From 2a9589628b7087a2fb20177d6cd3a5d63048813b Mon Sep 17 00:00:00 2001
From: Jesse Haka <haka.jesse@gmail.com>
Date: Fri, 23 Feb 2024 14:18:36 +0200
Subject: [PATCH] fix testdata

Signed-off-by: Jesse Haka <haka.jesse@gmail.com>
---
 .../translate/out/default-resources.all.yaml       |  4 ++--
 .../translate/out/envoy-patch-policy.all.yaml      |  2 --
 .../translate/out/from-gateway-api-to-xds.all.json | 12 ++++++------
 .../translate/out/from-gateway-api-to-xds.all.yaml |  4 ++--
 .../out/from-gateway-api-to-xds.listener.yaml      |  2 --
 .../out/from-gateway-api-to-xds.route.yaml         |  2 ++
 .../jwt-single-route-single-match-to-xds.all.json  | 12 ++++++------
 .../jwt-single-route-single-match-to-xds.all.yaml  |  4 ++--
 ...-single-route-single-match-to-xds.listener.yaml |  2 --
 ...jwt-single-route-single-match-to-xds.route.yaml |  2 ++
 .../testdata/translate/out/multiple-xds.route.json | 14 ++++++++++++--
 .../testdata/translate/out/quickstart.route.yaml   |  2 ++
 ...backendtrafficpolicy-status-conditions.out.yaml |  2 ++
 ...ndtrafficpolicy-status-fault-injection.out.yaml |  3 +++
 ...afficpolicy-with-circuitbreakers-error.out.yaml |  1 +
 ...kendtrafficpolicy-with-circuitbreakers.out.yaml |  2 ++
 .../backendtrafficpolicy-with-healthcheck.out.yaml |  4 ++++
 ...backendtrafficpolicy-with-loadbalancer.out.yaml |  3 +++
 ...al-ratelimit-default-route-level-limit.out.yaml |  1 +
 ...ith-local-ratelimit-invalid-limit-unit.out.yaml |  1 +
 ...ith-local-ratelimit-invalid-match-type.out.yaml |  1 +
 ...it-invalid-multiple-route-level-limits.out.yaml |  1 +
 ...kendtrafficpolicy-with-local-ratelimit.out.yaml |  1 +
 ...ackendtrafficpolicy-with-proxyprotocol.out.yaml |  2 ++
 ...ficpolicy-with-ratelimit-invalid-regex.out.yaml |  1 +
 .../backendtrafficpolicy-with-ratelimit.out.yaml   |  2 ++
 .../backendtrafficpolicy-with-retries.out.yaml     |  2 ++
 ...fficpolicy-with-same-prefix-httproutes.out.yaml |  2 ++
 ...backendtrafficpolicy-with-tcpkeepalive.out.yaml |  2 ++
 ...ackendtrafficpolicy-with-timeout-error.out.yaml |  1 +
 .../backendtrafficpolicy-with-timeout.out.yaml     |  2 ++
 .../testdata/clienttrafficpolicy-http3.out.yaml    |  1 +
 .../httproute-with-valid-extension-filter.out.yaml |  1 +
 ...-same-namespace-with-allowed-httproute.out.yaml |  1 +
 .../testdata/gateway-infrastructure.out.yaml       |  1 +
 ...in-other-namespace-allowed-by-refgrant.out.yaml |  1 +
 ...ner-with-tls-terminate-and-passthrough.out.yaml |  1 +
 ...ion-with-same-algorithm-different-fqdn.out.yaml |  1 +
 ...-with-valid-multiple-tls-configuration.out.yaml |  1 +
 ...-listener-with-valid-tls-configuration.out.yaml |  1 +
 ...eway-with-preexisting-status-condition.out.yaml |  1 +
 .../gateway-with-stale-status-condition.out.yaml   |  1 +
 ...two-listeners-with-multiple-httproutes.out.yaml |  4 ++++
 ...eners-with-same-port-http-tcp-protocol.out.yaml |  1 +
 ...eners-with-same-port-http-udp-protocol.out.yaml |  1 +
 .../testdata/grpcroute-with-header-match.out.yaml  |  1 +
 ...rpcroute-with-method-and-service-match.out.yaml |  2 ++
 .../testdata/grpcroute-with-method-match.out.yaml  |  2 ++
 ...grpcroute-with-request-header-modifier.out.yaml |  1 +
