRoute(filterType string, route *routev3.Route, irRoute *ir.HTTPRoute) error {
+func enableFilterOnRoute(filterType, filterName string, route *routev3.Route) error {
 	if route == nil {
 		return errors.New("xds route is nil")
 	}
-	if irRoute == nil {
-		return errors.New("ir route is nil")
-	}
-
-	filterName := perRouteFilterName(filterType, irRoute.Name)
 	filterCfg := route.GetTypedPerFilterConfig()
-	if _, ok := filterCfg[filterName]; ok {
+	if filterCfg == nil {
+		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
+	} else if _, ok := filterCfg[filterName]; ok {
 		// This should not happen since this is the only place where the filter
 		// config is added in a route.
 		return fmt.Errorf("route already contains filter config: %s, %+v",
 			filterType, route)
 	}
 
-	// Enable the corresponding filter for this route.
 	routeCfgAny, err := anypb.New(&routev3.FilterConfig{
 		Config: &anypb.Any{},
 	})
-	if err != nil {
-		return err
-	}
 
-	if filterCfg == nil {
-		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
-	}
-
-	route.TypedPerFilterConfig[filterName] = routeCfgAny
-	return nil
-}
-
-// enableFilterOnRoute enables a filterType on the provided route.
-func enableExtAuthFilterOnRoute(route *routev3.Route, filterName string) error {
-	if route == nil {
-		return errors.New("xds route is nil")
-	}
-
-	filterCfg := route.GetTypedPerFilterConfig()
-	if _, ok := filterCfg[filterName]; ok {
-		// This should not happen since this is the only place where the filter
-		// config is added in a route.
-		return fmt.Errorf("route already contains filter config: %s, %+v",
-			filterName, route)
-	}
-	contextExtensions := make(map[string]string)
-	extAuthPerFilterConfig := &extAuthService.ExtAuthzPerRoute{
-		Override: &extAuthService.ExtAuthzPerRoute_CheckSettings{
-			CheckSettings: &extAuthService.CheckSettings{
-				ContextExtensions: contextExtensions,
-				// negation is performing to match the envoy config name (disable_request_body_buffering)
-				// DisableRequestBodyBuffering: !params.passRequestPayloadToEnforcer,
+	if filterType == extAuthFilter {
+		contextExtensions := make(map[string]string)
+		contextExtensions["route-name"] = route.Name
+		extAuthPerFilterConfig := &extAuthService.ExtAuthzPerRoute{
+			Override: &extAuthService.ExtAuthzPerRoute_CheckSettings{
+				CheckSettings: &extAuthService.CheckSettings{
+					ContextExtensions: contextExtensions,
+					// negation is performing to match the envoy config name (disable_request_body_buffering)
+					// DisableRequestBodyBuffering: !params.passRequestPayloadToEnforcer,
+				},
 			},
-		},
+		}
+		// Enable the corresponding filter for this route.
+		routeCfgAny, err = anypb.New(extAuthPerFilterConfig)
+		if err != nil {
+			return err
+		}
 	}
-	// Enable the corresponding filter for this route.
-	routeCfgAny, err := anypb.New(extAuthPerFilterConfig)
 	if err != nil {
 		return err
 	}
-	if filterCfg == nil {
-		route.TypedPerFilterConfig = make(map[string]*anypb.Any)
-	}
+
 	route.TypedPerFilterConfig[filterName] = routeCfgAny
 	return nil
 }

From e3cef349dc97dbc02ffa5ae49fc055d87d8fe9bd Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 12 Sep 2024 12:54:18 +0530
Subject: [PATCH 25/40] fix unit tests

---
 adapter/internal/operator/gateway-api/api.go    |  2 +-
 .../operator/gateway-api/translator/extauth.go  |  4 +++-
 .../testdata/out/xds-ir/ext-auth.listeners.yaml | 17 +----------------
 .../testdata/out/xds-ir/ext-auth.routes.yaml    | 16 ++++++++++------
 ...e-port-with-different-filters.listeners.yaml |  6 ++----
 ...same-port-with-different-filters.routes.yaml |  8 +++++---
 6 files changed, 22 insertions(+), 31 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/api.go b/adapter/internal/operator/gateway-api/api.go
index 9d2896dfe..f51c4999c 100644
--- a/adapter/internal/operator/gateway-api/api.go
+++ b/adapter/internal/operator/gateway-api/api.go
@@ -89,7 +89,7 @@ func buildExtAuth() *ir.ExtAuth {
 	}
 	flag := true
 	extAuth := &ir.ExtAuth{
-		Name:                ExtAuthName,
+		Name:                "",
 		GRPC:                &grpcExtAuthService,
 		UseBootstrapCluster: &flag,
 	}
diff --git a/adapter/internal/operator/gateway-api/translator/extauth.go b/adapter/internal/operator/gateway-api/translator/extauth.go
index 58cfbb99b..ab54d7e3e 100644
--- a/adapter/internal/operator/gateway-api/translator/extauth.go
+++ b/adapter/internal/operator/gateway-api/translator/extauth.go
@@ -101,9 +101,11 @@ func buildHCMExtAuthFilter(extAuth *ir.ExtAuth) (*hcmv3.HttpFilter, error) {
 		return nil, err
 	}
 
+	disabled := extAuth == nil || (extAuth.GRPC == nil && extAuth.HTTP == nil)
+
 	return &hcmv3.HttpFilter{
 		Name:     extAuthFilterName(extAuth),
-		Disabled: false,
+		Disabled: disabled,
 		ConfigType: &hcmv3.HttpFilter_TypedConfig{
 			TypedConfig: extAuthAny,
 		},
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
index 0913264d9..a9cd656c0 100644
--- a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
@@ -14,8 +14,7 @@
           initialStreamWindowSize: 65536
           maxConcurrentStreams: 100
         httpFilters:
-        - disabled: true
-          name: envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com
+        - name: envoy.filters.http.ext_authz_
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
             httpService:
@@ -30,20 +29,6 @@
                 timeout: 10s
                 uri: http://http-backend.envoy-gateway:80/auth
             transportApiVersion: V3
-        - disabled: true
-          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com
-          typedConfig:
-            '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
-            allowedHeaders:
-              patterns:
-              - exact: header1
-              - exact: header2
-            grpcService:
-              envoyGrpc:
-                authority: grpc-backend.default:9000
-                clusterName: securitypolicy/default/policy-for-second-route/grpc-backend
-              timeout: 10s
-            transportApiVersion: V3
         - name: envoy.filters.http.router
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
index 0b039af3d..349a4edec 100644
--- a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/ext-auth.routes.yaml
@@ -13,9 +13,11 @@
         upgradeConfigs:
         - upgradeType: websocket
       typedPerFilterConfig:
-        envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com:
-          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
-          config: {}
+        envoy.filters.http.ext_authz_:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+          checkSettings:
+            contextExtensions:
+              route-name: httproute/default/httproute-1/rule/0/match/0/www_example_com
     - match:
         path: bar
       name: httproute/default/httproute-2/rule/0/match/0/www_example_com
@@ -24,6 +26,8 @@
         upgradeConfigs:
         - upgradeType: websocket
       typedPerFilterConfig:
-        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com:
-          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
-          config: {}
+        envoy.filters.http.ext_authz_:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+          checkSettings:
+            contextExtensions:
+              route-name: httproute/default/httproute-2/rule/0/match/0/www_example_com
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
index 910c6728e..a9f3eb6bc 100755
--- a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.listeners.yaml
@@ -17,8 +17,7 @@
           maxConcurrentStreams: 100
         http3ProtocolOptions: {}
         httpFilters:
-        - disabled: true
-          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+        - name: envoy.filters.http.ext_authz_securitypolicy/default/policy-for-http-route-2
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
             httpService:
@@ -74,8 +73,7 @@
           initialStreamWindowSize: 65536
           maxConcurrentStreams: 100
         httpFilters:
-        - disabled: true
-          name: envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com
+        - name: envoy.filters.http.ext_authz_securitypolicy/default/policy-for-http-route-2
           typedConfig:
             '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
             httpService:
diff --git a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
index 1a4ec4068..cd35bd956 100755
--- a/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
+++ b/adapter/internal/operator/gateway-api/translator/testdata/out/xds-ir/multiple-listeners-same-port-with-different-filters.routes.yaml
@@ -34,9 +34,11 @@
         upgradeConfigs:
         - upgradeType: websocket
       typedPerFilterConfig:
-        envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_foo_com:
-          '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
-          config: {}
+        envoy.filters.http.ext_authz_securitypolicy/default/policy-for-http-route-2:
+          '@type': type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthzPerRoute
+          checkSettings:
+            contextExtensions:
+              route-name: httproute/default/httproute-2/rule/0/match/0/www_foo_com
   - domains:
     - www.bar.com
     name: default/gateway-2/http/www_bar_com

From 66ed32c357d02eef47949153da22fe45130f3df3 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 12 Sep 2024 13:33:13 +0530
Subject: [PATCH 26/40] fix merge conflicts

---
 .../operator/gateway-api/ir/zz_generated.deepcopy.go |  5 +++++
 .../operator/gateway-api/zz_generated.deepcopy.go    | 12 ++++++++++++
 .../operator/synchronizer/zz_generated.deepcopy.go   |  9 ++++++---
 3 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
index 05c2e8eee..4cce37fc6 100644
--- a/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/gateway-api/ir/zz_generated.deepcopy.go
@@ -415,6 +415,11 @@ func (in *ExtAuth) DeepCopyInto(out *ExtAuth) {
 		*out = make([]string, len(*in))
 		copy(*out, *in)
 	}
+	if in.UseBootstrapCluster != nil {
+		in, out := &in.UseBootstrapCluster, &out.UseBootstrapCluster
+		*out = new(bool)
+		**out = **in
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtAuth.
diff --git a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
index 6463a14e3..63ac758e9 100644
--- a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
@@ -23,6 +23,7 @@ package gatewayapi
 
 import (
 	"github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
@@ -200,6 +201,17 @@ func (in *Resources) DeepCopyInto(out *Resources) {
 			}
 		}
 	}
+	if in.APIs != nil {
+		in, out := &in.APIs, &out.APIs
+		*out = make([]*dpv1alpha2.API, len(*in))
+		for i := range *in {
+			if (*in)[i] != nil {
+				in, out := &(*in)[i], &(*out)[i]
+				*out = new(dpv1alpha2.API)
+				(*in).DeepCopyInto(*out)
+			}
+		}
+	}
 }
 
 // DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Resources.
diff --git a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
index e01ee44b4..3f4e853f6 100644
--- a/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/synchronizer/zz_generated.deepcopy.go
@@ -182,7 +182,8 @@ func (in *GQLRouteState) DeepCopyInto(out *GQLRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha2.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}
@@ -335,7 +336,8 @@ func (in *GatewayStateData) DeepCopyInto(out *GatewayStateData) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha2.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}
@@ -408,7 +410,8 @@ func (in *HTTPRouteState) DeepCopyInto(out *HTTPRouteState) {
 			if val == nil {
 				(*out)[key] = nil
 			} else {
-				in, out := &val, &outVal
+				inVal := (*in)[key]
+				in, out := &inVal, &outVal
 				*out = new(v1alpha2.ResolvedBackend)
 				(*in).DeepCopyInto(*out)
 			}

From 04822bf076b73ab319f68b031ff9268700f7c102 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 23 Sep 2024 14:28:34 +0530
Subject: [PATCH 27/40] fix merge conflicts

---
 common-controller/go.mod | 13 ++++++-------
 common-controller/go.sum | 26 ++++++++++++--------------
 2 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/common-controller/go.mod b/common-controller/go.mod
index 65c8047d0..e59a3f7d1 100644
--- a/common-controller/go.mod
+++ b/common-controller/go.mod
@@ -6,9 +6,9 @@ require (
 	github.com/jackc/pgx/v5 v5.5.4
 	github.com/onsi/ginkgo/v2 v2.14.0
 	github.com/onsi/gomega v1.30.0
-	github.com/prometheus/client_golang v1.18.0 // indirect
+	github.com/prometheus/client_golang v1.19.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/sirupsen/logrus v1.9.0
+	github.com/sirupsen/logrus v1.9.3
 	k8s.io/apimachinery v0.29.2
 	k8s.io/client-go v0.29.2
 	sigs.k8s.io/controller-runtime v0.17.2
@@ -51,7 +51,6 @@ require (
 	github.com/leodido/go-urn v1.2.4 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mattn/go-isatty v0.0.19 // indirect
-	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.8 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
@@ -78,7 +77,7 @@ require (
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
 	github.com/envoyproxy/protoc-gen-validate v1.0.4 // indirect
-	github.com/evanphx/json-patch/v5 v5.8.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
@@ -88,7 +87,7 @@ require (
 	github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 // indirect
@@ -104,7 +103,7 @@ require (
 	github.com/prometheus/client_model v0.6.0 // indirect
 	github.com/prometheus/common v0.45.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/stretchr/testify v1.8.4
+	github.com/stretchr/testify v1.9.0
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.26.0 // indirect
 	golang.org/x/net v0.25.0 // indirect
@@ -113,7 +112,7 @@ require (
 	golang.org/x/term v0.20.0 // indirect
 	golang.org/x/text v0.15.0 // indirect
 	golang.org/x/time v0.3.0 // indirect
-	golang.org/x/tools v0.16.1 // indirect
+	golang.org/x/tools v0.17.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240528184218-531527333157 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240528184218-531527333157 // indirect
diff --git a/common-controller/go.sum b/common-controller/go.sum
index 499f6ef21..96075a957 100644
--- a/common-controller/go.sum
+++ b/common-controller/go.sum
@@ -54,8 +54,8 @@ github.com/envoyproxy/protoc-gen-validate v1.0.4 h1:gVPz/FMfvh57HdSJQyvBtF00j8JU
 github.com/envoyproxy/protoc-gen-validate v1.0.4/go.mod h1:qys6tmnRsYrQqIhm2bvKZH4Blx/1gTIZ2UKVY1M+Yew=
 github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
 github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
-github.com/evanphx/json-patch/v5 v5.8.0 h1:lRj6N9Nci7MvzrXuX6HFzU8XjmhPiXPlsKEy1u0KQro=
-github.com/evanphx/json-patch/v5 v5.8.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
+github.com/evanphx/json-patch/v5 v5.9.0 h1:kcBlZQbplgElYIlo/n1hJbls2z/1awpXxpRi0/FOJfg=
+github.com/evanphx/json-patch/v5 v5.9.0/go.mod h1:VNkHZ/282BpEyt/tObQO8s5CMPmYYq14uClGH4abBuQ=
 github.com/fsnotify/fsnotify v1.7.0 h1:8JEhPFa5W2WU7YfeZzPNqzMP6Lwt7L2715Ggo0nosvA=
 github.com/fsnotify/fsnotify v1.7.0/go.mod h1:40Bi/Hjc2AVfZrqy+aj+yEI+/bRxZnMJyTJwOpGvigM=
 github.com/gabriel-vasile/mimetype v1.4.2 h1:w5qFW6JKBz9Y393Y4q372O9A7cUSequkh1Q7OhCmWKU=
@@ -157,8 +157,6 @@ github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
 github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
-github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -185,13 +183,13 @@ github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRI
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
 github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_golang v1.19.0 h1:ygXvpU1AoN1MhdzckN+PyD9QJOSD4x7kmXYlnfbA6JU=
+github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdURP+DABIEIjnmDdp+k=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
-github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
-github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
+github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/redis/go-redis/v9 v9.2.1 h1:WlYJg71ODF0dVspZZCpYmoF1+U1Jjk9Rwd7pq6QmlCg=
@@ -208,8 +206,8 @@ github.com/shoenig/go-m1cpu v0.1.6/go.mod h1:1JJMcUBvfNwpq05QDQVAnx3gUHr9IYF7GNg
 github.com/shoenig/test v0.6.4 h1:kVTaSd7WLz5WZ2IaoM0RSzRsUD+m8wRR+5qvntpn4LU=
 github.com/shoenig/test v0.6.4/go.mod h1:byHiCGXqrVaflBLAMq/srcZIHynQPQgeyvkvXnjqq0k=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -226,8 +224,9 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/tklauser/go-sysconf v0.3.12 h1:0QaGUFOdQaIVdPgfITYzaTegZvdCjmYO52cSFAEVmqU=
 github.com/tklauser/go-sysconf v0.3.12/go.mod h1:Ho14jnntGE1fpdOqQEEaiKRpvIavV0hSfmBq8nJbHYI=
 github.com/tklauser/numcpus v0.6.1 h1:ng9scYS7az0Bk4OZLvrNXNSAO2Pxr1XXRAPyjhIx+Fk=
@@ -300,7 +299,6 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
@@ -321,8 +319,8 @@ golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
-golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
+golang.org/x/tools v0.17.0 h1:FvmRgNOcs3kOa+T20R1uhfP9F6HgG2mfxDv1vrx1Htc=
+golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

From 6726ac298880d15458a00bc605cf3a6159218bad Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 23 Sep 2024 15:40:30 +0530
Subject: [PATCH 28/40] update helm chart

---
 helm-charts/Chart.lock | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/helm-charts/Chart.lock b/helm-charts/Chart.lock
index 2de28a9e0..aae9255df 100644
--- a/helm-charts/Chart.lock
+++ b/helm-charts/Chart.lock
@@ -8,5 +8,5 @@ dependencies:
 - name: cert-manager
   repository: https://charts.jetstack.io
   version: v1.10.2
-digest: sha256:c73e2790cdd6cef996f40aecb00224e74e8aae146a7d1c4afb528720b404f76c
-generated: "2024-06-13T16:05:27.648453+05:30"
+digest: sha256:f88e85e3f5992c1cb4a3cc5f962541249efb5842ce8bf7a3bf900ada6df49f16
+generated: "2024-09-23T15:39:57.926671+05:30"

From c775c85685af0266bef3f887d2cba9056d8c752b Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 19 Sep 2024 11:11:21 +0530
Subject: [PATCH 29/40] change router xds port

---
 adapter/config/default_config.go                              | 4 ++--
 adapter/internal/adapter/adapter.go                           | 4 ++--
 .../gateway-api/bootstrap/testdata/merge/default.out.yaml     | 2 +-
 .../gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml | 2 +-
 .../bootstrap/testdata/render/custom-stats-matcher.yaml       | 2 +-
 .../bootstrap/testdata/render/disable-prometheus.yaml         | 2 +-
 .../bootstrap/testdata/render/enable-prometheus.yaml          | 2 +-
 .../gateway-api/bootstrap/testdata/render/otel-metrics.yaml   | 2 +-
 .../kubernetes/proxy/testdata/deployments/bootstrap.yaml      | 2 +-
 .../proxy/testdata/deployments/component-level.yaml           | 2 +-
 .../kubernetes/proxy/testdata/deployments/custom.yaml         | 2 +-
 .../testdata/deployments/custom_with_initcontainers.yaml      | 2 +-
 .../kubernetes/proxy/testdata/deployments/default-env.yaml    | 2 +-
 .../kubernetes/proxy/testdata/deployments/default.yaml        | 2 +-
 .../proxy/testdata/deployments/disable-prometheus.yaml        | 2 +-
 .../kubernetes/proxy/testdata/deployments/extension-env.yaml  | 2 +-
 .../testdata/deployments/override-labels-and-annotations.yaml | 2 +-
 .../proxy/testdata/deployments/patch-deployment.yaml          | 2 +-
 .../proxy/testdata/deployments/shutdown-manager.yaml          | 2 +-
 .../kubernetes/proxy/testdata/deployments/volumes.yaml        | 2 +-
 .../proxy/testdata/deployments/with-annotations.yaml          | 2 +-
 .../proxy/testdata/deployments/with-concurrency.yaml          | 2 +-
 .../proxy/testdata/deployments/with-extra-args.yaml           | 2 +-
 .../proxy/testdata/deployments/with-image-pull-secrets.yaml   | 2 +-
 .../proxy/testdata/deployments/with-node-selector.yaml        | 2 +-
 .../deployments/with-topology-spread-constraints.yaml         | 2 +-
 adapter/resources/check_health.sh                             | 2 +-
 common-controller/go.sum                                      | 4 ++--
 .../gateway-components/adapter/adapter-deployment.yaml        | 2 +-
 .../adapter/adapter-grpc-probe-script-conf.yaml               | 2 +-
 .../gateway-components/adapter/adapter-service.yaml           | 2 +-
 31 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index 887958c60..b5fb0a0d9 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -285,8 +285,8 @@ var defaultConfig = &Config{
 			EnforcerPublicCertPath:   "/home/wso2/security/keystore/enforcer.crt",
 			EnforcerServerName:       "",
 			AdapterTrustedCAPath:     "/home/wso2/security/truststore",
-			AdapterEnvoyXDSPort:      "18000",
-			AdapterEnforcerXDSPort:   "18001",
+			AdapterEnvoyXDSPort:      "18005",
+			AdapterEnforcerXDSPort:   "18000",
 			CommonControllerXDSPort:  "18002",
 			CommonControllerRestPort: "18003",
 			EnforcerLabel:            "wso2-apk-default",
diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 36e5952e4..1ad913a26 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -26,6 +26,7 @@ import (
 	xdsv3 "github.com/envoyproxy/go-control-plane/pkg/server/v3"
 	enforcerCallbacks "github.com/wso2/apk/adapter/internal/discovery/xds/enforcercallbacks"
 	routercb "github.com/wso2/apk/adapter/internal/discovery/xds/routercallbacks"
+	"github.com/wso2/apk/adapter/internal/operator"
 	xdstranslatorrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/translator/runner"
 	xdsserverrunner "github.com/wso2/apk/adapter/internal/operator/gateway-api/xds/runner"
 	infrarunner "github.com/wso2/apk/adapter/internal/operator/infrastructure/runner"
@@ -39,7 +40,6 @@ import (
 	"github.com/wso2/apk/adapter/pkg/health"
 	healthservice "github.com/wso2/apk/adapter/pkg/health/api/wso2/health/service"
 	"github.com/wso2/apk/adapter/pkg/utils/tlsutils"
-	"github.com/wso2/apk/adapter/internal/operator"
 
 	"context"
 	"flag"
@@ -77,7 +77,7 @@ const (
 func init() {
 	flag.BoolVar(&debug, "debug", true, "Use debug logging")
 	flag.BoolVar(&onlyLogging, "onlyLogging", false, "Only demo AccessLogging Service")
-	flag.UintVar(&port, "port", 18001, "Management server port")
+	flag.UintVar(&port, "port", 18000, "Management server port")
 	flag.UintVar(&alsPort, "als", 18090, "Accesslog server port")
 	flag.StringVar(&mode, "ads", ads, "Management server type (ads, xds, rest)")
 }
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
index 528105b3b..8b21fa61b 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/default.out.yaml
@@ -58,7 +58,7 @@ staticResources:
             address:
               socketAddress:
                 address: envoy-gateway
-                portValue: 18000
+                portValue: 18005
           loadBalancingWeight: 1
         loadBalancingWeight: 1
     name: xds_cluster
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
index ccfff8e1f..31bd014ea 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/merge/stats_sinks.out.yaml
@@ -52,7 +52,7 @@ staticResources:
             address:
               socketAddress:
                 address: envoy-gateway
-                portValue: 18000
+                portValue: 18005
           loadBalancingWeight: 1
         loadBalancingWeight: 1
     name: xds_cluster
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
index 7364bc85a..50cf18fcc 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/custom-stats-matcher.yaml
@@ -80,7 +80,7 @@ static_resources:
             address:
               socket_address:
                 address: envoy-gateway
-                port_value: 18000
+                port_value: 18005
     typed_extension_protocol_options:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
index ca8a5c09c..ac495acec 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/disable-prometheus.yaml
@@ -69,7 +69,7 @@ static_resources:
             address:
               socket_address:
                 address: envoy-gateway
-                port_value: 18000
+                port_value: 18005
     typed_extension_protocol_options:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
index ca8a5c09c..ac495acec 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/enable-prometheus.yaml
@@ -69,7 +69,7 @@ static_resources:
             address:
               socket_address:
                 address: envoy-gateway
-                port_value: 18000
+                port_value: 18005
     typed_extension_protocol_options:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
index 82fbd38ad..252762fba 100644
--- a/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
+++ b/adapter/internal/operator/gateway-api/bootstrap/testdata/render/otel-metrics.yaml
@@ -94,7 +94,7 @@ static_resources:
             address:
               socket_address:
                 address: envoy-gateway
-                port_value: 18000
+                port_value: 18005
     typed_extension_protocol_options:
       envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
         "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
index 7de7ca171..912229f83 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/bootstrap.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
index 7ba4cb464..cb32dccb4 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/component-level.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
index dddf49808..37004f0d3 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom.yaml
@@ -116,7 +116,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
index 7a3d8264d..42b9efe89 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/custom_with_initcontainers.yaml
@@ -116,7 +116,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
index b51526666..747f624fc 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default-env.yaml
@@ -114,7 +114,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
index d459b8da9..66520a444 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/default.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
index a7f68d155..6afd4429f 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/disable-prometheus.yaml
@@ -109,7 +109,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
index a7bb21857..e900bf38c 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/extension-env.yaml
@@ -114,7 +114,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
index b1086f11d..098d42727 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/override-labels-and-annotations.yaml
@@ -124,7 +124,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
index 3ca34b511..ac4c6c1c2 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/patch-deployment.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
index 46de0fee6..8bc2f9a01 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/shutdown-manager.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
index fe1845ef5..a6a5df11f 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/volumes.yaml
@@ -114,7 +114,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
index e94ff083e..ee4902555 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-annotations.yaml
@@ -118,7 +118,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
index 5ee173a50..e7742204a 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-concurrency.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
index 5a358d89e..12e94333e 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-extra-args.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
index cd3821c50..c271e1503 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-image-pull-secrets.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
index 01ea0267a..bf39d4154 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-node-selector.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
index ab8338bb8..2a478b313 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/testdata/deployments/with-topology-spread-constraints.yaml
@@ -113,7 +113,7 @@ spec:
                       address:
                         socket_address:
                           address: envoy-gateway
-                          port_value: 18000
+                          port_value: 18005
               typed_extension_protocol_options:
                 envoy.extensions.upstreams.http.v3.HttpProtocolOptions:
                   "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
diff --git a/adapter/resources/check_health.sh b/adapter/resources/check_health.sh
index 93c56cad5..8d5e18abd 100755
--- a/adapter/resources/check_health.sh
+++ b/adapter/resources/check_health.sh
@@ -15,7 +15,7 @@
 # limitations under the License.
 # -----------------------------------------------------------------------
 
-ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
+ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
 ADAPTER_SERVER_NAME="${ADAPTER_SERVER_NAME:-adapter}"
 grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
     -tls \
diff --git a/common-controller/go.sum b/common-controller/go.sum
index 96075a957..71888bfb6 100644
--- a/common-controller/go.sum
+++ b/common-controller/go.sum
@@ -188,8 +188,8 @@ github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdU
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
-github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
-github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
+github.com/prometheus/common v0.50.0 h1:YSZE6aa9+luNa2da6/Tik0q0A5AbR+U003TItK57CPQ=
+github.com/prometheus/common v0.50.0/go.mod h1:wHFBCEVWVmHMUpg7pYcOm2QUR/ocQdYSJVQJKnHc3xQ=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/redis/go-redis/v9 v9.2.1 h1:WlYJg71ODF0dVspZZCpYmoF1+U1Jjk9Rwd7pq6QmlCg=
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
index 421fb94df..cc2b44a7b 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-deployment.yaml
@@ -48,7 +48,7 @@ spec:
               protocol: "TCP"
             - containerPort: 8765
               protocol: "TCP"
-            - containerPort: 18001
+            - containerPort: 18005
               protocol: TCP
             {{ if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled}}
             - containerPort: 18006
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
index abecda2fa..9d1d9bde9 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-grpc-probe-script-conf.yaml
@@ -38,7 +38,7 @@ data:
     # limitations under the License.
     # -----------------------------------------------------------------------
 
-    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18001}"
+    ADAPTER_XDS_PORT="${ADAPTER_XDS_PORT:-18000}"
     grpc_health_probe -addr "127.0.0.1:${ADAPTER_XDS_PORT}" \
         -tls \
         -tls-ca-cert "${ADAPTER_PUBLIC_CERT_PATH}" \
diff --git a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-service.yaml b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-service.yaml
index a1c323b90..5cda980a9 100644
--- a/helm-charts/templates/data-plane/gateway-components/adapter/adapter-service.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/adapter/adapter-service.yaml
@@ -37,7 +37,7 @@ spec:
       targetPort: 9443
     - name: https-rate-limiter
       protocol: TCP
-      port: 18001
+      port: 18005
     - name: profile-port
       protocol: TCP
       port: 6060

From 61af0c18d4dd862bc6c5e993efe2eeae4bee491b Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 19 Sep 2024 11:55:22 +0530
Subject: [PATCH 30/40] add v1alpha3 to new controller

---
 adapter/internal/adapter/adapter.go               |  6 ++----
 .../gateway-api/provider/kubernetes/kubernetes.go | 15 ++++++---------
 .../operator/gateway-api/provider/scheme.go       |  4 ++++
 3 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/adapter/internal/adapter/adapter.go b/adapter/internal/adapter/adapter.go
index 1ad913a26..f3bf04819 100644
--- a/adapter/internal/adapter/adapter.go
+++ b/adapter/internal/adapter/adapter.go
@@ -254,10 +254,8 @@ func Run(conf *config.Config) {
 	xds.UpdateEnforcerConfig(conf)
 	if !conf.Adapter.EnableGatewayClassController {
 		go operator.InitOperator(conf.Adapter.Metrics)
-	}
-
-	if conf.Adapter.EnableGatewayClassController {
-		SetupRunners(conf)
+	} else {
+		go SetupRunners(conf)
 	}
 
 OUTER:
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
index 282195b79..a7a541af6 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/kubernetes.go
@@ -28,9 +28,15 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/wso2/apk/adapter/config"
+	"github.com/wso2/apk/adapter/internal/loggers"
+	dpcontrollers "github.com/wso2/apk/adapter/internal/operator/controllers/dp"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/provider"
 	"github.com/wso2/apk/adapter/internal/operator/message"
 	"github.com/wso2/apk/adapter/internal/operator/status"
+	"github.com/wso2/apk/adapter/internal/operator/synchronizer"
+	"github.com/wso2/apk/adapter/pkg/logging"
+	"github.com/wso2/apk/adapter/pkg/metrics"
 	"k8s.io/client-go/rest"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -38,14 +44,6 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager"
-	"github.com/wso2/apk/adapter/config"	
-	"github.com/wso2/apk/adapter/pkg/metrics"
-	"github.com/wso2/apk/adapter/internal/loggers"
-	"github.com/wso2/apk/adapter/pkg/logging"
-	"github.com/wso2/apk/adapter/internal/operator/synchronizer"
-	dpcontrollers "github.com/wso2/apk/adapter/internal/operator/controllers/dp"
-
-
 )
 
 // Provider is the scaffolding for the Kubernetes provider. It sets up dependencies
@@ -73,7 +71,6 @@ func New(cfg *rest.Config, resources *message.ProviderResources) (*Provider, err
 		LeaderElectionID:       "operator-lease.apk.wso2.com",
 	}
 
-	
 	conf := config.ReadConfigs()
 	metricsConfig := conf.Adapter.Metrics
 	if metricsConfig.Enabled {
diff --git a/adapter/internal/operator/gateway-api/provider/scheme.go b/adapter/internal/operator/gateway-api/provider/scheme.go
index ebbeb2631..386eccb4e 100644
--- a/adapter/internal/operator/gateway-api/provider/scheme.go
+++ b/adapter/internal/operator/gateway-api/provider/scheme.go
@@ -25,6 +25,7 @@ package provider
 import (
 	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
+	dpv1alpha3 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha3"
 	"k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
 	gwapiv1 "sigs.k8s.io/gateway-api/apis/v1"
@@ -62,6 +63,9 @@ func init() {
 	if err := dpv1alpha2.AddToScheme(scheme); err != nil {
 		panic(err)
 	}
+	if err := dpv1alpha3.AddToScheme(scheme); err != nil {
+		panic(err)
+	}
 }
 
 // GetScheme returns a scheme with types supported by the Kubernetes provider.

From 30b608e4feb1e8343beed094c6ea96645754be46 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 19 Sep 2024 17:36:26 +0530
Subject: [PATCH 31/40] support backend kind endpoints in new controller

---
 .../operator/controllers/dp/api_controller.go |  2 +-
 .../controllers/dp/gateway_controller.go      |  8 +++---
 .../internal/operator/gateway-api/contexts.go |  5 +---
 .../internal/operator/gateway-api/helpers.go  | 14 +++++-----
 .../internal/operator/gateway-api/ir/xds.go   |  4 +--
 .../provider/kubernetes/controller.go         |  4 +--
 .../provider/kubernetes/predicates.go         | 11 +++-----
 .../gateway-api/provider/kubernetes/routes.go |  5 ++--
 .../internal/operator/gateway-api/resource.go | 23 ++++++++++-----
 .../internal/operator/gateway-api/route.go    | 13 ++++++++-
 .../gateway-api/translator/cluster.go         |  2 +-
 .../gateway-api/zz_generated.deepcopy.go      |  5 ++--
 .../synchronizer/gateway_synchronizer.go      | 19 +++++++------
 adapter/internal/operator/utils/utils_test.go | 28 +++++++++----------
 14 files changed, 78 insertions(+), 65 deletions(-)

diff --git a/adapter/internal/operator/controllers/dp/api_controller.go b/adapter/internal/operator/controllers/dp/api_controller.go
index 7eae15414..cab30e8ab 100644
--- a/adapter/internal/operator/controllers/dp/api_controller.go
+++ b/adapter/internal/operator/controllers/dp/api_controller.go
@@ -1561,7 +1561,7 @@ func (apiReconciler *APIReconciler) getAPIsForConfigMap(ctx context.Context, obj
 		return []reconcile.Request{}
 	}
 
-	backendList := &dpv1alpha1.BackendList{}
+	backendList := &dpv1alpha2.BackendList{}
 	err := apiReconciler.client.List(ctx, backendList, &k8client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(configMapBackend, utils.NamespacedName(configMap).String()),
 	})
diff --git a/adapter/internal/operator/controllers/dp/gateway_controller.go b/adapter/internal/operator/controllers/dp/gateway_controller.go
index 36e33d9f1..79feeedd9 100644
--- a/adapter/internal/operator/controllers/dp/gateway_controller.go
+++ b/adapter/internal/operator/controllers/dp/gateway_controller.go
@@ -124,7 +124,7 @@ func NewGatewayController(mgr manager.Manager, operatorDataStore *synchronizer.O
 		return err
 	}
 
-	if err := c.Watch(source.Kind(mgr.GetCache(), &dpv1alpha1.Backend{}), handler.EnqueueRequestsFromMapFunc(r.getGatewaysForBackend),
+	if err := c.Watch(source.Kind(mgr.GetCache(), &dpv1alpha2.Backend{}), handler.EnqueueRequestsFromMapFunc(r.getGatewaysForBackend),
 		predicates...); err != nil {
 		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error3102, logging.BLOCKER, "Error watching Backend resources: %v", err))
 		return err
@@ -321,7 +321,7 @@ func (gatewayReconciler *GatewayReconciler) getResolvedBackendsMapping(ctx conte
 // getGatewaysForBackend triggers the Gateway controller reconcile method based on the changes detected
 // in backend resources.
 func (gatewayReconciler *GatewayReconciler) getGatewaysForBackend(ctx context.Context, obj k8client.Object) []reconcile.Request {
-	backend, ok := obj.(*dpv1alpha1.Backend)
+	backend, ok := obj.(*dpv1alpha2.Backend)
 	if !ok {
 		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error3107, logging.TRIVIAL, "Unexpected object type, bypassing reconciliation: %v", backend))
 		return []reconcile.Request{}
@@ -408,7 +408,7 @@ func (gatewayReconciler *GatewayReconciler) getGatewaysForSecret(ctx context.Con
 		return []reconcile.Request{}
 	}
 
-	backendList := &dpv1alpha1.BackendList{}
+	backendList := &dpv1alpha2.BackendList{}
 	if err := gatewayReconciler.client.List(ctx, backendList, &k8client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(secretBackend, utils.NamespacedName(secret).String()),
 	}); err != nil {
@@ -433,7 +433,7 @@ func (gatewayReconciler *GatewayReconciler) getGatewaysForConfigMap(ctx context.
 		return []reconcile.Request{}
 	}
 
-	backendList := &dpv1alpha1.BackendList{}
+	backendList := &dpv1alpha2.BackendList{}
 	if err := gatewayReconciler.client.List(ctx, backendList, &k8client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(configMapBackend, utils.NamespacedName(configMap).String()),
 	}); err != nil {
diff --git a/adapter/internal/operator/gateway-api/contexts.go b/adapter/internal/operator/gateway-api/contexts.go
index 0451156b3..5d131a36e 100644
--- a/adapter/internal/operator/gateway-api/contexts.go
+++ b/adapter/internal/operator/gateway-api/contexts.go
@@ -57,8 +57,6 @@ func (g *GatewayContext) ResetListeners() {
 	}
 }
 
-
-
 func (g *GatewayContext) attachEnvoyProxy(resources *Resources) {
 	// if g.Spec.Infrastructure != nil && g.Spec.Infrastructure.ParametersRef != nil && !IsMergeGatewaysEnabled(resources) {
 	// 	ref := g.Spec.Infrastructure.ParametersRef
@@ -75,7 +73,6 @@ func (g *GatewayContext) attachEnvoyProxy(resources *Resources) {
 	// g.envoyProxy = resources.EnvoyProxyForGatewayClass
 }
 
-
 // ListenerContext wraps a Listener and provides helper methods for
 // setting conditions and other status information on the associated
 // Gateway, etc.
@@ -480,4 +477,4 @@ func GetBackendRef(b BackendRefContext) *gwapiv1.BackendRef {
 
 func GetFilters(b BackendRefContext) any {
 	return reflect.ValueOf(b).FieldByName("Filters").Interface()
-}
\ No newline at end of file
+}
diff --git a/adapter/internal/operator/gateway-api/helpers.go b/adapter/internal/operator/gateway-api/helpers.go
index e8cb6e550..42b3142c6 100644
--- a/adapter/internal/operator/gateway-api/helpers.go
+++ b/adapter/internal/operator/gateway-api/helpers.go
@@ -381,7 +381,7 @@ func irRoutePrefix(route RouteContext) string {
 func GetNamespacedName(route RouteContext) string {
 	return types.NamespacedName{
 		Namespace: route.GetNamespace(),
-		Name: route.GetName(),
+		Name:      route.GetName(),
 	}.String()
 }
 
@@ -474,10 +474,10 @@ func listenersWithSameHTTPPort(xdsIR *ir.Xds, listener *ir.HTTPListener) []strin
 // contains checks if a specific string exists in the provided slice of strings.
 // It returns true if the string is found, and false otherwise.
 func Contains(slice []string, item string) bool {
-    for _, v := range slice {
-        if v == item {
-            return true
-        }
-    }
-    return false
+	for _, v := range slice {
+		if v == item {
+			return true
+		}
+	}
+	return false
 }
diff --git a/adapter/internal/operator/gateway-api/ir/xds.go b/adapter/internal/operator/gateway-api/ir/xds.go
index 8936fc963..32911c0bf 100644
--- a/adapter/internal/operator/gateway-api/ir/xds.go
+++ b/adapter/internal/operator/gateway-api/ir/xds.go
@@ -605,8 +605,8 @@ type ExtAuth struct {
 	// authorization server by default, no matter whether they are specified
 	// in HeadersToExtAuth or not.
 	// +optional
-	HeadersToExtAuth []string `json:"headersToExtAuth,omitempty"`
-	UseBootstrapCluster *bool  `json:"useBootstrapCluster,omitempty"`
+	HeadersToExtAuth    []string `json:"headersToExtAuth,omitempty"`
+	UseBootstrapCluster *bool    `json:"useBootstrapCluster,omitempty"`
 }
 
 // HTTPExtAuthService defines the HTTP External Authorization service
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
index ec48f5d0b..98008ba94 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/controller.go
@@ -495,7 +495,7 @@ func (r *gatewayReconcilerNew) watchResources(ctx context.Context, mgr manager.M
 	// Watch Service CRUDs and process affected *Route objects and services belongs to gateways
 	backendPredicates := []predicate.Predicate{predicate.NewPredicateFuncs(r.validateBackendForReconcile)}
 	if err := c.Watch(
-		source.Kind(mgr.GetCache(), &dpv1alpha1.Backend{}),
+		source.Kind(mgr.GetCache(), &dpv1alpha2.Backend{}),
 		handler.EnqueueRequestsFromMapFunc(r.enqueueClass),
 		backendPredicates...,
 	); err != nil {
@@ -669,7 +669,7 @@ func (r *gatewayReconcilerNew) processBackendRefs(ctx context.Context, gwcResour
 			endpointSliceLabelKey = discoveryv1.LabelServiceName
 
 		case gatewayapi.KindBackend:
-			backend := new(dpv1alpha1.Backend)
+			backend := new(dpv1alpha2.Backend)
 			err := r.client.Get(ctx, types.NamespacedName{Namespace: string(*backendRef.Namespace), Name: string(backendRef.Name)}, backend)
 			if err != nil {
 				loggers.LoggerAPKOperator.Errorf("Failed to get Backend namespace %s, name %s, Error: %v", string(*backendRef.Namespace),
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
index c1a4c5bcb..876d4bda8 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/predicates.go
@@ -25,7 +25,7 @@ import (
 	"github.com/wso2/apk/adapter/internal/loggers"
 	gatewayapi "github.com/wso2/apk/adapter/internal/operator/gateway-api"
 	"github.com/wso2/apk/adapter/internal/operator/utils"
-	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	corev1 "k8s.io/api/core/v1"
 	k8errors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/fields"
@@ -108,7 +108,7 @@ func (r *gatewayReconcilerNew) validateServiceForReconcile(obj client.Object) bo
 // if it exists, finds the Gateway's Deployment, and further updates the Gateway
 // status Ready condition. All Services are pushed for reconciliation.
 func (r *gatewayReconcilerNew) validateBackendForReconcile(obj client.Object) bool {
-	backend, ok := obj.(*dpv1alpha1.Backend)
+	backend, ok := obj.(*dpv1alpha2.Backend)
 	if !ok {
 		loggers.LoggerAPKOperator.Info("unexpected object type, bypassing reconciliation for object", obj)
 		return false
@@ -164,15 +164,12 @@ func (r *gatewayReconcilerNew) isRouteReferencingBackend(nsName *types.Namespace
 	httpRouteList := &gwapiv1.HTTPRouteList{}
 	if err := r.client.List(ctx, httpRouteList, &client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(backendHTTPRouteIndex, nsName.String()),
-	}); err != nil {
+	}); err != nil || len(httpRouteList.Items) == 0 {
 		loggers.LoggerAPKOperator.Error("unable to find associated HTTPRoutes for the service ", err)
 		return false
 	}
 
-	// Check how many Route objects refer this Backend
-	allAssociatedRoutes := len(httpRouteList.Items)
-
-	return allAssociatedRoutes != 0
+	return true
 }
 
 // envoyServiceForGateway returns the Envoy service, returning nil if the service doesn't exist.
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
index 94a3f8503..a4e8d5df9 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -220,7 +220,7 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 								newMatches := make([]gwapiv1.HTTPRouteMatch, 0)
 								for _, match := range rule.Matches {
 									if match.Path.Value != nil {
-										newPath := api.Spec.BasePath  +  *match.Path.Value
+										newPath := api.Spec.BasePath + *match.Path.Value
 										match.Path.Value = &newPath
 									} else {
 										newPath := api.Spec.BasePath
@@ -241,7 +241,7 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 									for _, match := range rule.Matches {
 										matchCopied := match.DeepCopy()
 										if match.Path.Value != nil {
-											newPath := removeFirstSubstring(*match.Path.Value, fmt.Sprintf("/%s",api.Spec.APIVersion)) 
+											newPath := removeFirstSubstring(*match.Path.Value, fmt.Sprintf("/%s", api.Spec.APIVersion))
 											matchCopied.Path.Value = &newPath
 										} else {
 											newPath := removeSuffix(api.Spec.BasePath, api.Spec.APIVersion)
@@ -265,7 +265,6 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 	return nil
 }
 
-
 func removeSuffix(str, suffix string) string {
 	if strings.HasSuffix(str, suffix) {
 		return str[:len(str)-len(suffix)]
diff --git a/adapter/internal/operator/gateway-api/resource.go b/adapter/internal/operator/gateway-api/resource.go
index 600d2d529..c2954cb72 100644
--- a/adapter/internal/operator/gateway-api/resource.go
+++ b/adapter/internal/operator/gateway-api/resource.go
@@ -27,7 +27,6 @@ import (
 	"reflect"
 
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
-	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	"golang.org/x/exp/slices"
 	v1 "k8s.io/api/core/v1"
@@ -57,7 +56,7 @@ type Resources struct {
 	ReferenceGrants     []*gwapiv1b1.ReferenceGrant   `json:"referenceGrants,omitempty" yaml:"referenceGrants,omitempty"`
 	Namespaces          []*v1.Namespace               `json:"namespaces,omitempty" yaml:"namespaces,omitempty"`
 	Services            []*v1.Service                 `json:"services,omitempty" yaml:"services,omitempty"`
-	Backends            []*dpv1alpha1.Backend         `json:"backends,omitempty" yaml:"backends,omitempty"`
+	Backends            []*dpv1alpha2.Backend         `json:"backends,omitempty" yaml:"backends,omitempty"`
 	EndpointSlices      []*discoveryv1.EndpointSlice  `json:"endpointSlices,omitempty" yaml:"endpointSlices,omitempty"`
 	Secrets             []*v1.Secret                  `json:"secrets,omitempty" yaml:"secrets,omitempty"`
 	ConfigMaps          []*v1.ConfigMap               `json:"configMaps,omitempty" yaml:"configMaps,omitempty"`
@@ -104,6 +103,16 @@ func (r *Resources) GetService(namespace, name string) *v1.Service {
 	return nil
 }
 
+func (r *Resources) GetBackend(namespace, name string) *dpv1alpha2.Backend {
+	for _, backend := range r.Backends {
+		if backend.Namespace == namespace && backend.Name == name {
+			return backend
+		}
+	}
+
+	return nil
+}
+
 func (r *Resources) GetSecret(namespace, name string) *v1.Secret {
 	for _, secret := range r.Secrets {
 		if secret.Namespace == namespace && secret.Name == name {
@@ -176,10 +185,10 @@ func RemoveDuplicates(apis []*dpv1alpha2.API) []*dpv1alpha2.API {
 	result := []*dpv1alpha2.API{}
 
 	for _, api := range apis {
-			if _, exists := uniqueAPIs[api]; !exists {
-					uniqueAPIs[api] = struct{}{}
-					result = append(result, api)
-			}
+		if _, exists := uniqueAPIs[api]; !exists {
+			uniqueAPIs[api] = struct{}{}
+			result = append(result, api)
+		}
 	}
 	return result
-}
\ No newline at end of file
+}
diff --git a/adapter/internal/operator/gateway-api/route.go b/adapter/internal/operator/gateway-api/route.go
index 2a12e3615..d293d5f54 100644
--- a/adapter/internal/operator/gateway-api/route.go
+++ b/adapter/internal/operator/gateway-api/route.go
@@ -28,6 +28,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/wso2/apk/adapter/internal/loggers"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/ir"
 	"github.com/wso2/apk/adapter/internal/operator/status"
 	"github.com/wso2/apk/adapter/pkg/utils/regex"
@@ -199,6 +200,7 @@ func (t *Translator) processHTTPRouteRules(httpRoute *HTTPRouteContext, parentRe
 				// processing any destinations for this route.
 				if route.DirectResponse == nil && route.Redirect == nil {
 					if ds != nil && len(ds.Endpoints) > 0 {
+						loggers.LoggerAPI.Errorf("Destination is not given in %s:%s", httpRoute.Namespace, httpRoute.Name)
 						if route.Destination == nil {
 							route.Destination = &ir.RouteDestination{
 								Name: irRouteDestinationName(httpRoute, ruleIdx),
@@ -1095,14 +1097,16 @@ func (t *Translator) processDestination(backendRefContext BackendRefContext,
 	if backendRef.Weight != nil {
 		weight = uint32(*backendRef.Weight)
 	}
-
+	loggers.LoggerAPI.Error("amalii", backendRef)
 	backendNamespace := NamespaceDerefOr(backendRef.Namespace, route.GetNamespace())
 	if !t.validateBackendRef(backendRefContext, parentRef, route, resources, backendNamespace, routeType) {
+		loggers.LoggerAPI.Error("amalii")
 		return nil, weight
 	}
 
 	// Skip processing backends with 0 weight
 	if weight == 0 {
+		loggers.LoggerAPI.Error("amalii")
 		return nil, weight
 	}
 
@@ -1140,6 +1144,13 @@ func (t *Translator) processDestination(backendRefContext BackendRefContext,
 				uint32(*backendRef.Port))
 			endpoints = append(endpoints, ep)
 		}
+	case KindBackend:
+		loggers.LoggerAPI.Error("amalii")
+		backend := resources.GetBackend(backendNamespace, string(backendRef.Name))
+		ep := ir.NewDestEndpoint(
+			backend.Spec.Services[0].Host,
+			uint32(backend.Spec.Services[0].Port))
+		endpoints = append(endpoints, ep)
 	}
 
 	// TODO: support mixed endpointslice address type for the same backendRef
diff --git a/adapter/internal/operator/gateway-api/translator/cluster.go b/adapter/internal/operator/gateway-api/translator/cluster.go
index f4fc1f270..fe29398cf 100644
--- a/adapter/internal/operator/gateway-api/translator/cluster.go
+++ b/adapter/internal/operator/gateway-api/translator/cluster.go
@@ -387,7 +387,7 @@ func buildXdsClusterLoadAssignment(clusterName string, destSettings []*ir.Destin
 						},
 					},
 				},
-			}	
+			}
 		}
 
 		for _, irEp := range ds.Endpoints {
diff --git a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
index 63ac758e9..eb2d06178 100644
--- a/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
+++ b/adapter/internal/operator/gateway-api/zz_generated.deepcopy.go
@@ -22,7 +22,6 @@
 package gatewayapi
 
 import (
-	"github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
 	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	corev1 "k8s.io/api/core/v1"
 	discoveryv1 "k8s.io/api/discovery/v1"
@@ -141,11 +140,11 @@ func (in *Resources) DeepCopyInto(out *Resources) {
 	}
 	if in.Backends != nil {
 		in, out := &in.Backends, &out.Backends
-		*out = make([]*v1alpha1.Backend, len(*in))
+		*out = make([]*dpv1alpha2.Backend, len(*in))
 		for i := range *in {
 			if (*in)[i] != nil {
 				in, out := &(*in)[i], &(*out)[i]
-				*out = new(v1alpha1.Backend)
+				*out = new(dpv1alpha2.Backend)
 				(*in).DeepCopyInto(*out)
 			}
 		}
diff --git a/adapter/internal/operator/synchronizer/gateway_synchronizer.go b/adapter/internal/operator/synchronizer/gateway_synchronizer.go
index 49e43a12b..4120df10e 100644
--- a/adapter/internal/operator/synchronizer/gateway_synchronizer.go
+++ b/adapter/internal/operator/synchronizer/gateway_synchronizer.go
@@ -105,16 +105,17 @@ func AddOrUpdateGateway(gatewayState GatewayState, state string) (string, error)
 	if state == constants.Create {
 		xds.GenerateGlobalClusters(gateway.Name)
 	}
-
-	xds.GenerateInterceptorClusters(gateway.Name, gwReqICluster, gwReqIAddresses, gwResICluster, gwResIAddresses)
-	xds.UpdateGatewayCache(gateway, resolvedListenerCerts, gwLuaScript, customRateLimitPolicies)
 	listeners, clusters, routes, endpoints, apis := xds.GenerateEnvoyResoucesForGateway(gateway.Name)
-	loggers.LoggerAPKOperator.Debugf("listeners: %v", listeners)
-	loggers.LoggerAPKOperator.Debugf("clusters: %v", clusters)
-	loggers.LoggerAPKOperator.Debugf("routes: %v", routes)
-	loggers.LoggerAPKOperator.Debugf("endpoints: %v", endpoints)
-	loggers.LoggerAPKOperator.Debugf("apis: %v", apis)
-	xds.UpdateXdsCacheWithLock(gateway.Name, endpoints, clusters, routes, listeners)
+	if !config.ReadConfigs().Adapter.EnableGatewayClassController {
+		xds.GenerateInterceptorClusters(gateway.Name, gwReqICluster, gwReqIAddresses, gwResICluster, gwResIAddresses)
+		xds.UpdateGatewayCache(gateway, resolvedListenerCerts, gwLuaScript, customRateLimitPolicies)
+		loggers.LoggerAPKOperator.Debugf("listeners: %v", listeners)
+		loggers.LoggerAPKOperator.Debugf("clusters: %v", clusters)
+		loggers.LoggerAPKOperator.Debugf("routes: %v", routes)
+		loggers.LoggerAPKOperator.Debugf("endpoints: %v", endpoints)
+		loggers.LoggerAPKOperator.Debugf("apis: %v", apis)
+		xds.UpdateXdsCacheWithLock(gateway.Name, endpoints, clusters, routes, listeners)
+	}
 	xds.UpdateEnforcerApis(gateway.Name, apis, "")
 	return "", nil
 }
diff --git a/adapter/internal/operator/utils/utils_test.go b/adapter/internal/operator/utils/utils_test.go
index 8599f2282..8d4a9e3ca 100644
--- a/adapter/internal/operator/utils/utils_test.go
+++ b/adapter/internal/operator/utils/utils_test.go
@@ -22,62 +22,62 @@ import (
 	"time"
 
 	"github.com/stretchr/testify/assert"
-	dpv1alpha1 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha1"
+	dpv1alpha2 "github.com/wso2/apk/common-go-libs/apis/dp/v1alpha2"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
 func TestTieBreaker(t *testing.T) {
 
 	type testItem struct {
-		objectList     []*dpv1alpha1.Backend
-		expectedObject *dpv1alpha1.Backend
+		objectList     []*dpv1alpha2.Backend
+		expectedObject *dpv1alpha2.Backend
 		message        string
 	}
 
 	newTime := time.Now()
 	newTimePlusOneMinute := newTime.Add(time.Minute * time.Duration(1))
 
-	policy1 := dpv1alpha1.Backend{
+	policy1 := dpv1alpha2.Backend{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:         "default",
 			Name:              "policy-1",
 			CreationTimestamp: metav1.NewTime(newTime),
 		},
-		Spec: dpv1alpha1.BackendSpec{
-			Protocol: dpv1alpha1.HTTPProtocol,
+		Spec: dpv1alpha2.BackendSpec{
+			Protocol: dpv1alpha2.HTTPProtocol,
 		},
 	}
 
-	policy2 := dpv1alpha1.Backend{
+	policy2 := dpv1alpha2.Backend{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:         "default",
 			Name:              "policy-2",
 			CreationTimestamp: metav1.NewTime(newTimePlusOneMinute),
 		},
-		Spec: dpv1alpha1.BackendSpec{
-			Protocol: dpv1alpha1.HTTPProtocol,
+		Spec: dpv1alpha2.BackendSpec{
+			Protocol: dpv1alpha2.HTTPProtocol,
 		},
 	}
 
-	policy3 := dpv1alpha1.Backend{
+	policy3 := dpv1alpha2.Backend{
 		ObjectMeta: metav1.ObjectMeta{
 			Namespace:         "default",
 			Name:              "policy-0",
 			CreationTimestamp: metav1.NewTime(newTime),
 		},
-		Spec: dpv1alpha1.BackendSpec{
-			Protocol: dpv1alpha1.HTTPProtocol,
+		Spec: dpv1alpha2.BackendSpec{
+			Protocol: dpv1alpha2.HTTPProtocol,
 		},
 	}
 
 	tests := []testItem{
 		{
-			objectList:     []*dpv1alpha1.Backend{&policy1, &policy2},
+			objectList:     []*dpv1alpha2.Backend{&policy1, &policy2},
 			expectedObject: &policy1,
 			message:        "Tie breaking using creation timestamps are different is not working",
 		},
 		{
-			objectList:     []*dpv1alpha1.Backend{&policy1, &policy3},
+			objectList:     []*dpv1alpha2.Backend{&policy1, &policy3},
 			expectedObject: &policy3,
 			message:        "Tie breaking using creation timestamps are equal is not working",
 		},

From b52d5b29c0c3234cd3331ae2252768bcf6126f3e Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 20 Sep 2024 12:55:05 +0530
Subject: [PATCH 32/40] add urlrewite for api routes

---
 .../kubernetes/proxy/resource_provider.go          | 14 ++++++++------
 .../gateway-api/provider/kubernetes/routes.go      | 11 +++++++++++
 .../data-plane/gateway-components/log-conf.yaml    |  2 ++
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
index 74cc8b848..2d1cd5b3a 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource_provider.go
@@ -116,13 +116,15 @@ func (r *ResourceRender) Service() (*corev1.Service, error) {
 	}
 
 	for _, port := range config.ReadConfigs().Deployment.Gateway.EnforcerPorts {
-		p := corev1.ServicePort{
-			Name:       ExpectedResourceHashedName(port.Name),
-			Protocol:   corev1.ProtocolTCP,
-			Port:       port.ContainerPort,
-			TargetPort: intstr.IntOrString{IntVal: port.ContainerPort},
+		if port.Expose {
+			p := corev1.ServicePort{
+				Name:       ExpectedResourceHashedName(port.Name),
+				Protocol:   corev1.ProtocolTCP,
+				Port:       port.ContainerPort,
+				TargetPort: intstr.IntOrString{IntVal: port.ContainerPort},
+			}
+			ports = append(ports, p)
 		}
-		ports = append(ports, p)
 	}
 
 	// Set the labels based on the owning gatewayclass name.
diff --git a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
index a4e8d5df9..37bf89ea6 100644
--- a/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
+++ b/adapter/internal/operator/gateway-api/provider/kubernetes/routes.go
@@ -229,6 +229,17 @@ func (r *gatewayReconcilerNew) processHTTPRoutes(ctx context.Context, gatewayNam
 									newMatches = append(newMatches, match)
 								}
 								rule.Matches = newMatches
+								rule.Filters = append(rule.Filters,
+									gwapiv1.HTTPRouteFilter{
+										Type: gwapiv1.HTTPRouteFilterURLRewrite,
+										URLRewrite: &gwapiv1.HTTPURLRewriteFilter{
+											Path: &gwapiv1.HTTPPathModifier{
+												Type:               gwapiv1.PrefixMatchHTTPPathModifier,
+												ReplacePrefixMatch: &api.Spec.BasePath,
+											},
+										},
+									},
+								)
 								newRules = append(newRules, rule)
 							}
 							hr.Spec.Rules = newRules
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index 7684d975e..cba00682b 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -18,12 +18,14 @@ data:
         javaOpts = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}"
       {{- end }}
       {{- range .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.ports}}
+      {{- if and .name .value }}
       [[deployment.gateway.enforcerPorts]]
         name = "{{ .name }}"
         containerPort = {{ .value }} 
         expose = {{ .expose | default false }}    
       {{- end }} 
       {{- end }} 
+      {{- end }} 
 
     [deployment.gateway.volumes]
       ratelimiterTruststoreSecretVolume = "{{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert"

From 38a56de642152e0260d255cf1ed130385265fe53 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Mon, 2 Sep 2024 10:44:57 +0530
Subject: [PATCH 33/40] Find matched api in enforcer

---
 .../proto/wso2/discovery/api/Resource.proto   |   1 +
 .../api/proto/wso2/discovery/api/api.proto    |   1 +
 .../discovery/config/enforcer/config.proto    |   2 +
 adapter/config/default_config.go              |   2 +
 adapter/config/types.go                       |   2 +
 adapter/internal/discovery/xds/marshaller.go  |   2 +
 .../internal/oasparser/config_generator.go    |   2 +
 .../envoyconf/envoyconf_internal_test.go      |   8 +-
 .../oasparser/envoyconf/listener_test.go      |   6 +-
 .../envoyconf/routes_with_clusters.go         |   4 +-
 .../oasparser/model/adapter_internal_api.go   |  11 +-
 .../internal/oasparser/model/api_operation.go |  13 +-
 adapter/internal/oasparser/model/common.go    |   9 +
 .../internal/oasparser/model/http_route.go    |  30 ++-
 .../kubernetes/proxy/resource.go              |   8 +-
 .../internal/operator/gateway-api/route.go    |   1 -
 .../v1alpha1/envoyproxy_helpers.go            |   7 +-
 .../gateway-api/v1alpha1/shared_types.go      |   2 -
 .../operator/gateway-api/version/version.go   |   3 +-
 .../api/wso2/discovery/api/Resource.pb.go     |  74 +++---
 .../api/wso2/discovery/api/api.pb.go          | 104 ++++----
 .../discovery/config/enforcer/config.pb.go    |  34 ++-
 .../commons/model/ResourceConfig.java         |  16 ++
 .../org/wso2/apk/enforcer/api/APIFactory.java |  46 +++-
 .../java/org/wso2/apk/enforcer/api/Utils.java |   4 +-
 .../apk/enforcer/config/ConfigHolder.java     |   1 +
 .../apk/enforcer/config/EnforcerConfig.java   |  10 +
 .../apk/enforcer/constants/APIConstants.java  |   1 +
 .../wso2/apk/enforcer/discovery/api/Api.java  | 238 ++++++++++++++++--
 .../enforcer/discovery/api/ApiOrBuilder.java  |  25 ++
 .../apk/enforcer/discovery/api/ApiProto.java  |  37 +--
 .../apk/enforcer/discovery/api/Operation.java | 218 ++++++++++++----
 .../discovery/api/OperationOrBuilder.java     |  36 +--
 .../enforcer/discovery/api/ResourceProto.java |  27 +-
 .../discovery/config/enforcer/Config.java     |  65 +++++
 .../config/enforcer/ConfigOrBuilder.java      |   6 +
 .../config/enforcer/ConfigProto.java          |  15 +-
 .../enforcer/graphql/GraphQLPayloadUtils.java |  13 +-
 .../enforcer/server/HttpRequestHandler.java   |  15 +-
 .../wso2/apk/enforcer/util/EndpointUtils.java |   7 +-
 40 files changed, 837 insertions(+), 269 deletions(-)

diff --git a/adapter/api/proto/wso2/discovery/api/Resource.proto b/adapter/api/proto/wso2/discovery/api/Resource.proto
index 45e4bfbb0..fac52a96c 100644
--- a/adapter/api/proto/wso2/discovery/api/Resource.proto
+++ b/adapter/api/proto/wso2/discovery/api/Resource.proto
@@ -46,6 +46,7 @@ message Operation {
 	string tier = 3;
 	OperationPolicies policies = 4;
 	repeated string scopes = 5;
+	string matchID = 6;
 	// MockedApiConfig mockedApiConfig = 6;
 }
 
diff --git a/adapter/api/proto/wso2/discovery/api/api.proto b/adapter/api/proto/wso2/discovery/api/api.proto
index 4e394e4dc..574fd78b6 100644
--- a/adapter/api/proto/wso2/discovery/api/api.proto
+++ b/adapter/api/proto/wso2/discovery/api/api.proto
@@ -53,6 +53,7 @@ message Api {
 	string mutualSSL = 15;
 	map<string, bool> applicationSecurity = 16;
 	bool transportSecurity = 17;
+	repeated string httpRouteIDs = 19;
 	/// string graphQLSchema = 22;
 	repeated GraphqlComplexity graphqlComplexityInfo = 23;
 	bool systemAPI = 24;
diff --git a/adapter/api/proto/wso2/discovery/config/enforcer/config.proto b/adapter/api/proto/wso2/discovery/config/enforcer/config.proto
index 9e7404f6d..595ec3911 100644
--- a/adapter/api/proto/wso2/discovery/config/enforcer/config.proto
+++ b/adapter/api/proto/wso2/discovery/config/enforcer/config.proto
@@ -53,4 +53,6 @@ message Config {
 
     bool mandateInternalKeyValidation = 15;
 
+    bool enableGatewayClassController = 16;
+
 }
diff --git a/adapter/config/default_config.go b/adapter/config/default_config.go
index b5fb0a0d9..37d1989b2 100644
--- a/adapter/config/default_config.go
+++ b/adapter/config/default_config.go
@@ -290,6 +290,8 @@ var defaultConfig = &Config{
 			CommonControllerXDSPort:  "18002",
 			CommonControllerRestPort: "18003",
 			EnforcerLabel:            "wso2-apk-default",
+			EnforcerImage:            "wso2/apk-enforcer:1.1.0",
+			EnforcerImagePullPolicy:  "Always",
 			EnforcerRegion:           "UNKNOWN",
 			EnforcerXDSMaxMsgSize:    "4194304",
 			EnforcerXDSMaxRetries:    "3",
diff --git a/adapter/config/types.go b/adapter/config/types.go
index 733bdefd8..4d86401bd 100644
--- a/adapter/config/types.go
+++ b/adapter/config/types.go
@@ -336,6 +336,8 @@ type gateway struct {
 	CommonControllerRestPort string
 	EnforcerLabel            string
 	EnforcerRegion           string
+	EnforcerImage            string
+	EnforcerImagePullPolicy  string
 	EnforcerXDSMaxMsgSize    string
 	EnforcerXDSMaxRetries    string
 	JavaOpts                 string
diff --git a/adapter/internal/discovery/xds/marshaller.go b/adapter/internal/discovery/xds/marshaller.go
index 7bfc4e805..2fe562c58 100644
--- a/adapter/internal/discovery/xds/marshaller.go
+++ b/adapter/internal/discovery/xds/marshaller.go
@@ -81,6 +81,7 @@ func MarshalConfig(config *config.Config) *enforcer.Config {
 	}
 	mandateSubscriptionValidation := config.Enforcer.MandateSubscriptionValidation
 	mandateInternalKeyValidation := config.Enforcer.MandateInternalKeyValidation
+	enableGatewayClassController := config.Adapter.EnableGatewayClassController
 
 	analytics := &enforcer.Analytics{
 		Enabled:            config.Analytics.Enabled,
@@ -160,6 +161,7 @@ func MarshalConfig(config *config.Config) *enforcer.Config {
 		Soap:                          soap,
 		MandateSubscriptionValidation: mandateSubscriptionValidation,
 		MandateInternalKeyValidation:  mandateInternalKeyValidation,
+		EnableGatewayClassController:  enableGatewayClassController,
 		HttpClient:                    httpClient,
 	}
 }
diff --git a/adapter/internal/oasparser/config_generator.go b/adapter/internal/oasparser/config_generator.go
index 807fdd9cb..6018e999c 100644
--- a/adapter/internal/oasparser/config_generator.go
+++ b/adapter/internal/oasparser/config_generator.go
@@ -241,6 +241,7 @@ func GetEnforcerAPI(adapterInternalAPI *model.AdapterInternalAPI, vhost string)
 			}
 			return nil
 		}(),
+		HttpRouteIDs: adapterInternalAPI.HTTPRouteIDs,
 	}
 }
 
@@ -263,6 +264,7 @@ func GetEnforcerAPIOperation(operation model.Operation, isMockedAPI bool) *api.O
 		ApiAuthentication: castAPIAuthenticationsToEnforcerAPIAuthentications(operation.GetAuthentication()),
 		Tier:              operation.GetTier(),
 		Policies:          policies,
+		MatchID:           operation.GetMatchID(),
 		// MockedApiConfig: mockedAPIConfig,
 	}
 	return &apiOperation
diff --git a/adapter/internal/oasparser/envoyconf/envoyconf_internal_test.go b/adapter/internal/oasparser/envoyconf/envoyconf_internal_test.go
index 1be24e1da..bc6b9d8c2 100644
--- a/adapter/internal/oasparser/envoyconf/envoyconf_internal_test.go
+++ b/adapter/internal/oasparser/envoyconf/envoyconf_internal_test.go
@@ -72,7 +72,7 @@ func TestCreateRoute(t *testing.T) {
 	})
 
 	resourceWithGet := model.CreateMinimalDummyResourceForTests("/xWso2BasePath/resourcePath",
-		[]*model.Operation{model.NewOperationWithPolicies("GET", policies)},
+		[]*model.Operation{model.NewOperationWithPolicies("GET", policies, "")},
 		"resource_operation_id", []model.Endpoint{endpoint}, true, false)
 	clusterName := "resource_operation_id"
 	hostRewriteSpecifier := &routev3.RouteAction_AutoHostRewrite{
@@ -142,7 +142,7 @@ func TestCreateRouteClusterSpecifier(t *testing.T) {
 		Port:    80,
 		RawURL:  "http://abc.com",
 	}
-	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil)},
+	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil, "")},
 		"resource_operation_id", []model.Endpoint{endpoint}, false, false)
 
 	route, err := createRoutes(generateRouteCreateParamsForUnitTests(title, apiType, vHost, xWso2BasePath, version, endpointBasePath,
@@ -173,7 +173,7 @@ func TestCreateRouteExtAuthzContext(t *testing.T) {
 		Port:    80,
 		RawURL:  "http://abc.com",
 	}
-	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil)},
+	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil, "")},
 		"resource_operation_id", []model.Endpoint{endpoint}, false, false)
 
 	route, err := createRoutes(generateRouteCreateParamsForUnitTests(title, apiType, vHost, xWso2BasePath, version,
@@ -570,7 +570,7 @@ func TestGetCorsPolicy(t *testing.T) {
 		"Cors Allowed Origin Header mismatch")
 	assert.Empty(t, corsPolicy3.GetAllowCredentials(), "Allow Credential property should not be assigned.")
 
-	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil)},
+	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{model.NewOperation("GET", nil, nil, "")},
 		"resource_operation_id", []model.Endpoint{endpoint}, false, false)
 
 	// Route without CORS configuration
diff --git a/adapter/internal/oasparser/envoyconf/listener_test.go b/adapter/internal/oasparser/envoyconf/listener_test.go
index cf17e636e..46e60833b 100644
--- a/adapter/internal/oasparser/envoyconf/listener_test.go
+++ b/adapter/internal/oasparser/envoyconf/listener_test.go
@@ -196,9 +196,9 @@ func testCreateRoutesForUnitTests(t *testing.T) []*routev3.Route {
 		RawURL:  "http://abc.com",
 	}
 
-	operationGet := model.NewOperation("GET", nil, nil)
-	operationPost := model.NewOperation("POST", nil, nil)
-	operationPut := model.NewOperation("PUT", nil, nil)
+	operationGet := model.NewOperation("GET", nil, nil, "")
+	operationPost := model.NewOperation("POST", nil, nil, "")
+	operationPut := model.NewOperation("PUT", nil, nil, "")
 	resourceWithGet := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{operationGet},
 		"resource_operation_id", []model.Endpoint{endpoint}, false, false)
 	resourceWithPost := model.CreateMinimalDummyResourceForTests("/resourcePath", []*model.Operation{operationPost},
diff --git a/adapter/internal/oasparser/envoyconf/routes_with_clusters.go b/adapter/internal/oasparser/envoyconf/routes_with_clusters.go
index b11ad5bed..cc0750aff 100644
--- a/adapter/internal/oasparser/envoyconf/routes_with_clusters.go
+++ b/adapter/internal/oasparser/envoyconf/routes_with_clusters.go
@@ -178,7 +178,7 @@ func CreateRoutesWithClusters(adapterInternalAPI *model.AdapterInternalAPI, inte
 				},
 			},
 		}
-		gqlop := model.NewOperationWithPolicies("POST", policies)
+		gqlop := model.NewOperationWithPolicies("POST", policies, "")
 		resource := model.CreateMinimalResource(adapterInternalAPI.GetXWso2Basepath(), []*model.Operation{gqlop}, "", adapterInternalAPI.Endpoints, true, false, gwapiv1.PathMatchExact)
 		routesP, err := createRoutes(genRouteCreateParams(adapterInternalAPI, &resource, vHost, basePath, clusterName, nil,
 			nil, organizationID, false, false, nil))
@@ -1074,7 +1074,7 @@ func createRoutes(params *routeCreateParams) (routes []*routev3.Route, err error
 				}
 			}
 			if !hasOptions {
-				operations = append(operations, model.NewOperation("OPTIONS", nil, nil))
+				operations = append(operations, model.NewOperation("OPTIONS", nil, nil, ""))
 			}
 		}
 
diff --git a/adapter/internal/oasparser/model/adapter_internal_api.go b/adapter/internal/oasparser/model/adapter_internal_api.go
index e861a0c95..27fcbad25 100644
--- a/adapter/internal/oasparser/model/adapter_internal_api.go
+++ b/adapter/internal/oasparser/model/adapter_internal_api.go
@@ -82,6 +82,7 @@ type AdapterInternalAPI struct {
 	Endpoints        *EndpointCluster
 	EndpointSecurity []*EndpointSecurity
 	AIProvider       InternalAIProvider
+	HTTPRouteIDs     []string
 }
 
 // BackendJWTTokenInfo represents the object structure holding the information related to the JWT Generator
@@ -889,7 +890,11 @@ func (adapterInternalAPI *AdapterInternalAPI) SetInfoHTTPRouteCR(httpRoute *gwap
 		loggers.LoggerOasparser.Debugf("Calculating auths for API ..., API_UUID = %v", adapterInternalAPI.UUID)
 		apiAuth := getSecurity(resourceAuthScheme)
 
-		for _, match := range rule.Matches {
+		if !hasRequestRedirectPolicy && len(rule.BackendRefs) < 1 {
+			return fmt.Errorf("no backendref were provided")
+		}
+
+		for matchID, match := range rule.Matches {
 			if hasURLRewritePolicy && hasRequestRedirectPolicy {
 				return fmt.Errorf("cannot have URL Rewrite and Request Redirect under the same rule")
 			}
@@ -909,8 +914,8 @@ func (adapterInternalAPI *AdapterInternalAPI) SetInfoHTTPRouteCR(httpRoute *gwap
 				})
 			}
 			resourcePath := adapterInternalAPI.xWso2Basepath + *match.Path.Value
-
-			operations := getAllowedOperations(match.Method, policies, apiAuth,
+			matchID := getMatchID(httpRoute.Namespace, httpRoute.Name, ruleID, matchID)
+			operations := getAllowedOperations(matchID, match.Method, policies, apiAuth,
 				parseRateLimitPolicyToInternal(resourceRatelimitPolicy), scopes, mirrorEndpointClusters)
 			
 			resource := &Resource{
diff --git a/adapter/internal/oasparser/model/api_operation.go b/adapter/internal/oasparser/model/api_operation.go
index 6220dbeb6..899a8fb02 100644
--- a/adapter/internal/oasparser/model/api_operation.go
+++ b/adapter/internal/oasparser/model/api_operation.go
@@ -44,6 +44,7 @@ type Operation struct {
 	mockedAPIConfig        *api.MockedApiConfig
 	rateLimitPolicy        *RateLimitPolicy
 	mirrorEndpointClusters []*EndpointCluster
+	matchID                string
 }
 
 // Authentication holds authentication related configurations
@@ -109,6 +110,10 @@ func (operation *Operation) GetTier() string {
 	return operation.tier
 }
 
+func (operation *Operation) GetMatchID() string {
+	return operation.matchID
+}
+
 // GetMockedAPIConfig returns the operation level mocked API implementation configs
 func (operation *Operation) GetMockedAPIConfig() *api.MockedApiConfig {
 	return operation.mockedAPIConfig
@@ -176,14 +181,14 @@ func (operation *Operation) GetCallInterceptorService(isIn bool) InterceptEndpoi
 }
 
 // NewOperation Creates and returns operation type object
-func NewOperation(method string, security []string, extensions map[string]interface{}) *Operation {
+func NewOperation(method string, security []string, extensions map[string]interface{}, matchID string) *Operation {
 	tier := ResolveThrottlingTier(extensions)
 	disableSecurity := ResolveDisableSecurity(extensions)
 	id := uuid.New().String()
-	return &Operation{id, method, security, nil, tier, disableSecurity, extensions, OperationPolicies{}, &api.MockedApiConfig{}, nil, nil}
+	return &Operation{id, method, security, nil, tier, disableSecurity, extensions, OperationPolicies{}, &api.MockedApiConfig{}, nil, nil, matchID}
 }
 
 // NewOperationWithPolicies Creates and returns operation with given method and policies
-func NewOperationWithPolicies(method string, policies OperationPolicies) *Operation {
-	return &Operation{iD: uuid.New().String(), method: method, policies: policies}
+func NewOperationWithPolicies(method string, policies OperationPolicies, matchID string) *Operation {
+	return &Operation{iD: uuid.New().String(), method: method, policies: policies, matchID: matchID}
 }
diff --git a/adapter/internal/oasparser/model/common.go b/adapter/internal/oasparser/model/common.go
index 8c5c2f54c..53ef4f4a1 100644
--- a/adapter/internal/oasparser/model/common.go
+++ b/adapter/internal/oasparser/model/common.go
@@ -22,6 +22,7 @@ package model
 
 import (
 	"errors"
+	"fmt"
 	"net/url"
 	"regexp"
 	"strconv"
@@ -155,3 +156,11 @@ func getHostandBasepathandPort(apiType string, rawURL string) (*Endpoint, error)
 
 	return &Endpoint{Host: host, Basepath: basepath, Port: port, URLType: urlType, RawURL: rawURL}, nil
 }
+
+func getRouteID(namespace, name string) string {
+	return fmt.Sprintf("httproute/%s/%s/", namespace, name)
+}
+
+func getMatchID(namespace, name string, ruleID, matchID int) string {
+	return fmt.Sprintf("%srule/%d/match/%d", getRouteID(namespace, name), ruleID, matchID)
+}
diff --git a/adapter/internal/oasparser/model/http_route.go b/adapter/internal/oasparser/model/http_route.go
index 6092dd66b..8aec6aa6a 100644
--- a/adapter/internal/oasparser/model/http_route.go
+++ b/adapter/internal/oasparser/model/http_route.go
@@ -287,26 +287,26 @@ func getSecurity(authScheme *dpv1alpha2.Authentication) *Authentication {
 }
 
 // getAllowedOperations retuns a list of allowed operatons, if httpMethod is not specified then all methods are allowed.
-func getAllowedOperations(httpMethod *gwapiv1.HTTPMethod, policies OperationPolicies, auth *Authentication,
+func getAllowedOperations(matchID string, httpMethod *gwapiv1.HTTPMethod, policies OperationPolicies, auth *Authentication,
 	ratelimitPolicy *RateLimitPolicy, scopes []string, mirrorEndpointClusters []*EndpointCluster) []*Operation {
 	if httpMethod != nil {
 		return []*Operation{{iD: uuid.New().String(), method: string(*httpMethod), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters}}
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID}}
 	}
 	return []*Operation{{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodGet), policies: policies,
-		auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes},
+		auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodPost), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters},
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodDelete), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters},
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodPatch), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters},
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodPut), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters},
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodHead), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters},
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID},
 		{iD: uuid.New().String(), method: string(gwapiv1.HTTPMethodOptions), policies: policies,
-			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters}}
+			auth: auth, rateLimitPolicy: ratelimitPolicy, scopes: scopes, mirrorEndpointClusters: mirrorEndpointClusters, matchID: matchID}}
 }
 
 // SetInfoAPICR populates ID, ApiType, Version and XWso2BasePath of adapterInternalAPI.
@@ -319,4 +319,16 @@ func (swagger *AdapterInternalAPI) SetInfoAPICR(api dpv1alpha3.API) {
 	swagger.OrganizationID = api.Spec.Organization
 	swagger.IsSystemAPI = api.Spec.SystemAPI
 	swagger.APIProperties = api.Spec.APIProperties
+	httpRouteIDs := []string{}
+	for _, route := range api.Spec.Production {
+		for _, routeRef := range route.RouteRefs {
+			httpRouteIDs = append(httpRouteIDs, getRouteID(api.Namespace, routeRef))
+		}
+	}
+	for _, route := range api.Spec.Sandbox {
+		for _, routeRef := range route.RouteRefs {
+			httpRouteIDs = append(httpRouteIDs, getRouteID(api.Namespace, routeRef))
+		}
+	}
+	swagger.HTTPRouteIDs = httpRouteIDs
 }
diff --git a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
index 631f4f357..c00b77c78 100644
--- a/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
+++ b/adapter/internal/operator/gateway-api/infrastructure/kubernetes/proxy/resource.go
@@ -272,11 +272,9 @@ func expectedProxyContainers(infra *ir.ProxyInfra,
 			},
 		},
 		{
-			Name:            enforcerContainerName,
-			Image:           *deploymentConfig.EnforcerContainer.Image,
-			ImagePullPolicy: corev1.PullIfNotPresent,
-			// Command:                  []string{"envoy"},
-			// Args:                     args,
+			Name:                     enforcerContainerName,
+			Image:                    *deploymentConfig.EnforcerContainer.Image,
+			ImagePullPolicy:          corev1.PullPolicy(config.ReadConfigs().Deployment.Gateway.EnforcerImagePullPolicy),
 			Env:                      expectedEnforcerEnv(deploymentConfig.EnforcerContainer),
 			Resources:                *deploymentConfig.EnforcerContainer.Resources,
 			SecurityContext:          deploymentConfig.EnforcerContainer.SecurityContext,
diff --git a/adapter/internal/operator/gateway-api/route.go b/adapter/internal/operator/gateway-api/route.go
index d293d5f54..989c28ca9 100644
--- a/adapter/internal/operator/gateway-api/route.go
+++ b/adapter/internal/operator/gateway-api/route.go
@@ -1145,7 +1145,6 @@ func (t *Translator) processDestination(backendRefContext BackendRefContext,
 			endpoints = append(endpoints, ep)
 		}
 	case KindBackend:
-		loggers.LoggerAPI.Error("amalii")
 		backend := resources.GetBackend(backendNamespace, string(backendRef.Name))
 		ep := ir.NewDestEndpoint(
 			backend.Spec.Services[0].Host,
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
index 666f39b99..b9df57fef 100644
--- a/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
+++ b/adapter/internal/operator/gateway-api/v1alpha1/envoyproxy_helpers.go
@@ -27,6 +27,7 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/wso2/apk/adapter/config"
 	autoscalingv2 "k8s.io/api/autoscaling/v2"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/resource"
@@ -54,7 +55,7 @@ func (e *EnvoyProxy) GetEnvoyProxyProvider() *EnvoyProxyProvider {
 // DefaultEnvoyProxyKubeProvider returns a new EnvoyProxyKubernetesProvider with default settings.
 func DefaultEnvoyProxyKubeProvider() *EnvoyProxyKubernetesProvider {
 	return &EnvoyProxyKubernetesProvider{
-		EnvoyDeployment: DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage),
+		EnvoyDeployment: DefaultKubernetesDeployment(DefaultEnvoyProxyImage, config.ReadConfigs().Deployment.Gateway.EnforcerImage),
 		EnvoyService:    DefaultKubernetesService(),
 	}
 }
@@ -88,10 +89,10 @@ func (r *EnvoyProxyProvider) GetEnvoyProxyKubeProvider() *EnvoyProxyKubernetesPr
 	}
 
 	if r.Kubernetes.EnvoyDeployment == nil {
-		r.Kubernetes.EnvoyDeployment = DefaultKubernetesDeployment(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+		r.Kubernetes.EnvoyDeployment = DefaultKubernetesDeployment(DefaultEnvoyProxyImage, config.ReadConfigs().Deployment.Gateway.EnforcerImage)
 	}
 
-	r.Kubernetes.EnvoyDeployment.defaultKubernetesDeploymentSpec(DefaultEnvoyProxyImage, DefaultEnforcerImage)
+	r.Kubernetes.EnvoyDeployment.defaultKubernetesDeploymentSpec(DefaultEnvoyProxyImage, config.ReadConfigs().Deployment.Gateway.EnforcerImage)
 
 	if r.Kubernetes.EnvoyService == nil {
 		r.Kubernetes.EnvoyService = DefaultKubernetesService()
diff --git a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
index 72fcdddbd..3030803b7 100644
--- a/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
+++ b/adapter/internal/operator/gateway-api/v1alpha1/shared_types.go
@@ -38,8 +38,6 @@ const (
 	DefaultDeploymentMemoryResourceRequests = "512Mi"
 	// DefaultEnvoyProxyImage is the default image used by envoyproxy
 	DefaultEnvoyProxyImage = "envoyproxy/envoy:distroless-v1.29.3"
-	// DefaultEnforcerImage default image used by enforcer
-	DefaultEnforcerImage = "wso2/apk-enforcer:1.1.0"
 	// DefaultShutdownManagerCPUResourceRequests for shutdown manager cpu resource
 	DefaultShutdownManagerCPUResourceRequests = "10m"
 	// DefaultShutdownManagerMemoryResourceRequests for shutdown manager memory resource
diff --git a/adapter/internal/operator/gateway-api/version/version.go b/adapter/internal/operator/gateway-api/version/version.go
index f320a6c07..f81bae213 100644
--- a/adapter/internal/operator/gateway-api/version/version.go
+++ b/adapter/internal/operator/gateway-api/version/version.go
@@ -29,6 +29,7 @@ import (
 	"runtime/debug"
 	"strings"
 
+	"github.com/wso2/apk/adapter/config"
 	"github.com/wso2/apk/adapter/internal/operator/gateway-api/v1alpha1"
 	"sigs.k8s.io/yaml"
 )
@@ -57,7 +58,7 @@ var (
 	envoyGatewayVersion    string
 	gatewayAPIVersion      string
 	envoyProxyVersion      = strings.Split(v1alpha1.DefaultEnvoyProxyImage, ":")[1]
-	enforcerVersion        = strings.Split(v1alpha1.DefaultEnforcerImage, ":")[1]
+	enforcerVersion        = strings.Split(config.ReadConfigs().Deployment.Gateway.EnforcerImage, ":")[1]
 	shutdownManagerVersion string
 	gitCommitID            string
 )
diff --git a/adapter/pkg/discovery/api/wso2/discovery/api/Resource.pb.go b/adapter/pkg/discovery/api/wso2/discovery/api/Resource.pb.go
index 8550adea6..83c7c0ece 100644
--- a/adapter/pkg/discovery/api/wso2/discovery/api/Resource.pb.go
+++ b/adapter/pkg/discovery/api/wso2/discovery/api/Resource.pb.go
@@ -126,7 +126,8 @@ type Operation struct {
 	ApiAuthentication *APIAuthentication `protobuf:"bytes,2,opt,name=apiAuthentication,proto3" json:"apiAuthentication,omitempty"`
 	Tier              string             `protobuf:"bytes,3,opt,name=tier,proto3" json:"tier,omitempty"`
 	Policies          *OperationPolicies `protobuf:"bytes,4,opt,name=policies,proto3" json:"policies,omitempty"`
-	Scopes            []string           `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"` // MockedApiConfig mockedApiConfig = 6;
+	Scopes            []string           `protobuf:"bytes,5,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	MatchID           string             `protobuf:"bytes,6,opt,name=matchID,proto3" json:"matchID,omitempty"` // MockedApiConfig mockedApiConfig = 6;
 }
 
 func (x *Operation) Reset() {
@@ -196,6 +197,13 @@ func (x *Operation) GetScopes() []string {
 	return nil
 }
 
+func (x *Operation) GetMatchID() string {
+	if x != nil {
+		return x.MatchID
+	}
+	return ""
+}
+
 // OperationPolicies holds policies of the APIM operations
 type OperationPolicies struct {
 	state         protoimpl.MessageState
@@ -346,7 +354,7 @@ var file_wso2_discovery_api_Resource_proto_rawDesc = []byte{
 	0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e,
 	0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f,
 	0x52, 0x10, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69,
-	0x74, 0x79, 0x22, 0xe7, 0x01, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x74, 0x79, 0x22, 0x81, 0x02, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
 	0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
 	0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x53, 0x0a, 0x11, 0x61, 0x70, 0x69, 0x41,
 	0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20,
@@ -360,37 +368,39 @@ var file_wso2_discovery_api_Resource_proto_rawDesc = []byte{
 	0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69,
 	0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x52, 0x08, 0x70, 0x6f, 0x6c, 0x69,
 	0x63, 0x69, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x05,
-	0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x22, 0xb3, 0x01, 0x0a,
-	0x11, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69,
-	0x65, 0x73, 0x12, 0x34, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f,
-	0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52,
-	0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x77, 0x73, 0x6f,
-	0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x30, 0x0a, 0x05, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x1a, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x05, 0x66, 0x61, 0x75,
-	0x6c, 0x74, 0x22, 0xab, 0x01, 0x0a, 0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x16, 0x0a,
-	0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x4a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74,
-	0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x77, 0x73, 0x6f, 0x32,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x18, 0x0a, 0x07,
+	0x6d, 0x61, 0x74, 0x63, 0x68, 0x49, 0x44, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6d,
+	0x61, 0x74, 0x63, 0x68, 0x49, 0x44, 0x22, 0xb3, 0x01, 0x0a, 0x11, 0x4f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x69, 0x65, 0x73, 0x12, 0x34, 0x0a, 0x07,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61,
+	0x70, 0x69, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x36, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x02,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x52, 0x08, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x30, 0x0a, 0x05, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x77, 0x73, 0x6f, 0x32,
 	0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50,
-	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
-	0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
-	0x42, 0x75, 0x0a, 0x23, 0x6f, 0x72, 0x67, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x61, 0x70, 0x6b,
-	0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
-	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f,
-	0x67, 0x6f, 0x2d, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65,
-	0x2f, 0x77, 0x73, 0x6f, 0x32, 0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f,
-	0x61, 0x70, 0x69, 0x3b, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x05, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x22, 0xab, 0x01, 0x0a,
+	0x06, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x4a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x2e,
+	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x1a, 0x3d, 0x0a, 0x0f, 0x50,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x75, 0x0a, 0x23, 0x6f, 0x72,
+	0x67, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x61, 0x70, 0x6b, 0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72,
+	0x63, 0x65, 0x72, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70,
+	0x69, 0x42, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x50, 0x72, 0x6f, 0x74, 0x6f,
+	0x50, 0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x65,
+	0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x67, 0x6f, 0x2d, 0x63, 0x6f, 0x6e,
+	0x74, 0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x77, 0x73, 0x6f, 0x32, 0x2f,
+	0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69, 0x3b, 0x61, 0x70,
+	0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/adapter/pkg/discovery/api/wso2/discovery/api/api.pb.go b/adapter/pkg/discovery/api/wso2/discovery/api/api.pb.go
index 8f785e8a2..5a3e1238b 100644
--- a/adapter/pkg/discovery/api/wso2/discovery/api/api.pb.go
+++ b/adapter/pkg/discovery/api/wso2/discovery/api/api.pb.go
@@ -60,6 +60,7 @@ type Api struct {
 	MutualSSL           string          `protobuf:"bytes,15,opt,name=mutualSSL,proto3" json:"mutualSSL,omitempty"`
 	ApplicationSecurity map[string]bool `protobuf:"bytes,16,rep,name=applicationSecurity,proto3" json:"applicationSecurity,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"varint,2,opt,name=value,proto3"`
 	TransportSecurity   bool            `protobuf:"varint,17,opt,name=transportSecurity,proto3" json:"transportSecurity,omitempty"`
+	HttpRouteIDs        []string        `protobuf:"bytes,19,rep,name=httpRouteIDs,proto3" json:"httpRouteIDs,omitempty"`
 	/// string graphQLSchema = 22;
 	GraphqlComplexityInfo  []*GraphqlComplexity `protobuf:"bytes,23,rep,name=graphqlComplexityInfo,proto3" json:"graphqlComplexityInfo,omitempty"`
 	SystemAPI              bool                 `protobuf:"varint,24,opt,name=systemAPI,proto3" json:"systemAPI,omitempty"`
@@ -223,6 +224,13 @@ func (x *Api) GetTransportSecurity() bool {
 	return false
 }
 
+func (x *Api) GetHttpRouteIDs() []string {
+	if x != nil {
+		return x.HttpRouteIDs
+	}
+	return nil
+}
+
 func (x *Api) GetGraphqlComplexityInfo() []*GraphqlComplexity {
 	if x != nil {
 		return x.GraphqlComplexityInfo
@@ -309,7 +317,7 @@ var file_wso2_discovery_api_api_proto_rawDesc = []byte{
 	0x2f, 0x67, 0x72, 0x61, 0x70, 0x68, 0x71, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x24,
 	0x77, 0x73, 0x6f, 0x32, 0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x61,
 	0x70, 0x69, 0x2f, 0x61, 0x69, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa7, 0x0a, 0x0a, 0x03, 0x41, 0x70, 0x69, 0x12, 0x0e, 0x0a, 0x02,
+	0x72, 0x6f, 0x74, 0x6f, 0x22, 0xcb, 0x0a, 0x0a, 0x03, 0x41, 0x70, 0x69, 0x12, 0x0e, 0x0a, 0x02,
 	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x05,
 	0x74, 0x69, 0x74, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x69, 0x74,
 	0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20,
@@ -352,54 +360,56 @@ var file_wso2_discovery_api_api_proto_rawDesc = []byte{
 	0x6e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x2c, 0x0a, 0x11, 0x74, 0x72, 0x61,
 	0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x18, 0x11,
 	0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x70, 0x6f, 0x72, 0x74, 0x53,
-	0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x5b, 0x0a, 0x15, 0x67, 0x72, 0x61, 0x70, 0x68,
-	0x71, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f,
-	0x18, 0x17, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69,
-	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x47, 0x72, 0x61, 0x70,
-	0x68, 0x71, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x74, 0x79, 0x52, 0x15, 0x67,
+	0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x22, 0x0a, 0x0c, 0x68, 0x74, 0x74, 0x70, 0x52,
+	0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x73, 0x18, 0x13, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x68,
+	0x74, 0x74, 0x70, 0x52, 0x6f, 0x75, 0x74, 0x65, 0x49, 0x44, 0x73, 0x12, 0x5b, 0x0a, 0x15, 0x67,
 	0x72, 0x61, 0x70, 0x68, 0x71, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x74, 0x79,
-	0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x41, 0x50,
-	0x49, 0x18, 0x18, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x41,
-	0x50, 0x49, 0x12, 0x59, 0x0a, 0x13, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x4a, 0x57, 0x54,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x19, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x27, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
-	0x2e, 0x61, 0x70, 0x69, 0x2e, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x4a, 0x57, 0x54, 0x54,
-	0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x13, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e,
-	0x64, 0x4a, 0x57, 0x54, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x2c, 0x0a,
-	0x11, 0x61, 0x70, 0x69, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x69,
-	0x6c, 0x65, 0x18, 0x1a, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x61, 0x70, 0x69, 0x44, 0x65, 0x66,
-	0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x20, 0x0a, 0x0b, 0x65,
-	0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0b, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x36, 0x0a,
-	0x16, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c,
-	0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x16, 0x73,
-	0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
-	0x74, 0x73, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e,
-	0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x45, 0x6e,
-	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x09, 0x65,
-	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x4c, 0x0a, 0x10, 0x65, 0x6e, 0x64, 0x70,
-	0x6f, 0x69, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x18, 0x1e, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76,
-	0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79,
-	0x49, 0x6e, 0x66, 0x6f, 0x52, 0x10, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x53, 0x65,
-	0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x69, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x77, 0x73, 0x6f,
+	0x49, 0x6e, 0x66, 0x6f, 0x18, 0x17, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x77, 0x73, 0x6f,
 	0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e,
-	0x41, 0x49, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x0a, 0x61, 0x69, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x1a, 0x46, 0x0a, 0x18, 0x41, 0x70, 0x70, 0x6c, 0x69, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x70,
-	0x0a, 0x23, 0x6f, 0x72, 0x67, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x61, 0x70, 0x6b, 0x2e, 0x65,
-	0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
-	0x79, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x08, 0x41, 0x70, 0x69, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50,
-	0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x65, 0x6e,
-	0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x67, 0x6f, 0x2d, 0x63, 0x6f, 0x6e, 0x74,
-	0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x77, 0x73, 0x6f, 0x32, 0x2f, 0x64,
-	0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69, 0x3b, 0x61, 0x70, 0x69,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x47, 0x72, 0x61, 0x70, 0x68, 0x71, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x78, 0x69, 0x74,
+	0x79, 0x52, 0x15, 0x67, 0x72, 0x61, 0x70, 0x68, 0x71, 0x6c, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x78, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x79, 0x73, 0x74,
+	0x65, 0x6d, 0x41, 0x50, 0x49, 0x18, 0x18, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x79, 0x73,
+	0x74, 0x65, 0x6d, 0x41, 0x50, 0x49, 0x12, 0x59, 0x0a, 0x13, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e,
+	0x64, 0x4a, 0x57, 0x54, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x18, 0x19, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f,
+	0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64,
+	0x4a, 0x57, 0x54, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x13, 0x62, 0x61,
+	0x63, 0x6b, 0x65, 0x6e, 0x64, 0x4a, 0x57, 0x54, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x2c, 0x0a, 0x11, 0x61, 0x70, 0x69, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69,
+	0x6f, 0x6e, 0x46, 0x69, 0x6c, 0x65, 0x18, 0x1a, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x11, 0x61, 0x70,
+	0x69, 0x44, 0x65, 0x66, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x46, 0x69, 0x6c, 0x65, 0x12,
+	0x20, 0x0a, 0x0b, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x1b,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e,
+	0x74, 0x12, 0x36, 0x0a, 0x16, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x1c, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x16, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x41, 0x0a, 0x09, 0x65, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x77,
+	0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70,
+	0x69, 0x2e, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x52, 0x09, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x12, 0x4c, 0x0a, 0x10,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79,
+	0x18, 0x1e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69,
+	0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x2e, 0x53, 0x65, 0x63, 0x75,
+	0x72, 0x69, 0x74, 0x79, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x10, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x12, 0x3e, 0x0a, 0x0a, 0x61, 0x69,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e,
+	0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e,
+	0x61, 0x70, 0x69, 0x2e, 0x41, 0x49, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x0a,
+	0x61, 0x69, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x1a, 0x46, 0x0a, 0x18, 0x41, 0x70,
+	0x70, 0x6c, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74,
+	0x79, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x42, 0x70, 0x0a, 0x23, 0x6f, 0x72, 0x67, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x61,
+	0x70, 0x6b, 0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2e, 0x64, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x61, 0x70, 0x69, 0x42, 0x08, 0x41, 0x70, 0x69, 0x50, 0x72,
+	0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x3d, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x67, 0x6f, 0x2d,
+	0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x77, 0x73,
+	0x6f, 0x32, 0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x61, 0x70, 0x69,
+	0x3b, 0x61, 0x70, 0x69, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/adapter/pkg/discovery/api/wso2/discovery/config/enforcer/config.pb.go b/adapter/pkg/discovery/api/wso2/discovery/config/enforcer/config.pb.go
index 0f0eca465..37011525c 100644
--- a/adapter/pkg/discovery/api/wso2/discovery/config/enforcer/config.pb.go
+++ b/adapter/pkg/discovery/api/wso2/discovery/config/enforcer/config.pb.go
@@ -41,6 +41,7 @@ type Config struct {
 	MandateSubscriptionValidation bool          `protobuf:"varint,13,opt,name=mandateSubscriptionValidation,proto3" json:"mandateSubscriptionValidation,omitempty"`
 	HttpClient                    *HttpClient   `protobuf:"bytes,14,opt,name=httpClient,proto3" json:"httpClient,omitempty"`
 	MandateInternalKeyValidation  bool          `protobuf:"varint,15,opt,name=mandateInternalKeyValidation,proto3" json:"mandateInternalKeyValidation,omitempty"`
+	EnableGatewayClassController  bool          `protobuf:"varint,16,opt,name=enableGatewayClassController,proto3" json:"enableGatewayClassController,omitempty"`
 }
 
 func (x *Config) Reset() {
@@ -180,6 +181,13 @@ func (x *Config) GetMandateInternalKeyValidation() bool {
 	return false
 }
 
+func (x *Config) GetEnableGatewayClassController() bool {
+	if x != nil {
+		return x.EnableGatewayClassController
+	}
+	return false
+}
+
 var File_wso2_discovery_config_enforcer_config_proto protoreflect.FileDescriptor
 
 var file_wso2_discovery_config_enforcer_config_proto_rawDesc = []byte{
@@ -222,7 +230,7 @@ var file_wso2_discovery_config_enforcer_config_proto_rawDesc = []byte{
 	0x73, 0x6f, 0x61, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2b, 0x77, 0x73, 0x6f, 0x32,
 	0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
 	0x67, 0x2f, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2f, 0x63, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa7, 0x08, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66,
+	0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xeb, 0x08, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66,
 	0x69, 0x67, 0x12, 0x44, 0x0a, 0x08, 0x73, 0x65, 0x63, 0x75, 0x72, 0x69, 0x74, 0x79, 0x18, 0x01,
 	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x64, 0x69, 0x73, 0x63,
 	0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x65, 0x6e, 0x66,
@@ -289,16 +297,20 @@ var file_wso2_discovery_config_enforcer_config_proto_rawDesc = []byte{
 	0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0f, 0x20,
 	0x01, 0x28, 0x08, 0x52, 0x1c, 0x6d, 0x61, 0x6e, 0x64, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x74, 0x65,
 	0x72, 0x6e, 0x61, 0x6c, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f,
-	0x6e, 0x42, 0x90, 0x01, 0x0a, 0x2f, 0x6f, 0x72, 0x67, 0x2e, 0x77, 0x73, 0x6f, 0x32, 0x2e, 0x61,
-	0x70, 0x6b, 0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2e, 0x64, 0x69, 0x73, 0x63,
-	0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x65, 0x6e, 0x66,
-	0x6f, 0x72, 0x63, 0x65, 0x72, 0x42, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x50, 0x72, 0x6f,
-	0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
-	0x2f, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f, 0x67, 0x6f, 0x2d, 0x63,
-	0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65, 0x2f, 0x77, 0x73, 0x6f,
-	0x32, 0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f, 0x63, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x2f, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x3b, 0x65, 0x6e, 0x66, 0x6f,
-	0x72, 0x63, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x6e, 0x12, 0x42, 0x0a, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x47, 0x61, 0x74, 0x65, 0x77,
+	0x61, 0x79, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x6c, 0x65,
+	0x72, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x47,
+	0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x43, 0x6c, 0x61, 0x73, 0x73, 0x43, 0x6f, 0x6e, 0x74, 0x72,
+	0x6f, 0x6c, 0x6c, 0x65, 0x72, 0x42, 0x90, 0x01, 0x0a, 0x2f, 0x6f, 0x72, 0x67, 0x2e, 0x77, 0x73,
+	0x6f, 0x32, 0x2e, 0x61, 0x70, 0x6b, 0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x2e,
+	0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2e, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x2e, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x42, 0x0b, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x4e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x65, 0x6e, 0x76, 0x6f, 0x79, 0x70, 0x72, 0x6f, 0x78, 0x79, 0x2f,
+	0x67, 0x6f, 0x2d, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x2d, 0x70, 0x6c, 0x61, 0x6e, 0x65,
+	0x2f, 0x77, 0x73, 0x6f, 0x32, 0x2f, 0x64, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x2f,
+	0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2f, 0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x3b,
+	0x65, 0x6e, 0x66, 0x6f, 0x72, 0x63, 0x65, 0x72, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/gateway/enforcer/org.wso2.apk.enforcer.commons/src/main/java/org/wso2/apk/enforcer/commons/model/ResourceConfig.java b/gateway/enforcer/org.wso2.apk.enforcer.commons/src/main/java/org/wso2/apk/enforcer/commons/model/ResourceConfig.java
index e70bc8559..27970a96e 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer.commons/src/main/java/org/wso2/apk/enforcer/commons/model/ResourceConfig.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer.commons/src/main/java/org/wso2/apk/enforcer/commons/model/ResourceConfig.java
@@ -27,6 +27,7 @@
 public class ResourceConfig {
 
     private String path;
+    private String matchID;
     private HttpMethods method;
     private String tier = "Unlimited";
     private EndpointCluster endpoints;
@@ -51,6 +52,19 @@ private HttpMethods(String value) {
         }
     }
 
+    /**
+     * Get the matching path Template for the request.
+     *
+     * @return path Template
+     */
+    public String getMatchID() {
+        return matchID;
+    }
+
+    public void setMatchID(String matchID) {
+        this.matchID = matchID;
+    }
+
     /**
      * Get the matching path Template for the request.
      *
@@ -91,6 +105,7 @@ public void setTier(String tier) {
     }
 
     //todo(amali) this don't need to be a map
+
     /**
      * Get the resource level endpoint cluster map for the corresponding Resource
      * where the map-key is either "PRODUCTION" or "SANDBOX".
@@ -133,6 +148,7 @@ public String[] getScopes() {
     public void setScopes(String[] scopes) {
         this.scopes = scopes;
     }
+
     public PolicyConfig getPolicyConfig() {
         return policyConfig;
     }
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/APIFactory.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/APIFactory.java
index ec2dc512e..85b78d5e6 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/APIFactory.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/APIFactory.java
@@ -21,6 +21,8 @@
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 import org.wso2.apk.enforcer.common.CacheProviderUtil;
+import org.wso2.apk.enforcer.config.ConfigHolder;
+import org.wso2.apk.enforcer.config.EnforcerConfig;
 import org.wso2.apk.enforcer.discovery.api.Api;
 import org.wso2.apk.enforcer.commons.model.APIConfig;
 import org.wso2.apk.enforcer.commons.model.ResourceConfig;
@@ -65,7 +67,7 @@ public void addApi(API api) {
     public void addApis(List<Api> apis) {
         //TODO: (Praminda) Use apiId as the map key. Need to add the apiId to envoy context meta
         Map<String, API> newApis = new ConcurrentHashMap<>();
-
+        EnforcerConfig enforcerConfig = ConfigHolder.getInstance().getConfig();
         for (Api api : apis) {
 //            if (APIConstants.ApiType.WEB_SOCKET.equals(api.getApiType())) {
 //                WebSocketAPI webSocketAPI = new WebSocketAPI();
@@ -76,18 +78,36 @@ public void addApis(List<Api> apis) {
             if (APIConstants.ApiType.GRAPHQL.equals(api.getApiType())) {
                 GraphQLAPI graphQLAPI = new GraphQLAPI();
                 graphQLAPI.init(api);
-                String apiKey = getApiKey(graphQLAPI);
-                newApis.put(apiKey, graphQLAPI);
+                if (enforcerConfig.getEnableGatewayClassController()) {
+                    for (String httpRouteID : api.getHttpRouteIDsList()) {
+                        newApis.put(httpRouteID, graphQLAPI);
+                    }
+                } else {
+                    String apiKey = getApiKey(graphQLAPI);
+                    newApis.put(apiKey, graphQLAPI);
+                }
             } else if (APIConstants.ApiType.GRPC.equals(api.getApiType())) {
                 GRPCAPI grpcAPI = new GRPCAPI();
                 grpcAPI.init(api);
-                String apiKey = getApiKey(grpcAPI);
-                newApis.put(apiKey, grpcAPI);
+                if (enforcerConfig.getEnableGatewayClassController()) {
+                    for (String httpRouteID : api.getHttpRouteIDsList()) {
+                        newApis.put(httpRouteID, grpcAPI);
+                    }
+                } else {
+                    String apiKey = getApiKey(grpcAPI);
+                    newApis.put(apiKey, grpcAPI);
+                }
             } else {
                 RestAPI enforcerApi = new RestAPI();
                 enforcerApi.init(api);
-                String apiKey = getApiKey(enforcerApi);
-                newApis.put(apiKey, enforcerApi);
+                if (enforcerConfig.getEnableGatewayClassController()) {
+                    for (String httpRouteID : api.getHttpRouteIDsList()) {
+                        newApis.put(httpRouteID, enforcerApi);
+                    }
+                } else {
+                    String apiKey = getApiKey(enforcerApi);
+                    newApis.put(apiKey, enforcerApi);
+                }
             }
         }
 
@@ -104,6 +124,12 @@ public void removeApi(API api) {
     }
 
     public API getMatchedAPI(CheckRequest request) {
+        EnforcerConfig enforcerConfig = ConfigHolder.getInstance().getConfig();
+        if (enforcerConfig.getEnableGatewayClassController()) {
+            String routeName = request.getAttributes().getContextExtensionsMap().get(APIConstants.ROUTE_NAME_PARAM);
+            String apikey = routeName.split("rule/")[0];
+            return apis.get(apikey);
+        }
         String vHost = request.getAttributes().getContextExtensionsMap().get(APIConstants.GW_VHOST_PARAM);
         String basePath = request.getAttributes().getContextExtensionsMap().get(APIConstants.GW_BASE_PATH_PARAM);
         String version = request.getAttributes().getContextExtensionsMap().get(APIConstants.GW_VERSION_PARAM);
@@ -136,6 +162,12 @@ public byte[] getAPIDefinition(final String basePath, final String version, fina
 //        return (WebSocketAPI) apis.get(apiKey);
 //    }
 
+    public ResourceConfig getMatchedResource(API api, String routeName) {
+        List<ResourceConfig> resourceConfigList = api.getAPIConfig().getResources();
+        return resourceConfigList.stream()
+                .filter(resourceConfig -> routeName.startsWith(resourceConfig.getMatchID()+"/")).findFirst().orElse(null);
+    }
+
     public ResourceConfig getMatchedResource(API api, String matchedResourcePath, String method) {
         List<ResourceConfig> resourceConfigList = api.getAPIConfig().getResources();
         if (APIConstants.ApiType.GRPC.equals(api.getAPIConfig().getApiType())) {
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/Utils.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/Utils.java
index c2b2d46bb..c43997aab 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/Utils.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/api/Utils.java
@@ -21,6 +21,7 @@
 import org.wso2.apk.enforcer.commons.model.AuthenticationConfig;
 import org.wso2.apk.enforcer.commons.model.JWTAuthenticationConfig;
 import org.wso2.apk.enforcer.commons.model.Oauth2AuthenticationConfig;
+import org.wso2.apk.enforcer.config.EnforcerConfig;
 import org.wso2.apk.enforcer.discovery.api.APIKey;
 import org.wso2.apk.enforcer.discovery.api.EndpointClusterConfig;
 import org.wso2.apk.enforcer.discovery.api.Operation;
@@ -87,6 +88,7 @@ public static EndpointCluster processEndpoints(org.wso2.apk.enforcer.discovery.a
 
     public static ResourceConfig buildResource(Operation operation, String resPath, EndpointSecurity[] endpointSecurity) {
         ResourceConfig resource = new ResourceConfig();
+        resource.setMatchID(operation.getMatchID());
         resource.setPath(resPath);
         resource.setMethod(ResourceConfig.HttpMethods.valueOf(operation.getMethod().toUpperCase()));
         resource.setTier(operation.getTier());
@@ -98,7 +100,7 @@ public static ResourceConfig buildResource(Operation operation, String resPath,
             JWTAuthenticationConfig jwtAuthenticationConfig = getDefaultJwtAuthenticationConfig();
             authenticationConfig.setJwtAuthenticationConfig(jwtAuthenticationConfig);
         }
-        
+
         if (operation.hasApiAuthentication()) {
             authenticationConfig.setDisabled(operation.getApiAuthentication().getDisabled());
             if (operation.getApiAuthentication().hasOauth2()) {
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/ConfigHolder.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/ConfigHolder.java
index 238f74491..2adaf1563 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/ConfigHolder.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/ConfigHolder.java
@@ -175,6 +175,7 @@ private void parseConfigs(Config config) {
         populateMandateSubscriptionValidationConfig(config.getMandateSubscriptionValidation());
         populateMandateInternalKeyValidationConfig(config.getMandateInternalKeyValidation());
         populateHttpClientConfig(config.getHttpClient());
+        this.config.setEnableGatewayClassController(config.getEnableGatewayClassController());
         // resolve string variables provided as environment variables.
         resolveConfigsWithEnvs(this.config);
     }
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnforcerConfig.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnforcerConfig.java
index c8eeb7586..789634146 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnforcerConfig.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/config/EnforcerConfig.java
@@ -63,7 +63,17 @@ public class EnforcerConfig {
     private boolean mandateSubscriptionValidation;
     private boolean mandateInternalKeyValidation;
     private ClientConfigDto httpClientConfigDto;
+    private boolean enableGatewayClassController;
 
+    public void setEnableGatewayClassController(Boolean enableGatewayClassController) {
+
+        this.enableGatewayClassController = enableGatewayClassController;
+    }
+
+    public Boolean  getEnableGatewayClassController() {
+
+        return enableGatewayClassController;
+    }
     public ClientConfigDto getHttpClientConfigDto() {
 
         return httpClientConfigDto;
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/constants/APIConstants.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/constants/APIConstants.java
index ddb0a747f..4e6da2259 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/constants/APIConstants.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/constants/APIConstants.java
@@ -26,6 +26,7 @@ public class APIConstants {
 
     public static final String DEFAULT = "default";
     public static final String GW_VHOST_PARAM = "vHost";
+    public static final String ROUTE_NAME_PARAM = "route-name";
     public static final String GW_BASE_PATH_PARAM = "basePath";
     public static final String GW_RES_PATH_PARAM = "path";
     public static final String GW_VERSION_PARAM = "version";
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Api.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Api.java
index 508410367..d72826742 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Api.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Api.java
@@ -33,6 +33,7 @@ private Api() {
     organizationId_ = "";
     clientCertificates_ = java.util.Collections.emptyList();
     mutualSSL_ = "";
+    httpRouteIDs_ = com.google.protobuf.LazyStringArrayList.EMPTY;
     graphqlComplexityInfo_ = java.util.Collections.emptyList();
     apiDefinitionFile_ = com.google.protobuf.ByteString.EMPTY;
     environment_ = "";
@@ -182,11 +183,20 @@ private Api(
             transportSecurity_ = input.readBool();
             break;
           }
-          case 186: {
+          case 154: {
+            java.lang.String s = input.readStringRequireUtf8();
             if (!((mutable_bitField0_ & 0x00000008) != 0)) {
-              graphqlComplexityInfo_ = new java.util.ArrayList<org.wso2.apk.enforcer.discovery.api.GraphqlComplexity>();
+              httpRouteIDs_ = new com.google.protobuf.LazyStringArrayList();
               mutable_bitField0_ |= 0x00000008;
             }
+            httpRouteIDs_.add(s);
+            break;
+          }
+          case 186: {
+            if (!((mutable_bitField0_ & 0x00000010) != 0)) {
+              graphqlComplexityInfo_ = new java.util.ArrayList<org.wso2.apk.enforcer.discovery.api.GraphqlComplexity>();
+              mutable_bitField0_ |= 0x00000010;
+            }
             graphqlComplexityInfo_.add(
                 input.readMessage(org.wso2.apk.enforcer.discovery.api.GraphqlComplexity.parser(), extensionRegistry));
             break;
@@ -239,9 +249,9 @@ private Api(
             break;
           }
           case 242: {
-            if (!((mutable_bitField0_ & 0x00000010) != 0)) {
+            if (!((mutable_bitField0_ & 0x00000020) != 0)) {
               endpointSecurity_ = new java.util.ArrayList<org.wso2.apk.enforcer.discovery.api.SecurityInfo>();
-              mutable_bitField0_ |= 0x00000010;
+              mutable_bitField0_ |= 0x00000020;
             }
             endpointSecurity_.add(
                 input.readMessage(org.wso2.apk.enforcer.discovery.api.SecurityInfo.parser(), extensionRegistry));
@@ -282,9 +292,12 @@ private Api(
         clientCertificates_ = java.util.Collections.unmodifiableList(clientCertificates_);
       }
       if (((mutable_bitField0_ & 0x00000008) != 0)) {
-        graphqlComplexityInfo_ = java.util.Collections.unmodifiableList(graphqlComplexityInfo_);
+        httpRouteIDs_ = httpRouteIDs_.getUnmodifiableView();
       }
       if (((mutable_bitField0_ & 0x00000010) != 0)) {
+        graphqlComplexityInfo_ = java.util.Collections.unmodifiableList(graphqlComplexityInfo_);
+      }
+      if (((mutable_bitField0_ & 0x00000020) != 0)) {
         endpointSecurity_ = java.util.Collections.unmodifiableList(endpointSecurity_);
       }
       this.unknownFields = unknownFields.build();
@@ -948,6 +961,41 @@ public boolean getTransportSecurity() {
     return transportSecurity_;
   }
 
+  public static final int HTTPROUTEIDS_FIELD_NUMBER = 19;
+  private com.google.protobuf.LazyStringList httpRouteIDs_;
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @return A list containing the httpRouteIDs.
+   */
+  public com.google.protobuf.ProtocolStringList
+      getHttpRouteIDsList() {
+    return httpRouteIDs_;
+  }
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @return The count of httpRouteIDs.
+   */
+  public int getHttpRouteIDsCount() {
+    return httpRouteIDs_.size();
+  }
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @param index The index of the element to return.
+   * @return The httpRouteIDs at the given index.
+   */
+  public java.lang.String getHttpRouteIDs(int index) {
+    return httpRouteIDs_.get(index);
+  }
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @param index The index of the value to return.
+   * @return The bytes of the httpRouteIDs at the given index.
+   */
+  public com.google.protobuf.ByteString
+      getHttpRouteIDsBytes(int index) {
+    return httpRouteIDs_.getByteString(index);
+  }
+
   public static final int GRAPHQLCOMPLEXITYINFO_FIELD_NUMBER = 23;
   private java.util.List<org.wso2.apk.enforcer.discovery.api.GraphqlComplexity> graphqlComplexityInfo_;
   /**
@@ -1265,6 +1313,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
     if (transportSecurity_ != false) {
       output.writeBool(17, transportSecurity_);
     }
+    for (int i = 0; i < httpRouteIDs_.size(); i++) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 19, httpRouteIDs_.getRaw(i));
+    }
     for (int i = 0; i < graphqlComplexityInfo_.size(); i++) {
       output.writeMessage(23, graphqlComplexityInfo_.get(i));
     }
@@ -1364,6 +1415,14 @@ public int getSerializedSize() {
       size += com.google.protobuf.CodedOutputStream
         .computeBoolSize(17, transportSecurity_);
     }
+    {
+      int dataSize = 0;
+      for (int i = 0; i < httpRouteIDs_.size(); i++) {
+        dataSize += computeStringSizeNoTag(httpRouteIDs_.getRaw(i));
+      }
+      size += dataSize;
+      size += 2 * getHttpRouteIDsList().size();
+    }
     for (int i = 0; i < graphqlComplexityInfo_.size(); i++) {
       size += com.google.protobuf.CodedOutputStream
         .computeMessageSize(23, graphqlComplexityInfo_.get(i));
@@ -1448,6 +1507,8 @@ public boolean equals(final java.lang.Object obj) {
         other.internalGetApplicationSecurity())) return false;
     if (getTransportSecurity()
         != other.getTransportSecurity()) return false;
+    if (!getHttpRouteIDsList()
+        .equals(other.getHttpRouteIDsList())) return false;
     if (!getGraphqlComplexityInfoList()
         .equals(other.getGraphqlComplexityInfoList())) return false;
     if (getSystemAPI()
@@ -1529,6 +1590,10 @@ public int hashCode() {
     hash = (37 * hash) + TRANSPORTSECURITY_FIELD_NUMBER;
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(
         getTransportSecurity());
+    if (getHttpRouteIDsCount() > 0) {
+      hash = (37 * hash) + HTTPROUTEIDS_FIELD_NUMBER;
+      hash = (53 * hash) + getHttpRouteIDsList().hashCode();
+    }
     if (getGraphqlComplexityInfoCount() > 0) {
       hash = (37 * hash) + GRAPHQLCOMPLEXITYINFO_FIELD_NUMBER;
       hash = (53 * hash) + getGraphqlComplexityInfoList().hashCode();
@@ -1763,9 +1828,11 @@ public Builder clear() {
       internalGetMutableApplicationSecurity().clear();
       transportSecurity_ = false;
 
+      httpRouteIDs_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      bitField0_ = (bitField0_ & ~0x00000008);
       if (graphqlComplexityInfoBuilder_ == null) {
         graphqlComplexityInfo_ = java.util.Collections.emptyList();
-        bitField0_ = (bitField0_ & ~0x00000008);
+        bitField0_ = (bitField0_ & ~0x00000010);
       } else {
         graphqlComplexityInfoBuilder_.clear();
       }
@@ -1791,7 +1858,7 @@ public Builder clear() {
       }
       if (endpointSecurityBuilder_ == null) {
         endpointSecurity_ = java.util.Collections.emptyList();
-        bitField0_ = (bitField0_ & ~0x00000010);
+        bitField0_ = (bitField0_ & ~0x00000020);
       } else {
         endpointSecurityBuilder_.clear();
       }
@@ -1862,10 +1929,15 @@ public org.wso2.apk.enforcer.discovery.api.Api buildPartial() {
       result.applicationSecurity_ = internalGetApplicationSecurity();
       result.applicationSecurity_.makeImmutable();
       result.transportSecurity_ = transportSecurity_;
+      if (((bitField0_ & 0x00000008) != 0)) {
+        httpRouteIDs_ = httpRouteIDs_.getUnmodifiableView();
+        bitField0_ = (bitField0_ & ~0x00000008);
+      }
+      result.httpRouteIDs_ = httpRouteIDs_;
       if (graphqlComplexityInfoBuilder_ == null) {
-        if (((bitField0_ & 0x00000008) != 0)) {
+        if (((bitField0_ & 0x00000010) != 0)) {
           graphqlComplexityInfo_ = java.util.Collections.unmodifiableList(graphqlComplexityInfo_);
-          bitField0_ = (bitField0_ & ~0x00000008);
+          bitField0_ = (bitField0_ & ~0x00000010);
         }
         result.graphqlComplexityInfo_ = graphqlComplexityInfo_;
       } else {
@@ -1886,9 +1958,9 @@ public org.wso2.apk.enforcer.discovery.api.Api buildPartial() {
         result.endpoints_ = endpointsBuilder_.build();
       }
       if (endpointSecurityBuilder_ == null) {
-        if (((bitField0_ & 0x00000010) != 0)) {
+        if (((bitField0_ & 0x00000020) != 0)) {
           endpointSecurity_ = java.util.Collections.unmodifiableList(endpointSecurity_);
-          bitField0_ = (bitField0_ & ~0x00000010);
+          bitField0_ = (bitField0_ & ~0x00000020);
         }
         result.endpointSecurity_ = endpointSecurity_;
       } else {
@@ -2054,11 +2126,21 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.api.Api other) {
       if (other.getTransportSecurity() != false) {
         setTransportSecurity(other.getTransportSecurity());
       }
+      if (!other.httpRouteIDs_.isEmpty()) {
+        if (httpRouteIDs_.isEmpty()) {
+          httpRouteIDs_ = other.httpRouteIDs_;
+          bitField0_ = (bitField0_ & ~0x00000008);
+        } else {
+          ensureHttpRouteIDsIsMutable();
+          httpRouteIDs_.addAll(other.httpRouteIDs_);
+        }
+        onChanged();
+      }
       if (graphqlComplexityInfoBuilder_ == null) {
         if (!other.graphqlComplexityInfo_.isEmpty()) {
           if (graphqlComplexityInfo_.isEmpty()) {
             graphqlComplexityInfo_ = other.graphqlComplexityInfo_;
-            bitField0_ = (bitField0_ & ~0x00000008);
+            bitField0_ = (bitField0_ & ~0x00000010);
           } else {
             ensureGraphqlComplexityInfoIsMutable();
             graphqlComplexityInfo_.addAll(other.graphqlComplexityInfo_);
@@ -2071,7 +2153,7 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.api.Api other) {
             graphqlComplexityInfoBuilder_.dispose();
             graphqlComplexityInfoBuilder_ = null;
             graphqlComplexityInfo_ = other.graphqlComplexityInfo_;
-            bitField0_ = (bitField0_ & ~0x00000008);
+            bitField0_ = (bitField0_ & ~0x00000010);
             graphqlComplexityInfoBuilder_ = 
               com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders ?
                  getGraphqlComplexityInfoFieldBuilder() : null;
@@ -2103,7 +2185,7 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.api.Api other) {
         if (!other.endpointSecurity_.isEmpty()) {
           if (endpointSecurity_.isEmpty()) {
             endpointSecurity_ = other.endpointSecurity_;
-            bitField0_ = (bitField0_ & ~0x00000010);
+            bitField0_ = (bitField0_ & ~0x00000020);
           } else {
             ensureEndpointSecurityIsMutable();
             endpointSecurity_.addAll(other.endpointSecurity_);
@@ -2116,7 +2198,7 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.api.Api other) {
             endpointSecurityBuilder_.dispose();
             endpointSecurityBuilder_ = null;
             endpointSecurity_ = other.endpointSecurity_;
-            bitField0_ = (bitField0_ & ~0x00000010);
+            bitField0_ = (bitField0_ & ~0x00000020);
             endpointSecurityBuilder_ = 
               com.google.protobuf.GeneratedMessageV3.alwaysUseFieldBuilders ?
                  getEndpointSecurityFieldBuilder() : null;
@@ -3767,12 +3849,122 @@ public Builder clearTransportSecurity() {
       return this;
     }
 
+    private com.google.protobuf.LazyStringList httpRouteIDs_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    private void ensureHttpRouteIDsIsMutable() {
+      if (!((bitField0_ & 0x00000008) != 0)) {
+        httpRouteIDs_ = new com.google.protobuf.LazyStringArrayList(httpRouteIDs_);
+        bitField0_ |= 0x00000008;
+       }
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @return A list containing the httpRouteIDs.
+     */
+    public com.google.protobuf.ProtocolStringList
+        getHttpRouteIDsList() {
+      return httpRouteIDs_.getUnmodifiableView();
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @return The count of httpRouteIDs.
+     */
+    public int getHttpRouteIDsCount() {
+      return httpRouteIDs_.size();
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param index The index of the element to return.
+     * @return The httpRouteIDs at the given index.
+     */
+    public java.lang.String getHttpRouteIDs(int index) {
+      return httpRouteIDs_.get(index);
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param index The index of the value to return.
+     * @return The bytes of the httpRouteIDs at the given index.
+     */
+    public com.google.protobuf.ByteString
+        getHttpRouteIDsBytes(int index) {
+      return httpRouteIDs_.getByteString(index);
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param index The index to set the value at.
+     * @param value The httpRouteIDs to set.
+     * @return This builder for chaining.
+     */
+    public Builder setHttpRouteIDs(
+        int index, java.lang.String value) {
+      if (value == null) {
+    throw new NullPointerException();
+  }
+  ensureHttpRouteIDsIsMutable();
+      httpRouteIDs_.set(index, value);
+      onChanged();
+      return this;
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param value The httpRouteIDs to add.
+     * @return This builder for chaining.
+     */
+    public Builder addHttpRouteIDs(
+        java.lang.String value) {
+      if (value == null) {
+    throw new NullPointerException();
+  }
+  ensureHttpRouteIDsIsMutable();
+      httpRouteIDs_.add(value);
+      onChanged();
+      return this;
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param values The httpRouteIDs to add.
+     * @return This builder for chaining.
+     */
+    public Builder addAllHttpRouteIDs(
+        java.lang.Iterable<java.lang.String> values) {
+      ensureHttpRouteIDsIsMutable();
+      com.google.protobuf.AbstractMessageLite.Builder.addAll(
+          values, httpRouteIDs_);
+      onChanged();
+      return this;
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @return This builder for chaining.
+     */
+    public Builder clearHttpRouteIDs() {
+      httpRouteIDs_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+      bitField0_ = (bitField0_ & ~0x00000008);
+      onChanged();
+      return this;
+    }
+    /**
+     * <code>repeated string httpRouteIDs = 19;</code>
+     * @param value The bytes of the httpRouteIDs to add.
+     * @return This builder for chaining.
+     */
+    public Builder addHttpRouteIDsBytes(
+        com.google.protobuf.ByteString value) {
+      if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+      ensureHttpRouteIDsIsMutable();
+      httpRouteIDs_.add(value);
+      onChanged();
+      return this;
+    }
+
     private java.util.List<org.wso2.apk.enforcer.discovery.api.GraphqlComplexity> graphqlComplexityInfo_ =
       java.util.Collections.emptyList();
     private void ensureGraphqlComplexityInfoIsMutable() {
-      if (!((bitField0_ & 0x00000008) != 0)) {
+      if (!((bitField0_ & 0x00000010) != 0)) {
         graphqlComplexityInfo_ = new java.util.ArrayList<org.wso2.apk.enforcer.discovery.api.GraphqlComplexity>(graphqlComplexityInfo_);
-        bitField0_ |= 0x00000008;
+        bitField0_ |= 0x00000010;
        }
     }
 
@@ -3966,7 +4158,7 @@ public Builder addAllGraphqlComplexityInfo(
     public Builder clearGraphqlComplexityInfo() {
       if (graphqlComplexityInfoBuilder_ == null) {
         graphqlComplexityInfo_ = java.util.Collections.emptyList();
-        bitField0_ = (bitField0_ & ~0x00000008);
+        bitField0_ = (bitField0_ & ~0x00000010);
         onChanged();
       } else {
         graphqlComplexityInfoBuilder_.clear();
@@ -4071,7 +4263,7 @@ public org.wso2.apk.enforcer.discovery.api.GraphqlComplexity.Builder addGraphqlC
         graphqlComplexityInfoBuilder_ = new com.google.protobuf.RepeatedFieldBuilderV3<
             org.wso2.apk.enforcer.discovery.api.GraphqlComplexity, org.wso2.apk.enforcer.discovery.api.GraphqlComplexity.Builder, org.wso2.apk.enforcer.discovery.api.GraphqlComplexityOrBuilder>(
                 graphqlComplexityInfo_,
-                ((bitField0_ & 0x00000008) != 0),
+                ((bitField0_ & 0x00000010) != 0),
                 getParentForChildren(),
                 isClean());
         graphqlComplexityInfo_ = null;
@@ -4492,9 +4684,9 @@ public org.wso2.apk.enforcer.discovery.api.EndpointClusterOrBuilder getEndpoints
     private java.util.List<org.wso2.apk.enforcer.discovery.api.SecurityInfo> endpointSecurity_ =
       java.util.Collections.emptyList();
     private void ensureEndpointSecurityIsMutable() {
-      if (!((bitField0_ & 0x00000010) != 0)) {
+      if (!((bitField0_ & 0x00000020) != 0)) {
         endpointSecurity_ = new java.util.ArrayList<org.wso2.apk.enforcer.discovery.api.SecurityInfo>(endpointSecurity_);
-        bitField0_ |= 0x00000010;
+        bitField0_ |= 0x00000020;
        }
     }
 
@@ -4644,7 +4836,7 @@ public Builder addAllEndpointSecurity(
     public Builder clearEndpointSecurity() {
       if (endpointSecurityBuilder_ == null) {
         endpointSecurity_ = java.util.Collections.emptyList();
-        bitField0_ = (bitField0_ & ~0x00000010);
+        bitField0_ = (bitField0_ & ~0x00000020);
         onChanged();
       } else {
         endpointSecurityBuilder_.clear();
@@ -4721,7 +4913,7 @@ public org.wso2.apk.enforcer.discovery.api.SecurityInfo.Builder addEndpointSecur
         endpointSecurityBuilder_ = new com.google.protobuf.RepeatedFieldBuilderV3<
             org.wso2.apk.enforcer.discovery.api.SecurityInfo, org.wso2.apk.enforcer.discovery.api.SecurityInfo.Builder, org.wso2.apk.enforcer.discovery.api.SecurityInfoOrBuilder>(
                 endpointSecurity_,
-                ((bitField0_ & 0x00000010) != 0),
+                ((bitField0_ & 0x00000020) != 0),
                 getParentForChildren(),
                 isClean());
         endpointSecurity_ = null;
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiOrBuilder.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiOrBuilder.java
index 437851660..6b1e2770d 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiOrBuilder.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiOrBuilder.java
@@ -259,6 +259,31 @@ boolean getApplicationSecurityOrThrow(
    */
   boolean getTransportSecurity();
 
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @return A list containing the httpRouteIDs.
+   */
+  java.util.List<java.lang.String>
+      getHttpRouteIDsList();
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @return The count of httpRouteIDs.
+   */
+  int getHttpRouteIDsCount();
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @param index The index of the element to return.
+   * @return The httpRouteIDs at the given index.
+   */
+  java.lang.String getHttpRouteIDs(int index);
+  /**
+   * <code>repeated string httpRouteIDs = 19;</code>
+   * @param index The index of the value to return.
+   * @return The bytes of the httpRouteIDs at the given index.
+   */
+  com.google.protobuf.ByteString
+      getHttpRouteIDsBytes(int index);
+
   /**
    * <pre>
    *&#47; string graphQLSchema = 22;
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiProto.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiProto.java
index 8f168c4d2..0a4e79198 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiProto.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ApiProto.java
@@ -41,7 +41,7 @@ public static void registerAllExtensions(
       "luster.proto\032&wso2/discovery/api/securit" +
       "y_info.proto\032 wso2/discovery/api/graphql" +
       ".proto\032$wso2/discovery/api/ai_provider.p" +
-      "roto\"\252\007\n\003Api\022\n\n\002id\030\001 \001(\t\022\r\n\005title\030\002 \001(\t\022" +
+      "roto\"\300\007\n\003Api\022\n\n\002id\030\001 \001(\t\022\r\n\005title\030\002 \001(\t\022" +
       "\017\n\007version\030\003 \001(\t\022\017\n\007apiType\030\004 \001(\t\022\036\n\026dis" +
       "ableAuthentications\030\005 \001(\010\022\025\n\rdisableScop" +
       "es\030\006 \001(\010\022\017\n\007envType\030\007 \001(\t\022/\n\tresources\030\010" +
@@ -52,22 +52,23 @@ public static void registerAllExtensions(
       "2\037.wso2.discovery.api.Certificate\022\021\n\tmut" +
       "ualSSL\030\017 \001(\t\022M\n\023applicationSecurity\030\020 \003(" +
       "\01320.wso2.discovery.api.Api.ApplicationSe" +
-      "curityEntry\022\031\n\021transportSecurity\030\021 \001(\010\022D" +
-      "\n\025graphqlComplexityInfo\030\027 \003(\0132%.wso2.dis" +
-      "covery.api.GraphqlComplexity\022\021\n\tsystemAP" +
-      "I\030\030 \001(\010\022D\n\023backendJWTTokenInfo\030\031 \001(\0132\'.w" +
-      "so2.discovery.api.BackendJWTTokenInfo\022\031\n" +
-      "\021apiDefinitionFile\030\032 \001(\014\022\023\n\013environment\030" +
-      "\033 \001(\t\022\036\n\026subscriptionValidation\030\034 \001(\010\0226\n" +
-      "\tendpoints\030\035 \001(\0132#.wso2.discovery.api.En" +
-      "dpointCluster\022:\n\020endpointSecurity\030\036 \003(\0132" +
-      " .wso2.discovery.api.SecurityInfo\0222\n\naip" +
-      "rovider\030\037 \001(\0132\036.wso2.discovery.api.AIPro" +
-      "vider\032:\n\030ApplicationSecurityEntry\022\013\n\003key" +
-      "\030\001 \001(\t\022\r\n\005value\030\002 \001(\010:\0028\001Bp\n#org.wso2.ap" +
-      "k.enforcer.discovery.apiB\010ApiProtoP\001Z=gi" +
-      "thub.com/envoyproxy/go-control-plane/wso" +
-      "2/discovery/api;apib\006proto3"
+      "curityEntry\022\031\n\021transportSecurity\030\021 \001(\010\022\024" +
+      "\n\014httpRouteIDs\030\023 \003(\t\022D\n\025graphqlComplexit" +
+      "yInfo\030\027 \003(\0132%.wso2.discovery.api.Graphql" +
+      "Complexity\022\021\n\tsystemAPI\030\030 \001(\010\022D\n\023backend" +
+      "JWTTokenInfo\030\031 \001(\0132\'.wso2.discovery.api." +
+      "BackendJWTTokenInfo\022\031\n\021apiDefinitionFile" +
+      "\030\032 \001(\014\022\023\n\013environment\030\033 \001(\t\022\036\n\026subscript" +
+      "ionValidation\030\034 \001(\010\0226\n\tendpoints\030\035 \001(\0132#" +
+      ".wso2.discovery.api.EndpointCluster\022:\n\020e" +
+      "ndpointSecurity\030\036 \003(\0132 .wso2.discovery.a" +
+      "pi.SecurityInfo\0222\n\naiprovider\030\037 \001(\0132\036.ws" +
+      "o2.discovery.api.AIProvider\032:\n\030Applicati" +
+      "onSecurityEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 " +
+      "\001(\010:\0028\001Bp\n#org.wso2.apk.enforcer.discove" +
+      "ry.apiB\010ApiProtoP\001Z=github.com/envoyprox" +
+      "y/go-control-plane/wso2/discovery/api;ap" +
+      "ib\006proto3"
     };
     descriptor = com.google.protobuf.Descriptors.FileDescriptor
       .internalBuildGeneratedFileFrom(descriptorData,
@@ -85,7 +86,7 @@ public static void registerAllExtensions(
     internal_static_wso2_discovery_api_Api_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_wso2_discovery_api_Api_descriptor,
-        new java.lang.String[] { "Id", "Title", "Version", "ApiType", "DisableAuthentications", "DisableScopes", "EnvType", "Resources", "BasePath", "Tier", "ApiLifeCycleState", "Vhost", "OrganizationId", "ClientCertificates", "MutualSSL", "ApplicationSecurity", "TransportSecurity", "GraphqlComplexityInfo", "SystemAPI", "BackendJWTTokenInfo", "ApiDefinitionFile", "Environment", "SubscriptionValidation", "Endpoints", "EndpointSecurity", "Aiprovider", });
+        new java.lang.String[] { "Id", "Title", "Version", "ApiType", "DisableAuthentications", "DisableScopes", "EnvType", "Resources", "BasePath", "Tier", "ApiLifeCycleState", "Vhost", "OrganizationId", "ClientCertificates", "MutualSSL", "ApplicationSecurity", "TransportSecurity", "HttpRouteIDs", "GraphqlComplexityInfo", "SystemAPI", "BackendJWTTokenInfo", "ApiDefinitionFile", "Environment", "SubscriptionValidation", "Endpoints", "EndpointSecurity", "Aiprovider", });
     internal_static_wso2_discovery_api_Api_ApplicationSecurityEntry_descriptor =
       internal_static_wso2_discovery_api_Api_descriptor.getNestedTypes().get(0);
     internal_static_wso2_discovery_api_Api_ApplicationSecurityEntry_fieldAccessorTable = new
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Operation.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Operation.java
index c1d341c12..b6a529edb 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Operation.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/Operation.java
@@ -23,6 +23,7 @@ private Operation() {
     method_ = "";
     tier_ = "";
     scopes_ = com.google.protobuf.LazyStringArrayList.EMPTY;
+    matchID_ = "";
   }
 
   @java.lang.Override
@@ -103,6 +104,12 @@ private Operation(
             scopes_.add(s);
             break;
           }
+          case 50: {
+            java.lang.String s = input.readStringRequireUtf8();
+
+            matchID_ = s;
+            break;
+          }
           default: {
             if (!parseUnknownField(
                 input, unknownFields, extensionRegistry, tag)) {
@@ -269,10 +276,6 @@ public org.wso2.apk.enforcer.discovery.api.OperationPoliciesOrBuilder getPolicie
   public static final int SCOPES_FIELD_NUMBER = 5;
   private com.google.protobuf.LazyStringList scopes_;
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @return A list containing the scopes.
    */
@@ -281,10 +284,6 @@ public org.wso2.apk.enforcer.discovery.api.OperationPoliciesOrBuilder getPolicie
     return scopes_;
   }
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @return The count of scopes.
    */
@@ -292,10 +291,6 @@ public int getScopesCount() {
     return scopes_.size();
   }
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @param index The index of the element to return.
    * @return The scopes at the given index.
@@ -304,10 +299,6 @@ public java.lang.String getScopes(int index) {
     return scopes_.get(index);
   }
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @param index The index of the value to return.
    * @return The bytes of the scopes at the given index.
@@ -317,6 +308,52 @@ public java.lang.String getScopes(int index) {
     return scopes_.getByteString(index);
   }
 
+  public static final int MATCHID_FIELD_NUMBER = 6;
+  private volatile java.lang.Object matchID_;
+  /**
+   * <pre>
+   * MockedApiConfig mockedApiConfig = 6;
+   * </pre>
+   *
+   * <code>string matchID = 6;</code>
+   * @return The matchID.
+   */
+  @java.lang.Override
+  public java.lang.String getMatchID() {
+    java.lang.Object ref = matchID_;
+    if (ref instanceof java.lang.String) {
+      return (java.lang.String) ref;
+    } else {
+      com.google.protobuf.ByteString bs = 
+          (com.google.protobuf.ByteString) ref;
+      java.lang.String s = bs.toStringUtf8();
+      matchID_ = s;
+      return s;
+    }
+  }
+  /**
+   * <pre>
+   * MockedApiConfig mockedApiConfig = 6;
+   * </pre>
+   *
+   * <code>string matchID = 6;</code>
+   * @return The bytes for matchID.
+   */
+  @java.lang.Override
+  public com.google.protobuf.ByteString
+      getMatchIDBytes() {
+    java.lang.Object ref = matchID_;
+    if (ref instanceof java.lang.String) {
+      com.google.protobuf.ByteString b = 
+          com.google.protobuf.ByteString.copyFromUtf8(
+              (java.lang.String) ref);
+      matchID_ = b;
+      return b;
+    } else {
+      return (com.google.protobuf.ByteString) ref;
+    }
+  }
+
   private byte memoizedIsInitialized = -1;
   @java.lang.Override
   public final boolean isInitialized() {
@@ -346,6 +383,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
     for (int i = 0; i < scopes_.size(); i++) {
       com.google.protobuf.GeneratedMessageV3.writeString(output, 5, scopes_.getRaw(i));
     }
+    if (!getMatchIDBytes().isEmpty()) {
+      com.google.protobuf.GeneratedMessageV3.writeString(output, 6, matchID_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -377,6 +417,9 @@ public int getSerializedSize() {
       size += dataSize;
       size += 1 * getScopesList().size();
     }
+    if (!getMatchIDBytes().isEmpty()) {
+      size += com.google.protobuf.GeneratedMessageV3.computeStringSize(6, matchID_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -408,6 +451,8 @@ public boolean equals(final java.lang.Object obj) {
     }
     if (!getScopesList()
         .equals(other.getScopesList())) return false;
+    if (!getMatchID()
+        .equals(other.getMatchID())) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -435,6 +480,8 @@ public int hashCode() {
       hash = (37 * hash) + SCOPES_FIELD_NUMBER;
       hash = (53 * hash) + getScopesList().hashCode();
     }
+    hash = (37 * hash) + MATCHID_FIELD_NUMBER;
+    hash = (53 * hash) + getMatchID().hashCode();
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -590,6 +637,8 @@ public Builder clear() {
       }
       scopes_ = com.google.protobuf.LazyStringArrayList.EMPTY;
       bitField0_ = (bitField0_ & ~0x00000001);
+      matchID_ = "";
+
       return this;
     }
 
@@ -634,6 +683,7 @@ public org.wso2.apk.enforcer.discovery.api.Operation buildPartial() {
         bitField0_ = (bitField0_ & ~0x00000001);
       }
       result.scopes_ = scopes_;
+      result.matchID_ = matchID_;
       onBuilt();
       return result;
     }
@@ -706,6 +756,10 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.api.Operation other) {
         }
         onChanged();
       }
+      if (!other.getMatchID().isEmpty()) {
+        matchID_ = other.matchID_;
+        onChanged();
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -1134,10 +1188,6 @@ private void ensureScopesIsMutable() {
        }
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @return A list containing the scopes.
      */
@@ -1146,10 +1196,6 @@ private void ensureScopesIsMutable() {
       return scopes_.getUnmodifiableView();
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @return The count of scopes.
      */
@@ -1157,10 +1203,6 @@ public int getScopesCount() {
       return scopes_.size();
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param index The index of the element to return.
      * @return The scopes at the given index.
@@ -1169,10 +1211,6 @@ public java.lang.String getScopes(int index) {
       return scopes_.get(index);
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param index The index of the value to return.
      * @return The bytes of the scopes at the given index.
@@ -1182,10 +1220,6 @@ public java.lang.String getScopes(int index) {
       return scopes_.getByteString(index);
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param index The index to set the value at.
      * @param value The scopes to set.
@@ -1202,10 +1236,6 @@ public Builder setScopes(
       return this;
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param value The scopes to add.
      * @return This builder for chaining.
@@ -1221,10 +1251,6 @@ public Builder addScopes(
       return this;
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param values The scopes to add.
      * @return This builder for chaining.
@@ -1238,10 +1264,6 @@ public Builder addAllScopes(
       return this;
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @return This builder for chaining.
      */
@@ -1252,10 +1274,6 @@ public Builder clearScopes() {
       return this;
     }
     /**
-     * <pre>
-     * MockedApiConfig mockedApiConfig = 6;
-     * </pre>
-     *
      * <code>repeated string scopes = 5;</code>
      * @param value The bytes of the scopes to add.
      * @return This builder for chaining.
@@ -1271,6 +1289,102 @@ public Builder addScopesBytes(
       onChanged();
       return this;
     }
+
+    private java.lang.Object matchID_ = "";
+    /**
+     * <pre>
+     * MockedApiConfig mockedApiConfig = 6;
+     * </pre>
+     *
+     * <code>string matchID = 6;</code>
+     * @return The matchID.
+     */
+    public java.lang.String getMatchID() {
+      java.lang.Object ref = matchID_;
+      if (!(ref instanceof java.lang.String)) {
+        com.google.protobuf.ByteString bs =
+            (com.google.protobuf.ByteString) ref;
+        java.lang.String s = bs.toStringUtf8();
+        matchID_ = s;
+        return s;
+      } else {
+        return (java.lang.String) ref;
+      }
+    }
+    /**
+     * <pre>
+     * MockedApiConfig mockedApiConfig = 6;
+     * </pre>
+     *
+     * <code>string matchID = 6;</code>
+     * @return The bytes for matchID.
+     */
+    public com.google.protobuf.ByteString
+        getMatchIDBytes() {
+      java.lang.Object ref = matchID_;
+      if (ref instanceof String) {
+        com.google.protobuf.ByteString b = 
+            com.google.protobuf.ByteString.copyFromUtf8(
+                (java.lang.String) ref);
+        matchID_ = b;
+        return b;
+      } else {
+        return (com.google.protobuf.ByteString) ref;
+      }
+    }
+    /**
+     * <pre>
+     * MockedApiConfig mockedApiConfig = 6;
+     * </pre>
+     *
+     * <code>string matchID = 6;</code>
+     * @param value The matchID to set.
+     * @return This builder for chaining.
+     */
+    public Builder setMatchID(
+        java.lang.String value) {
+      if (value == null) {
+    throw new NullPointerException();
+  }
+  
+      matchID_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     * <pre>
+     * MockedApiConfig mockedApiConfig = 6;
+     * </pre>
+     *
+     * <code>string matchID = 6;</code>
+     * @return This builder for chaining.
+     */
+    public Builder clearMatchID() {
+      
+      matchID_ = getDefaultInstance().getMatchID();
+      onChanged();
+      return this;
+    }
+    /**
+     * <pre>
+     * MockedApiConfig mockedApiConfig = 6;
+     * </pre>
+     *
+     * <code>string matchID = 6;</code>
+     * @param value The bytes for matchID to set.
+     * @return This builder for chaining.
+     */
+    public Builder setMatchIDBytes(
+        com.google.protobuf.ByteString value) {
+      if (value == null) {
+    throw new NullPointerException();
+  }
+  checkByteStringIsUtf8(value);
+      
+      matchID_ = value;
+      onChanged();
+      return this;
+    }
     @java.lang.Override
     public final Builder setUnknownFields(
         final com.google.protobuf.UnknownFieldSet unknownFields) {
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/OperationOrBuilder.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/OperationOrBuilder.java
index 5eb178d36..c8185fa4a 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/OperationOrBuilder.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/OperationOrBuilder.java
@@ -62,43 +62,47 @@ public interface OperationOrBuilder extends
   org.wso2.apk.enforcer.discovery.api.OperationPoliciesOrBuilder getPoliciesOrBuilder();
 
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @return A list containing the scopes.
    */
   java.util.List<java.lang.String>
       getScopesList();
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @return The count of scopes.
    */
   int getScopesCount();
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @param index The index of the element to return.
    * @return The scopes at the given index.
    */
   java.lang.String getScopes(int index);
   /**
-   * <pre>
-   * MockedApiConfig mockedApiConfig = 6;
-   * </pre>
-   *
    * <code>repeated string scopes = 5;</code>
    * @param index The index of the value to return.
    * @return The bytes of the scopes at the given index.
    */
   com.google.protobuf.ByteString
       getScopesBytes(int index);
+
+  /**
+   * <pre>
+   * MockedApiConfig mockedApiConfig = 6;
+   * </pre>
+   *
+   * <code>string matchID = 6;</code>
+   * @return The matchID.
+   */
+  java.lang.String getMatchID();
+  /**
+   * <pre>
+   * MockedApiConfig mockedApiConfig = 6;
+   * </pre>
+   *
+   * <code>string matchID = 6;</code>
+   * @return The bytes for matchID.
+   */
+  com.google.protobuf.ByteString
+      getMatchIDBytes();
 }
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ResourceProto.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ResourceProto.java
index a8f5f727b..3b26d4fcc 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ResourceProto.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/api/ResourceProto.java
@@ -57,22 +57,23 @@ public static void registerAllExtensions(
       "\035.wso2.discovery.api.Operation\0226\n\tendpoi" +
       "nts\030\004 \001(\0132#.wso2.discovery.api.EndpointC" +
       "luster\022:\n\020endpointSecurity\030\005 \003(\0132 .wso2." +
-      "discovery.api.SecurityInfo\"\264\001\n\tOperation" +
+      "discovery.api.SecurityInfo\"\305\001\n\tOperation" +
       "\022\016\n\006method\030\001 \001(\t\022@\n\021apiAuthentication\030\002 " +
       "\001(\0132%.wso2.discovery.api.APIAuthenticati" +
       "on\022\014\n\004tier\030\003 \001(\t\0227\n\010policies\030\004 \001(\0132%.wso" +
       "2.discovery.api.OperationPolicies\022\016\n\006sco" +
-      "pes\030\005 \003(\t\"\231\001\n\021OperationPolicies\022+\n\007reque" +
-      "st\030\001 \003(\0132\032.wso2.discovery.api.Policy\022,\n\010" +
-      "response\030\002 \003(\0132\032.wso2.discovery.api.Poli" +
-      "cy\022)\n\005fault\030\003 \003(\0132\032.wso2.discovery.api.P" +
-      "olicy\"\213\001\n\006Policy\022\016\n\006action\030\001 \001(\t\022>\n\npara" +
-      "meters\030\002 \003(\0132*.wso2.discovery.api.Policy" +
-      ".ParametersEntry\0321\n\017ParametersEntry\022\013\n\003k" +
-      "ey\030\001 \001(\t\022\r\n\005value\030\002 \001(\t:\0028\001Bu\n#org.wso2." +
-      "apk.enforcer.discovery.apiB\rResourceProt" +
-      "oP\001Z=github.com/envoyproxy/go-control-pl" +
-      "ane/wso2/discovery/api;apib\006proto3"
+      "pes\030\005 \003(\t\022\017\n\007matchID\030\006 \001(\t\"\231\001\n\021Operation" +
+      "Policies\022+\n\007request\030\001 \003(\0132\032.wso2.discove" +
+      "ry.api.Policy\022,\n\010response\030\002 \003(\0132\032.wso2.d" +
+      "iscovery.api.Policy\022)\n\005fault\030\003 \003(\0132\032.wso" +
+      "2.discovery.api.Policy\"\213\001\n\006Policy\022\016\n\006act" +
+      "ion\030\001 \001(\t\022>\n\nparameters\030\002 \003(\0132*.wso2.dis" +
+      "covery.api.Policy.ParametersEntry\0321\n\017Par" +
+      "ametersEntry\022\013\n\003key\030\001 \001(\t\022\r\n\005value\030\002 \001(\t" +
+      ":\0028\001Bu\n#org.wso2.apk.enforcer.discovery." +
+      "apiB\rResourceProtoP\001Z=github.com/envoypr" +
+      "oxy/go-control-plane/wso2/discovery/api;" +
+      "apib\006proto3"
     };
     descriptor = com.google.protobuf.Descriptors.FileDescriptor
       .internalBuildGeneratedFileFrom(descriptorData,
@@ -92,7 +93,7 @@ public static void registerAllExtensions(
     internal_static_wso2_discovery_api_Operation_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_wso2_discovery_api_Operation_descriptor,
-        new java.lang.String[] { "Method", "ApiAuthentication", "Tier", "Policies", "Scopes", });
+        new java.lang.String[] { "Method", "ApiAuthentication", "Tier", "Policies", "Scopes", "MatchID", });
     internal_static_wso2_discovery_api_OperationPolicies_descriptor =
       getDescriptor().getMessageTypes().get(2);
     internal_static_wso2_discovery_api_OperationPolicies_fieldAccessorTable = new
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/Config.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/Config.java
index e6d37cb50..3a427d967 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/Config.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/Config.java
@@ -229,6 +229,11 @@ private Config(
             mandateInternalKeyValidation_ = input.readBool();
             break;
           }
+          case 128: {
+
+            enableGatewayClassController_ = input.readBool();
+            break;
+          }
           default: {
             if (!parseUnknownField(
                 input, unknownFields, extensionRegistry, tag)) {
@@ -638,6 +643,17 @@ public boolean getMandateInternalKeyValidation() {
     return mandateInternalKeyValidation_;
   }
 
+  public static final int ENABLEGATEWAYCLASSCONTROLLER_FIELD_NUMBER = 16;
+  private boolean enableGatewayClassController_;
+  /**
+   * <code>bool enableGatewayClassController = 16;</code>
+   * @return The enableGatewayClassController.
+   */
+  @java.lang.Override
+  public boolean getEnableGatewayClassController() {
+    return enableGatewayClassController_;
+  }
+
   private byte memoizedIsInitialized = -1;
   @java.lang.Override
   public final boolean isInitialized() {
@@ -697,6 +713,9 @@ public void writeTo(com.google.protobuf.CodedOutputStream output)
     if (mandateInternalKeyValidation_ != false) {
       output.writeBool(15, mandateInternalKeyValidation_);
     }
+    if (enableGatewayClassController_ != false) {
+      output.writeBool(16, enableGatewayClassController_);
+    }
     unknownFields.writeTo(output);
   }
 
@@ -766,6 +785,10 @@ public int getSerializedSize() {
       size += com.google.protobuf.CodedOutputStream
         .computeBoolSize(15, mandateInternalKeyValidation_);
     }
+    if (enableGatewayClassController_ != false) {
+      size += com.google.protobuf.CodedOutputStream
+        .computeBoolSize(16, enableGatewayClassController_);
+    }
     size += unknownFields.getSerializedSize();
     memoizedSize = size;
     return size;
@@ -847,6 +870,8 @@ public boolean equals(final java.lang.Object obj) {
     }
     if (getMandateInternalKeyValidation()
         != other.getMandateInternalKeyValidation()) return false;
+    if (getEnableGatewayClassController()
+        != other.getEnableGatewayClassController()) return false;
     if (!unknownFields.equals(other.unknownFields)) return false;
     return true;
   }
@@ -916,6 +941,9 @@ public int hashCode() {
     hash = (37 * hash) + MANDATEINTERNALKEYVALIDATION_FIELD_NUMBER;
     hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(
         getMandateInternalKeyValidation());
+    hash = (37 * hash) + ENABLEGATEWAYCLASSCONTROLLER_FIELD_NUMBER;
+    hash = (53 * hash) + com.google.protobuf.Internal.hashBoolean(
+        getEnableGatewayClassController());
     hash = (29 * hash) + unknownFields.hashCode();
     memoizedHashCode = hash;
     return hash;
@@ -1136,6 +1164,8 @@ public Builder clear() {
       }
       mandateInternalKeyValidation_ = false;
 
+      enableGatewayClassController_ = false;
+
       return this;
     }
 
@@ -1234,6 +1264,7 @@ public org.wso2.apk.enforcer.discovery.config.enforcer.Config buildPartial() {
         result.httpClient_ = httpClientBuilder_.build();
       }
       result.mandateInternalKeyValidation_ = mandateInternalKeyValidation_;
+      result.enableGatewayClassController_ = enableGatewayClassController_;
       onBuilt();
       return result;
     }
@@ -1350,6 +1381,9 @@ public Builder mergeFrom(org.wso2.apk.enforcer.discovery.config.enforcer.Config
       if (other.getMandateInternalKeyValidation() != false) {
         setMandateInternalKeyValidation(other.getMandateInternalKeyValidation());
       }
+      if (other.getEnableGatewayClassController() != false) {
+        setEnableGatewayClassController(other.getEnableGatewayClassController());
+      }
       this.mergeUnknownFields(other.unknownFields);
       onChanged();
       return this;
@@ -3109,6 +3143,37 @@ public Builder clearMandateInternalKeyValidation() {
       onChanged();
       return this;
     }
+
+    private boolean enableGatewayClassController_ ;
+    /**
+     * <code>bool enableGatewayClassController = 16;</code>
+     * @return The enableGatewayClassController.
+     */
+    @java.lang.Override
+    public boolean getEnableGatewayClassController() {
+      return enableGatewayClassController_;
+    }
+    /**
+     * <code>bool enableGatewayClassController = 16;</code>
+     * @param value The enableGatewayClassController to set.
+     * @return This builder for chaining.
+     */
+    public Builder setEnableGatewayClassController(boolean value) {
+      
+      enableGatewayClassController_ = value;
+      onChanged();
+      return this;
+    }
+    /**
+     * <code>bool enableGatewayClassController = 16;</code>
+     * @return This builder for chaining.
+     */
+    public Builder clearEnableGatewayClassController() {
+      
+      enableGatewayClassController_ = false;
+      onChanged();
+      return this;
+    }
     @java.lang.Override
     public final Builder setUnknownFields(
         final com.google.protobuf.UnknownFieldSet unknownFields) {
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigOrBuilder.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigOrBuilder.java
index 9bb944b65..78cc44cf3 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigOrBuilder.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigOrBuilder.java
@@ -222,4 +222,10 @@ org.wso2.apk.enforcer.discovery.config.enforcer.FilterOrBuilder getFiltersOrBuil
    * @return The mandateInternalKeyValidation.
    */
   boolean getMandateInternalKeyValidation();
+
+  /**
+   * <code>bool enableGatewayClassController = 16;</code>
+   * @return The enableGatewayClassController.
+   */
+  boolean getEnableGatewayClassController();
 }
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigProto.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigProto.java
index 1142d75aa..23291675f 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigProto.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/discovery/config/enforcer/ConfigProto.java
@@ -43,7 +43,7 @@ public static void registerAllExtensions(
       "cer/tracing.proto\032,wso2/discovery/config" +
       "/enforcer/metrics.proto\032)wso2/discovery/" +
       "config/enforcer/soap.proto\032+wso2/discove" +
-      "ry/config/enforcer/client.proto\"\344\006\n\006Conf" +
+      "ry/config/enforcer/client.proto\"\212\007\n\006Conf" +
       "ig\022:\n\010security\030\001 \001(\0132(.wso2.discovery.co" +
       "nfig.enforcer.Security\022;\n\010keystore\030\002 \001(\013" +
       "2).wso2.discovery.config.enforcer.CertSt" +
@@ -65,11 +65,12 @@ public static void registerAllExtensions(
       "p\022%\n\035mandateSubscriptionValidation\030\r \001(\010" +
       "\022>\n\nhttpClient\030\016 \001(\0132*.wso2.discovery.co" +
       "nfig.enforcer.HttpClient\022$\n\034mandateInter" +
-      "nalKeyValidation\030\017 \001(\010B\220\001\n/org.wso2.apk." +
-      "enforcer.discovery.config.enforcerB\013Conf" +
-      "igProtoP\001ZNgithub.com/envoyproxy/go-cont" +
-      "rol-plane/wso2/discovery/config/enforcer" +
-      ";enforcerb\006proto3"
+      "nalKeyValidation\030\017 \001(\010\022$\n\034enableGatewayC" +
+      "lassController\030\020 \001(\010B\220\001\n/org.wso2.apk.en" +
+      "forcer.discovery.config.enforcerB\013Config" +
+      "ProtoP\001ZNgithub.com/envoyproxy/go-contro" +
+      "l-plane/wso2/discovery/config/enforcer;e" +
+      "nforcerb\006proto3"
     };
     descriptor = com.google.protobuf.Descriptors.FileDescriptor
       .internalBuildGeneratedFileFrom(descriptorData,
@@ -92,7 +93,7 @@ public static void registerAllExtensions(
     internal_static_wso2_discovery_config_enforcer_Config_fieldAccessorTable = new
       com.google.protobuf.GeneratedMessageV3.FieldAccessorTable(
         internal_static_wso2_discovery_config_enforcer_Config_descriptor,
-        new java.lang.String[] { "Security", "Keystore", "Truststore", "AuthService", "JwtGenerator", "Cache", "Analytics", "Management", "Tracing", "Metrics", "Filters", "Soap", "MandateSubscriptionValidation", "HttpClient", "MandateInternalKeyValidation", });
+        new java.lang.String[] { "Security", "Keystore", "Truststore", "AuthService", "JwtGenerator", "Cache", "Analytics", "Management", "Tracing", "Metrics", "Filters", "Soap", "MandateSubscriptionValidation", "HttpClient", "MandateInternalKeyValidation", "EnableGatewayClassController", });
     org.wso2.apk.enforcer.discovery.config.enforcer.CertStoreProto.getDescriptor();
     org.wso2.apk.enforcer.discovery.config.enforcer.ServiceProto.getDescriptor();
     org.wso2.apk.enforcer.discovery.config.enforcer.JWTGeneratorProto.getDescriptor();
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/graphql/GraphQLPayloadUtils.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/graphql/GraphQLPayloadUtils.java
index 2bd2147f1..b0140b904 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/graphql/GraphQLPayloadUtils.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/graphql/GraphQLPayloadUtils.java
@@ -32,6 +32,8 @@
 import org.wso2.apk.enforcer.commons.constants.GraphQLConstants;
 import org.wso2.apk.enforcer.commons.graphql.GraphQLProcessorUtil;
 import org.wso2.apk.enforcer.commons.graphql.QueryValidator;
+import org.wso2.apk.enforcer.config.ConfigHolder;
+import org.wso2.apk.enforcer.config.EnforcerConfig;
 import org.wso2.apk.enforcer.discovery.api.GraphqlComplexity;
 import org.wso2.apk.enforcer.api.API;
 import org.wso2.apk.enforcer.api.APIFactory;
@@ -62,7 +64,7 @@ public class GraphQLPayloadUtils {
      * @return matching resource configs for the request
      * @throws EnforcerException use for error response handling
      */
-    public static ArrayList<ResourceConfig> buildGQLRequestContext(API api, String queryBody) throws EnforcerException {
+    public static ArrayList<ResourceConfig> buildGQLRequestContext(API api, String queryBody, String routeName) throws EnforcerException {
         GraphQLSchemaDTO graphQLSchemaDTO = api.getAPIConfig().getGraphQLSchemaDTO();
         try {
             // Validate payload with graphQLSchema
@@ -89,7 +91,14 @@ public static ArrayList<ResourceConfig> buildGQLRequestContext(API api, String q
                 }
                 ArrayList<ResourceConfig> resourceConfigs = new ArrayList<>();
                 for (String op : operationList) {
-                    ResourceConfig resourceConfig = APIFactory.getInstance().getMatchedResource(api, op, method);
+                    EnforcerConfig enforcerConfig = ConfigHolder.getInstance().getConfig();
+                    ResourceConfig resourceConfig;
+                    if (enforcerConfig.getEnableGatewayClassController()) {
+                        resourceConfig = APIFactory.getInstance().getMatchedResource(api, routeName);
+                    } else {
+                        resourceConfig = APIFactory.getInstance().getMatchedResource(api, op, method);
+                    }
+
                     if (resourceConfig != null) {
                         resourceConfigs.add(resourceConfig);
                     } else {
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/server/HttpRequestHandler.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/server/HttpRequestHandler.java
index 97d232374..7a65c2f4f 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/server/HttpRequestHandler.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/server/HttpRequestHandler.java
@@ -32,6 +32,8 @@
 import org.wso2.apk.enforcer.commons.model.APIConfig;
 import org.wso2.apk.enforcer.commons.model.RequestContext;
 import org.wso2.apk.enforcer.commons.model.ResourceConfig;
+import org.wso2.apk.enforcer.config.ConfigHolder;
+import org.wso2.apk.enforcer.config.EnforcerConfig;
 import org.wso2.apk.enforcer.constants.APIConstants;
 import org.wso2.apk.enforcer.constants.AdapterConstants;
 import org.wso2.apk.enforcer.constants.HttpConstants;
@@ -87,6 +89,7 @@ private RequestContext buildRequestContext(API api, CheckRequest request) {
         String certificate = request.getAttributes().getSource().getCertificate();
         Map<String, String> headers = request.getAttributes().getRequest().getHttp().getHeadersMap();
         String pathTemplate = request.getAttributes().getContextExtensionsMap().get(APIConstants.GW_RES_PATH_PARAM);
+        String routeName = request.getAttributes().getContextExtensionsMap().get(APIConstants.ROUTE_NAME_PARAM);
         String cluster = request.getAttributes().getContextExtensionsMap()
                 .get(AdapterConstants.CLUSTER_HEADER_KEY);
         long requestTimeInMillis = request.getAttributes().getRequest().getTime().getSeconds() * 1000 +
@@ -116,11 +119,12 @@ private RequestContext buildRequestContext(API api, CheckRequest request) {
         ResourceConfig resourceConfig = null;
         ArrayList<ResourceConfig> resourceConfigs = null;
         boolean isGraphQLAPI = api.getAPIConfig().getApiType().equals(APIConstants.ApiType.GRAPHQL);
+        EnforcerConfig enforcerConfig = ConfigHolder.getInstance().getConfig();
         if (isGraphQLAPI && !HttpConstants.OPTIONS.equals(method)) {
             // need to decode the payload if request is graphql and a non option call.
             try {
                 requestPayload = GraphQLPayloadUtils.getGQLRequestPayload(requestPayload, headers);
-                resourceConfigs = GraphQLPayloadUtils.buildGQLRequestContext(api, requestPayload);
+                resourceConfigs = GraphQLPayloadUtils.buildGQLRequestContext(api, requestPayload, routeName);
             } catch (EnforcerException exception) {
                 logger.error("Error while processing the graphql api request for {}",
                         api.getAPIConfig().getName(),
@@ -139,12 +143,19 @@ private RequestContext buildRequestContext(API api, CheckRequest request) {
                         exception.getMessage());
                 return requestContext;
             }
-        } else if (!isGraphQLAPI) {
+        } else if (!isGraphQLAPI && !enforcerConfig.getEnableGatewayClassController()) {
             resourceConfig = APIFactory.getInstance().getMatchedResource(api, pathTemplate, method);
             if (resourceConfig != null) {
                 resourceConfigs = new ArrayList<>();
                 resourceConfigs.add(resourceConfig);
             }
+        } else if (!isGraphQLAPI && enforcerConfig.getEnableGatewayClassController()) {
+            resourceConfig = APIFactory.getInstance().getMatchedResource(api,
+                    request.getAttributes().getContextExtensionsMap().get(APIConstants.ROUTE_NAME_PARAM));
+            if (resourceConfig != null) {
+                resourceConfigs = new ArrayList<>();
+                resourceConfigs.add(resourceConfig);
+            }
         }
         return new RequestContext.Builder(requestPath).matchedResourceConfigs(resourceConfigs).requestMethod(method)
                 .certificate(certificate).matchedAPI(api.getAPIConfig()).headers(headers).requestID(requestID)
diff --git a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/util/EndpointUtils.java b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/util/EndpointUtils.java
index 6c3812abe..975215ce5 100644
--- a/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/util/EndpointUtils.java
+++ b/gateway/enforcer/org.wso2.apk.enforcer/src/main/java/org/wso2/apk/enforcer/util/EndpointUtils.java
@@ -24,6 +24,8 @@
 import org.wso2.apk.enforcer.commons.model.RequestContext;
 import org.wso2.apk.enforcer.commons.model.ResourceConfig;
 import org.wso2.apk.enforcer.commons.model.RetryConfig;
+import org.wso2.apk.enforcer.config.ConfigHolder;
+import org.wso2.apk.enforcer.config.EnforcerConfig;
 import org.wso2.apk.enforcer.constants.APIConstants;
 
 import java.util.Base64;
@@ -84,7 +86,10 @@ public static void addEndpointSecurity(RequestContext requestContext) {
      * @param requestContext request Context
      */
     public static void updateClusterHeaderAndCheckEnv(RequestContext requestContext) {
-        requestContext.addOrModifyHeaders(AdapterConstants.CLUSTER_HEADER, requestContext.getClusterHeader());
+        EnforcerConfig enforcerConfig = ConfigHolder.getInstance().getConfig();
+        if (!enforcerConfig.getEnableGatewayClassController()) {
+            requestContext.addOrModifyHeaders(AdapterConstants.CLUSTER_HEADER, requestContext.getClusterHeader());
+        }
         requestContext.getRemoveHeaders().remove(AdapterConstants.CLUSTER_HEADER);
         addRouterHttpHeaders(requestContext);
         addEndpointSecurity(requestContext);

From da5237ae56f8ffdc9b4dedef476ee13ff078843c Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 20 Sep 2024 17:11:36 +0530
Subject: [PATCH 34/40] add enforcer image configs

---
 .../operator/controllers/dp/api_controller.go  |  2 +-
 adapter/internal/operator/gateway-api/route.go |  4 +---
 .../synchronizer/gateway_synchronizer.go       | 18 ++++++++----------
 .../gateway-components/log-conf.yaml           |  2 ++
 4 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/adapter/internal/operator/controllers/dp/api_controller.go b/adapter/internal/operator/controllers/dp/api_controller.go
index cab30e8ab..b592ee0b8 100644
--- a/adapter/internal/operator/controllers/dp/api_controller.go
+++ b/adapter/internal/operator/controllers/dp/api_controller.go
@@ -1611,7 +1611,7 @@ func (apiReconciler *APIReconciler) getAPIsForSecret(ctx context.Context, obj k8
 	if err := apiReconciler.client.List(ctx, backendList, &k8client.ListOptions{
 		FieldSelector: fields.OneTermEqualSelector(secretBackend, utils.NamespacedName(secret).String()),
 	}); err != nil {
-		loggers.LoggerAPKOperator.ErrorC(logging.PrintError(logging.Error2621, logging.MINOR, "Unable to find associated Backends for Secret: %s", utils.NamespacedName(secret).String()))
+		loggers.LoggerAPKOperator.Debugf("Unable to find associated Backends for Secret: %s", utils.NamespacedName(secret).String())
 		return []reconcile.Request{}
 	}
 
diff --git a/adapter/internal/operator/gateway-api/route.go b/adapter/internal/operator/gateway-api/route.go
index 989c28ca9..5f40690fc 100644
--- a/adapter/internal/operator/gateway-api/route.go
+++ b/adapter/internal/operator/gateway-api/route.go
@@ -1097,16 +1097,14 @@ func (t *Translator) processDestination(backendRefContext BackendRefContext,
 	if backendRef.Weight != nil {
 		weight = uint32(*backendRef.Weight)
 	}
-	loggers.LoggerAPI.Error("amalii", backendRef)
+
 	backendNamespace := NamespaceDerefOr(backendRef.Namespace, route.GetNamespace())
 	if !t.validateBackendRef(backendRefContext, parentRef, route, resources, backendNamespace, routeType) {
-		loggers.LoggerAPI.Error("amalii")
 		return nil, weight
 	}
 
 	// Skip processing backends with 0 weight
 	if weight == 0 {
-		loggers.LoggerAPI.Error("amalii")
 		return nil, weight
 	}
 
diff --git a/adapter/internal/operator/synchronizer/gateway_synchronizer.go b/adapter/internal/operator/synchronizer/gateway_synchronizer.go
index 4120df10e..822517edc 100644
--- a/adapter/internal/operator/synchronizer/gateway_synchronizer.go
+++ b/adapter/internal/operator/synchronizer/gateway_synchronizer.go
@@ -106,16 +106,14 @@ func AddOrUpdateGateway(gatewayState GatewayState, state string) (string, error)
 		xds.GenerateGlobalClusters(gateway.Name)
 	}
 	listeners, clusters, routes, endpoints, apis := xds.GenerateEnvoyResoucesForGateway(gateway.Name)
-	if !config.ReadConfigs().Adapter.EnableGatewayClassController {
-		xds.GenerateInterceptorClusters(gateway.Name, gwReqICluster, gwReqIAddresses, gwResICluster, gwResIAddresses)
-		xds.UpdateGatewayCache(gateway, resolvedListenerCerts, gwLuaScript, customRateLimitPolicies)
-		loggers.LoggerAPKOperator.Debugf("listeners: %v", listeners)
-		loggers.LoggerAPKOperator.Debugf("clusters: %v", clusters)
-		loggers.LoggerAPKOperator.Debugf("routes: %v", routes)
-		loggers.LoggerAPKOperator.Debugf("endpoints: %v", endpoints)
-		loggers.LoggerAPKOperator.Debugf("apis: %v", apis)
-		xds.UpdateXdsCacheWithLock(gateway.Name, endpoints, clusters, routes, listeners)
-	}
+	xds.GenerateInterceptorClusters(gateway.Name, gwReqICluster, gwReqIAddresses, gwResICluster, gwResIAddresses)
+	xds.UpdateGatewayCache(gateway, resolvedListenerCerts, gwLuaScript, customRateLimitPolicies)
+	loggers.LoggerAPKOperator.Debugf("listeners: %v", listeners)
+	loggers.LoggerAPKOperator.Debugf("clusters: %v", clusters)
+	loggers.LoggerAPKOperator.Debugf("routes: %v", routes)
+	loggers.LoggerAPKOperator.Debugf("endpoints: %v", endpoints)
+	loggers.LoggerAPKOperator.Debugf("apis: %v", apis)
+	xds.UpdateXdsCacheWithLock(gateway.Name, endpoints, clusters, routes, listeners)
 	xds.UpdateEnforcerApis(gateway.Name, apis, "")
 	return "", nil
 }
diff --git a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
index cba00682b..b533d3031 100644
--- a/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/log-conf.yaml
@@ -14,6 +14,8 @@ data:
       commonControllerHost = "{{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc"
       enforcerServerName = "{{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc"
       {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs }}
+      enforcerImage = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.image | default "apk-enforcer:1.2.0-SNAPSHOT" }}"
+      enforcerImagePullPolicy = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.imagePullPolicy | default "Always" }}"
       {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}
         javaOpts = "{{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.javaOpts }}"
       {{- end }}

From 87e71e4b9855921b314de0da96de0a986e0b2783 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Fri, 20 Sep 2024 17:28:58 +0530
Subject: [PATCH 35/40] revert unnecessary changes to values yaml

---
 helm-charts/values.yaml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/helm-charts/values.yaml b/helm-charts/values.yaml
index a1e5e2ac6..83ef4e1b3 100644
--- a/helm-charts/values.yaml
+++ b/helm-charts/values.yaml
@@ -59,8 +59,7 @@ wso2:
       gateway:
         listener:
           hostname: "gw.wso2.com"
-        service: 
-          type: "NodePort"
+        service: {}
           # secretName: "idp-tls"
       # partitionServer:
       #   enabled: false
@@ -129,7 +128,7 @@ wso2:
             level: "DEBG" # LogLevels can be "DEBG", "FATL", "ERRO", "WARN", "INFO", "PANC"
         # #          logFormat: "TEXT" # Values can be "JSON", "TEXT"
           configs: 
-            enableGatewayClassController: true
+            enableGatewayClassController: false
         #   apiNamespaces:
         #     - "apk-v12"
         #   tls:

From 9e2fc099d22c282c9dfc383d4169b21b94bad63e Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Tue, 24 Sep 2024 13:59:33 +0530
Subject: [PATCH 36/40] fix deployment yamls

---
 .../gateway-runtime-autoscaller.yaml          |   0
 .../gateway-runtime-deployment.yaml           |   2 +
 .../gateway-runtime/gateway-service.yaml      |   0
 .../gateway-runtime-deployment.yaml           | 478 ------------------
 4 files changed, 2 insertions(+), 478 deletions(-)
 rename helm-charts/templates/data-plane/{ => gateway-components}/gateway-runtime/gateway-runtime-autoscaller.yaml (100%)
 rename helm-charts/templates/data-plane/{ => gateway-components}/gateway-runtime/gateway-service.yaml (100%)
 delete mode 100644 helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml

diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
similarity index 100%
rename from helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-autoscaller.yaml
rename to helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-autoscaller.yaml
diff --git a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
index 50d9bc91f..ea31eab48 100644
--- a/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
+++ b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-runtime-deployment.yaml
@@ -15,6 +15,7 @@
 # under the License.
 
 {{- if .Values.wso2.apk.dp.enabled }}
+{{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs (not .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -494,3 +495,4 @@ spec:
         - name: tmp
           emptyDir: {}
           {{end}}
+{{end}}
\ No newline at end of file
diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml b/helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
similarity index 100%
rename from helm-charts/templates/data-plane/gateway-runtime/gateway-service.yaml
rename to helm-charts/templates/data-plane/gateway-components/gateway-runtime/gateway-service.yaml
diff --git a/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml b/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml
deleted file mode 100644
index c2b16457a..000000000
--- a/helm-charts/templates/data-plane/gateway-runtime/gateway-runtime-deployment.yaml
+++ /dev/null
@@ -1,478 +0,0 @@
-# Copyright (c) 2022, WSO2 LLC. (https://www.wso2.com) All Rights Reserved.
-#
-# WSO2 LLC. licenses this file to you under the Apache License,
-# Version 2.0 (the "License"); you may not use this file except
-# in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-{{- if .Values.wso2.apk.dp.enabled }}
-{{- if and .Values.wso2.apk.dp.adapter .Values.wso2.apk.dp.adapter.deployment .Values.wso2.apk.dp.adapter.deployment.configs (not .Values.wso2.apk.dp.adapter.deployment.configs.enableGatewayClassController) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ template "apk-helm.resource.prefix" . }}-gateway-runtime-deployment
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.replicas }}
-  strategy:
-    type: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.strategy }}
-  selector:
-    matchLabels:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 6}}
-  template:
-    metadata:
-      labels:
-{{ include "apk-helm.pod.selectorLabels" (dict "root" . "app" "gateway" ) | indent 8}}
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/data-plane/gateway-components/log-conf.yaml") . | sha256sum }}
-    spec:
-      affinity: {{- include "apk-helm.deployment.affinity" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.affinity "app" "gateway-runtime" "context" $) | nindent 8 }}
-      {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector }}
-      nodeSelector: {{- include "apk-helm.deployment.nodeSelector" ( dict "value" .Values.wso2.apk.dp.gatewayRuntime.deployment.nodeSelector "context" $) | nindent 8 }}
-      {{- end }}
-      automountServiceAccountToken: false
-      containers:
-        - name: enforcer
-          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.image }}
-          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.imagePullPolicy }}
-          ports:
-            - containerPort: 8081
-              protocol: "TCP"
-            - containerPort: 9001
-              protocol: "TCP"
-            - containerPort: 5006	
-              protocol: "TCP"
-            - containerPort: 8084
-              protocol: "TCP"
-            - containerPort: 9092
-              protocol: "TCP"
-            - containerPort: 18002
-              protocol: "TCP"
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled}}
-            - containerPort: 18006
-              protocol: "TCP"
-            {{- end }}
-{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.resources | indent 10 }}
-{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.env | indent 10 }}
-            - name: ADAPTER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ADAPTER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: COMMON_CONTROLLER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
-            - name: COMMON_CONTROLLER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-common-controller-service.{{ .Release.Namespace }}.svc
-            - name: ENFORCER_PRIVATE_KEY_PATH
-              value: /home/wso2/security/keystore/enforcer.key  
-            - name: ENFORCER_PUBLIC_CERT_PATH
-              value: /home/wso2/security/keystore/enforcer.crt
-            - name: ENFORCER_SERVER_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-enforcer-service.{{ .Release.Namespace }}.svc
-            - name: TRUSTED_CA_CERTS_PATH
-              value: "/home/wso2/security/truststore"
-            - name: ADAPTER_XDS_PORT
-              value : "18000"
-            - name: COMMON_CONTROLLER_XDS_PORT
-              value : "18002"
-            - name: COMMON_CONTROLLER_REST_PORT
-              value : "18003"
-            - name: ENFORCER_LABEL
-              value : {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
-            - name: ENFORCER_REGION
-              value: UNKNOWN
-            - name: XDS_MAX_MSG_SIZE
-              value: "4194304"
-            - name: XDS_MAX_RETRIES 
-              value: "3"
-            - name: enforcer_admin_pwd
-              value: admin
-            - name: JAVA_OPTS
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2 -Dapk.jmx.metrics.enabled=true -javaagent:/home/wso2/lib/jmx_prometheus_javaagent-0.20.0.jar=18006:/tmp/metrics/prometheus-jmx-config-enforcer.yml
-            {{- else }}
-              value: -Dhttpclient.hostnameVerifier=AllowAll -Xms512m -Xmx512m -XX:MaxRAMFraction=2
-            {{- end }}
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.analytics .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
-            {{- $defaultPublisherSecretName := "" }}
-            {{- $moesifPublisherSecretName := "" }}
-            {{- range .Values.wso2.apk.dp.gatewayRuntime.analytics.publishers }}
-              {{- if eq .type "default" }}
-                {{- $defaultPublisherSecretName = .secretName }}
-              {{- end }}
-              {{- if eq .type "moesif" }}
-                {{- $moesifPublisherSecretName = .secretName }}
-              {{- end }}
-            {{- end }}
-            {{- if $defaultPublisherSecretName }}
-            - name: CHOREO_ANALYTICS_AUTH_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $defaultPublisherSecretName }}
-                  key: "authToken"
-            - name: CHOREO_ANALYTICS_AUTH_URL
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $defaultPublisherSecretName }}
-                  key: "authURL"
-            {{- end }}
-            {{- if $moesifPublisherSecretName }}
-            - name: MOESIF_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: {{ $moesifPublisherSecretName }}
-                  key: "moesifToken"
-            {{- end }}
-            {{- end }}
-            {{- if .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis }}
-            - name: REDIS_USERNAME
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.username | default "default" }}
-            - name: REDIS_PASSWORD
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.password | default "" }}
-            - name: REDIS_HOST
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.host | default "redis-master" }}
-            - name: REDIS_PORT
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.port | default "6379" }}
-            - name: IS_REDIS_TLS_ENABLED
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tlsEnabled | default "false" }}
-            - name: REDIS_REVOKED_TOKENS_CHANNEL
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.channelName | default "wso2-apk-revoked-tokens-channel" }}
-            - name: REDIS_KEY_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userKeyPath | default "/home/wso2/security/redis/redis.key" }}
-            - name: REDIS_CERT_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.userCertPath | default "/home/wso2/security/redis/redis.crt" }}
-            - name: REDIS_CA_CERT_FILE
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.redisCaCertPath | default "/home/wso2/security/redis/redis-ca.key" }}
-            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
-              value: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.redis.tokenCleanupInterval | default "3600" }}
-            {{- else }}
-            - name: REDIS_USERNAME
-              value: "default"
-            - name: REDIS_PASSWORD
-              value: ""
-            - name: REDIS_HOST
-              value: "redis-master"
-            - name: REDIS_PORT
-              value: "6379"
-            - name: IS_REDIS_TLS_ENABLED
-              value: "false"
-            - name: REDIS_REVOKED_TOKENS_CHANNEL
-              value: "wso2-apk-revoked-tokens-channel"
-            - name: REDIS_KEY_FILE
-              value: "/home/wso2/security/redis/redis.key"
-            - name: REDIS_CERT_FILE
-              value: "/home/wso2/security/redis/redis.crt"
-            - name: REDIS_CA_CERT_FILE
-              value: "/home/wso2/security/redis/redis-ca.key"
-            - name: REVOKED_TOKEN_CLEANUP_INTERVAL
-              value: "3600"
-            {{- end }}
-          volumeMounts:
-            - name: tmp
-              mountPath: /tmp
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/enforcer.key
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certKeyFilename | default "tls.key" }}
-            {{- else }}
-              subPath: tls.key
-            {{- end }}
-            {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-            - name: prometheus-jmx-config-volume
-              mountPath: /tmp/metrics/prometheus-jmx-config-enforcer.yml
-              subPath: prometheus-jmx-config-enforcer.yml
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/apk.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.caCertFileName | default "ca.crt" }}
-            {{- else }}
-              subPath: ca.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: adapter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/adapter.crt
-            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            # - name: common-controller-truststore-secret-volume
-            #   mountPath: /home/wso2/security/truststore/adapter.pem
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/router.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: log-conf-volume
-              mountPath: /home/wso2/conf/
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/keystore/mg.pem
-              subPath: mg.pem
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/truststore/mg.pem
-              subPath: mg.pem
-            - name: enforcer-jwt-secret-volume
-              mountPath: /home/wso2/security/keystore/mg.key
-              subPath: mg.key
-            - name: enforcer-trusted-certs
-              mountPath: /home/wso2/security/truststore/wso2carbon.pem
-              subPath: wso2carbon.pem
-            - name: enforcer-apikey-cert
-              mountPath: /home/wso2/security/truststore/wso2-apim-carbon.pem
-              subPath: wso2-apim-carbon.pem
-            - name: idp-certificate-secret-volume
-              mountPath: /home/wso2/security/truststore/idp.pem
-            {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.fileName }}
-              subPath: {{ .Values.wso2.apk.idp.signing.fileName }}
-            {{ else }}
-              subPath: wso2carbon.pem
-            {{ end }}
-            {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.fileName }}
-            - name: idp-tls-certificate-secret-volume
-              mountPath: /home/wso2/security/truststore/idp-tls.pem
-              subPath: {{ .Values.wso2.apk.idp.tls.fileName }}
-            {{ end }}
-          readinessProbe:
-            exec:
-              command: [ "sh", "check_health.sh" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.readinessProbe.failureThreshold }}
-          livenessProbe:
-            exec:
-              command: [ "sh", "check_health.sh" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.livenessProbe.failureThreshold }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-        - name: router
-          image: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.image }}
-          imagePullPolicy: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.imagePullPolicy }}
-          ports:
-            {{ if and .Values.wso2.apk.dp.gateway.httpListener .Values.wso2.apk.dp.gateway.httpListener.enabled }}
-            - containerPort: {{ .Values.wso2.apk.dp.gateway.httpListener.port | default 9080}}
-              protocol: "TCP"
-            {{ end }}
-            - containerPort: 9095
-              protocol: "TCP"
-            - containerPort: 9090
-              protocol: "TCP"
-            - containerPort: 9091
-              protocol: "TCP"
-            - containerPort: 9000
-              protocol: "TCP"
-{{ include "apk-helm.deployment.resources" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.resources | indent 10 }}
-{{ include "apk-helm.deployment.env" .Values.wso2.apk.dp.gatewayRuntime.deployment.router.env | indent 10 }}
-            - name: ADAPTER_HOST_NAME
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ADAPTER_HOST
-              value: {{ template "apk-helm.resource.prefix" . }}-adapter-service.{{ .Release.Namespace }}.svc
-            - name: ENFORCER_HOST
-              value: "127.0.0.1"
-            - name: ENFORCER_ANALYTICS_HOST
-              value: "127.0.0.1"
-            - name: ROUTER_ADMIN_HOST
-              value: "0.0.0.0"
-            - name: ROUTER_ADMIN_PORT
-              value: "9000"
-            - name: ROUTER_PORT
-              value: "9095"
-            - name: ROUTER_CLUSTER
-              value: "apk_router_cluster"
-            - name: ROUTER_LABEL
-              value: {{ .Values.wso2.apk.dp.gateway.name | default "wso2-apk-default" }}
-            - name: ROUTER_PRIVATE_KEY_PATH
-              value: "/home/wso2/security/keystore/router.key"
-            - name: ROUTER_PUBLIC_CERT_PATH
-              value: "/home/wso2/security/keystore/router.crt"
-            - name: ADAPTER_PORT
-              value: "18000"
-            - name: ADAPTER_CA_CERT_PATH
-              value: "/home/wso2/security/truststore/adapter.crt"
-            - name: ENFORCER_PORT
-              value: "8081"
-            - name: ENFORCER_ANALYTICS_RECEIVER_PORT
-              value: "18090"
-            - name: ENFORCER_CA_CERT_PATH
-              value: "/home/wso2/security/truststore/enforcer.crt"
-            - name: CONCURRENCY
-              value: "2"
-          volumeMounts:
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/router.key
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certKeyFilename | default "tls.key" }}
-            {{- else }}
-              subPath: tls.key
-            {{- end }}
-            - name: router-keystore-secret-volume
-              mountPath: /home/wso2/security/keystore/router.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: adapter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/adapter.crt
-            {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: enforcer-keystore-secret-volume
-              mountPath: /home/wso2/security/truststore/enforcer.crt
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: log-conf-volume
-              mountPath: /home/wso2/conf/
-            {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
-            - name: ratelimiter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/ratelimiter.crt
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certFilename | default "tls.crt" }}
-            {{- else }}
-              subPath: tls.crt
-            {{- end }}
-            - name: ratelimiter-truststore-secret-volume
-              mountPath: /home/wso2/security/truststore/ratelimiter-ca.crt
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-              subPath: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certCAFilename | default "ca.crt" }}
-            {{- else }}
-              subPath: ca.crt
-            {{- end }}
-            {{ end }}
-          livenessProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "health" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.livenessProbe.failureThreshold }}
-          readinessProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "ready" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop: ["ALL"]
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-          startupProbe:
-            exec:
-              command: [ "sh", "router_check_health.sh", "ready" ]
-            initialDelaySeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.initialDelaySeconds }}
-            periodSeconds: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.periodSeconds }}
-            failureThreshold: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.readinessProbe.failureThreshold }}
-      {{- if and .Values.wso2.subscription .Values.wso2.subscription.imagePullSecrets}}
-      imagePullSecrets:
-        - name: {{ .Values.wso2.subscription.imagePullSecrets }}
-      {{ end }}
-      securityContext:
-        seccompProfile:
-          type: "RuntimeDefault"
-      volumes:
-      {{ if and .Values.wso2.apk.dp.enabled .Values.wso2.apk.dp.ratelimiter.enabled }}
-        - name: ratelimiter-truststore-secret-volume
-          secret:
-            {{- if and .Values.wso2.apk.dp.ratelimiter.deployment.configs .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.ratelimiter.deployment.configs.tls.certificatesSecret | default (printf "%s-ratelimiter-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-ratelimiter-server-cert
-          {{- end }}
-      {{ end }}
-        # - name: common-controller-truststore-secret-volume
-        #   secret:
-        #   {{- if and .Values.wso2.apk.dp.commonController.configs .Values.wso2.apk.dp.commonController.configs.tls }}
-        #     secretName: {{ .Values.wso2.apk.dp.commonController.configs.tls.secretName | default (printf "%s-common-controller-server-cert" (include "apk-helm.resource.prefix" .)) }}
-        #   {{- else }}
-        #     secretName: {{ template "apk-helm.resource.prefix" . }}-common-controller-server-cert
-        #   {{- end }}
-        #     defaultMode: 420
-        {{- if and .Values.wso2.apk.metrics .Values.wso2.apk.metrics.enabled }}
-        - name: prometheus-jmx-config-volume
-          configMap: 
-            name: prometheus-jmx-config-enforcer
-        {{- end }}
-        - name: enforcer-keystore-secret-volume
-          secret: 
-          {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.enforcer.configs.tls.certificatesSecret | default (printf "%s-enforcer-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-server-cert
-          {{- end }}
-        - name: log-conf-volume
-          configMap: 
-            name: {{ template "apk-helm.resource.prefix" . }}-log-conf
-        - name: router-keystore-secret-volume
-          secret: 
-            {{- if and .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.gatewayRuntime.deployment.router.configs.tls.certificatesSecret | default (printf "%s-gateway-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-gateway-server-cert
-          {{- end }}
-        - name: adapter-truststore-secret-volume
-          secret: 
-          {{- if and .Values.wso2.apk.dp.adapter.deployment.configs .Values.wso2.apk.dp.adapter.deployment.configs.tls }}
-            secretName: {{ .Values.wso2.apk.dp.adapter.deployment.configs.tls.secretName | default (printf "%s-adapter-server-cert" (include "apk-helm.resource.prefix" .)) }}
-          {{- else }}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-adapter-server-cert
-          {{- end }}
-        - name: enforcer-jwt-secret-volume
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-keystore-secret
-        - name: enforcer-trusted-certs
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
-        - name: enforcer-apikey-cert
-          secret: 
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret 
-        - name: idp-certificate-secret-volume
-          secret:
-          {{ if and .Values.wso2.apk.idp.signing .Values.wso2.apk.idp.signing.secretName }}
-            secretName: {{ .Values.wso2.apk.idp.signing.secretName }}
-            {{else}}
-            secretName: {{ template "apk-helm.resource.prefix" . }}-enforcer-truststore-secret
-          {{ end}}
-          {{ if and .Values.wso2.apk.idp.tls .Values.wso2.apk.idp.tls.secretName }}
-        - name: idp-tls-certificate-secret-volume
-          secret:
-            secretName: {{ .Values.wso2.apk.idp.tls.secretName }}
-          {{ end }}
-        - name: tmp
-          emptyDir: {}
-          {{end}}
-{{- end}}
\ No newline at end of file

From 9d626f45dd65288566f79618a8520bcb4730302e Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Wed, 25 Sep 2024 16:28:01 +0530
Subject: [PATCH 37/40] temp

---
 .../internal/oasparser/envoyconf/listener.go  | 177 +++++++++---------
 1 file changed, 88 insertions(+), 89 deletions(-)

diff --git a/adapter/internal/oasparser/envoyconf/listener.go b/adapter/internal/oasparser/envoyconf/listener.go
index a7fba0c27..1bedea36f 100644
--- a/adapter/internal/oasparser/envoyconf/listener.go
+++ b/adapter/internal/oasparser/envoyconf/listener.go
@@ -99,7 +99,7 @@ func CreateListenerByGateway(gateway *gwapiv1.Gateway, resolvedListenerCerts map
 			var filterChains []*listenerv3.FilterChain
 
 			for _, listenerObj := range listeners {
-				if listenerObj.Name == "httpslistener" {
+				if listenerObj.Name == "gatewaylistener" {
 					httpFilters = getHTTPFilters(gwLuaScript)
 				} else {
 					httpFilters = getHTTPFilters(`
@@ -398,137 +398,136 @@ func CreateVirtualHosts(vhostToRouteArrayMap map[string][]*routev3.Route, custom
 	return virtualHosts
 }
 
-
 func generateSubscriptionBasedRatelimits() []*routev3.RateLimit {
 	return []*routev3.RateLimit{&routev3.RateLimit{
-			Actions: []*routev3.RateLimit_Action{
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForOrganization,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForOrganization,
-										},
+		Actions: []*routev3.RateLimit_Action{
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForOrganization,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForOrganization,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForSubscription,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForSubscription,
-										},
+			},
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForSubscription,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForSubscription,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForPolicy,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForUsagePolicy,
-										},
+			},
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForPolicy,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForUsagePolicy,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
 			},
-		}, &routev3.RateLimit{
-			Actions: []*routev3.RateLimit_Action{
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForOrganization,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForOrganization,
-										},
+		},
+	}, &routev3.RateLimit{
+		Actions: []*routev3.RateLimit_Action{
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForOrganization,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForOrganization,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForSubscription,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForSubscription,
-										},
+			},
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForSubscription,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForSubscription,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_Metadata{
-						Metadata: &routev3.RateLimit_Action_MetaData{
-							DescriptorKey: DescriptorKeyForPolicy,
-							MetadataKey: &metadatav3.MetadataKey{
-								Key: extAuthzFilterName,
-								Path: []*metadatav3.MetadataKey_PathSegment{
-									{
-										Segment: &metadatav3.MetadataKey_PathSegment_Key{
-											Key: descriptorMetadataKeyForUsagePolicy,
-										},
+			},
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_Metadata{
+					Metadata: &routev3.RateLimit_Action_MetaData{
+						DescriptorKey: DescriptorKeyForPolicy,
+						MetadataKey: &metadatav3.MetadataKey{
+							Key: extAuthzFilterName,
+							Path: []*metadatav3.MetadataKey_PathSegment{
+								{
+									Segment: &metadatav3.MetadataKey_PathSegment_Key{
+										Key: descriptorMetadataKeyForUsagePolicy,
 									},
 								},
 							},
-							Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
-							SkipIfAbsent: true,
 						},
+						Source:       routev3.RateLimit_Action_MetaData_DYNAMIC,
+						SkipIfAbsent: true,
 					},
 				},
-				{
-					ActionSpecifier: &routev3.RateLimit_Action_GenericKey_{
-						GenericKey: &routev3.RateLimit_Action_GenericKey{
-							DescriptorKey:   "burst",
-							DescriptorValue: "enabled",
-						},
+			},
+			{
+				ActionSpecifier: &routev3.RateLimit_Action_GenericKey_{
+					GenericKey: &routev3.RateLimit_Action_GenericKey{
+						DescriptorKey:   "burst",
+						DescriptorValue: "enabled",
 					},
 				},
 			},
 		},
+	},
 	}
 }
 

From fe1f45e34cd599e59e988aa9c2cc7cdc6c31aad6 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Wed, 25 Sep 2024 16:57:49 +0530
Subject: [PATCH 38/40] fix go mod

---
 common-controller/go.mod | 2 +-
 common-controller/go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/common-controller/go.mod b/common-controller/go.mod
index e59a3f7d1..d09f93280 100644
--- a/common-controller/go.mod
+++ b/common-controller/go.mod
@@ -101,7 +101,7 @@ require (
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/prometheus/client_model v0.6.0 // indirect
-	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/common v0.48.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stretchr/testify v1.9.0
 	go.uber.org/multierr v1.11.0 // indirect
diff --git a/common-controller/go.sum b/common-controller/go.sum
index 71888bfb6..96075a957 100644
--- a/common-controller/go.sum
+++ b/common-controller/go.sum
@@ -188,8 +188,8 @@ github.com/prometheus/client_golang v1.19.0/go.mod h1:ZRM9uEAypZakd+q/x7+gmsvXdU
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.6.0 h1:k1v3CzpSRUTrKMppY35TLwPvxHqBu0bYgxZzqGIgaos=
 github.com/prometheus/client_model v0.6.0/go.mod h1:NTQHnmxFpouOD0DpvP4XujX3CdOAGQPoaGhyTchlyt8=
-github.com/prometheus/common v0.50.0 h1:YSZE6aa9+luNa2da6/Tik0q0A5AbR+U003TItK57CPQ=
-github.com/prometheus/common v0.50.0/go.mod h1:wHFBCEVWVmHMUpg7pYcOm2QUR/ocQdYSJVQJKnHc3xQ=
+github.com/prometheus/common v0.48.0 h1:QO8U2CdOzSn1BBsmXJXduaaW+dY/5QLjfB8svtSzKKE=
+github.com/prometheus/common v0.48.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/redis/go-redis/v9 v9.2.1 h1:WlYJg71ODF0dVspZZCpYmoF1+U1Jjk9Rwd7pq6QmlCg=

From c0a789475d33358008d5aa9616d687274ecf1333 Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Wed, 25 Sep 2024 17:38:11 +0530
Subject: [PATCH 39/40] update lua listenercheck

---
 adapter/internal/oasparser/envoyconf/listener.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/adapter/internal/oasparser/envoyconf/listener.go b/adapter/internal/oasparser/envoyconf/listener.go
index 1bedea36f..5688658e3 100644
--- a/adapter/internal/oasparser/envoyconf/listener.go
+++ b/adapter/internal/oasparser/envoyconf/listener.go
@@ -99,7 +99,7 @@ func CreateListenerByGateway(gateway *gwapiv1.Gateway, resolvedListenerCerts map
 			var filterChains []*listenerv3.FilterChain
 
 			for _, listenerObj := range listeners {
-				if listenerObj.Name == "gatewaylistener" {
+				if listenerObj.Name == "httpslistener" || listenerObj.Name == "httplistener" {
 					httpFilters = getHTTPFilters(gwLuaScript)
 				} else {
 					httpFilters = getHTTPFilters(`

From 587bd93a276949ff1423dee9cce2e9173264843c Mon Sep 17 00:00:00 2001
From: AmaliMatharaarachchi <maamalilakshika@gmail.com>
Date: Thu, 26 Sep 2024 08:41:15 +0530
Subject: [PATCH 40/40] revert change

---
 adapter/internal/oasparser/envoyconf/listener.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/adapter/internal/oasparser/envoyconf/listener.go b/adapter/internal/oasparser/envoyconf/listener.go
index 5688658e3..bcbc29e50 100644
--- a/adapter/internal/oasparser/envoyconf/listener.go
+++ b/adapter/internal/oasparser/envoyconf/listener.go
@@ -99,7 +99,7 @@ func CreateListenerByGateway(gateway *gwapiv1.Gateway, resolvedListenerCerts map
 			var filterChains []*listenerv3.FilterChain
 
 			for _, listenerObj := range listeners {
-				if listenerObj.Name == "httpslistener" || listenerObj.Name == "httplistener" {
+				if listenerObj.Name == "httpslistener" {
 					httpFilters = getHTTPFilters(gwLuaScript)
 				} else {
 					httpFilters = getHTTPFilters(`