 .../testdata/grpcroute-with-service-match.out.yaml |  2 ++
 ...ackendtrafficpolicy-with-timeout-error.out.yaml |  1 +
 ...-and-backendtrafficpolicy-with-timeout.out.yaml |  2 ++
 ...-gateway-with-more-different-listeners.out.yaml |  8 ++++++++
 ...taching-to-gateway-with-more-listeners.out.yaml |  8 ++++++++
 ...ith-two-listeners-with-different-ports.out.yaml |  2 ++
 ...ttaching-to-gateway-with-two-listeners.out.yaml |  2 ++
 .../httproute-attaching-to-gateway.out.yaml        |  1 +
 ...te-attaching-to-listener-matching-port.out.yaml |  1 +
 ...listener-on-gateway-with-two-listeners.out.yaml |  1 +
 ...ceimport-backendrefs-diff-address-type.out.yaml |  1 +
 ...ceimport-backendrefs-same-address-type.out.yaml |  1 +
 ...iceimport-backendref-fqdn-address-type.out.yaml |  1 +
 ...ceimport-backendref-mixed-address-type.out.yaml |  1 +
 ...listener-with-serviceimport-backendref.out.yaml |  1 +
 .../httproute-attaching-to-listener.out.yaml       |  1 +
 .../httproute-backend-request-timeout.out.yaml     |  1 +
 .../testdata/httproute-request-timeout.out.yaml    |  1 +
 ...-with-multiple-backends-and-no-weights.out.yaml |  1 +
 ...ule-with-multiple-backends-and-weights.out.yaml |  1 +
 ...in-other-namespace-allowed-by-refgrant.out.yaml |  1 +
 ...in-other-namespace-allowed-by-refgrant.out.yaml |  1 +
 .../testdata/httproute-with-empty-matches.out.yaml |  1 +
 ...-filter-duplicate-add-multiple-filters.out.yaml |  1 +
 ...oute-with-header-filter-duplicate-adds.out.yaml |  1 +
 ...lter-duplicate-remove-multiple-filters.out.yaml |  1 +
 ...e-with-header-filter-duplicate-removes.out.yaml |  1 +
 ...with-header-filter-empty-header-values.out.yaml |  1 +
 ...ttproute-with-header-filter-no-headers.out.yaml |  1 +
 .../httproute-with-header-filter-remove.out.yaml   |  1 +
 ...oute-with-invalid-backend-ref-bad-port.out.yaml |  1 +
 ...with-invalid-backend-ref-invalid-group.out.yaml |  1 +
 ...-with-invalid-backend-ref-invalid-kind.out.yaml |  1 +
 ...route-with-invalid-backend-ref-no-port.out.yaml |  1 +
 ...-invalid-backend-ref-no-service.import.out.yaml |  1 +
 ...te-with-invalid-backend-ref-no-service.out.yaml |  1 +
 ...-invalid-backendref-in-other-namespace.out.yaml |  1 +
 ...ttproute-with-mirror-filter-duplicates.out.yaml |  1 +
 .../httproute-with-mirror-filter-multiple.out.yaml |  1 +
 ...ute-with-mirror-filter-service-no-port.out.yaml |  1 +
 ...e-with-mirror-filter-service-not-found.out.yaml |  1 +
 .../testdata/httproute-with-mirror-filter.out.yaml |  1 +
 ...edirect-filter-full-path-replace-https.out.yaml |  1 +
 ...ttproute-with-redirect-filter-hostname.out.yaml |  1 +
 ...t-filter-prefix-replace-with-port-http.out.yaml |  1 +
 ...route-with-response-header-filter-adds.out.yaml |  1 +
 ...-filter-duplicate-add-multiple-filters.out.yaml |  1 +
 ...-response-header-filter-duplicate-adds.out.yaml |  1 +
 ...lter-duplicate-remove-multiple-filters.out.yaml |  1 +
 ...sponse-header-filter-duplicate-removes.out.yaml |  1 +
 ...onse-header-filter-empty-header-values.out.yaml |  1 +
 ...with-response-header-filter-no-headers.out.yaml |  1 +
 ...ute-with-response-header-filter-remove.out.yaml |  1 +
 ...with-single-rule-with-exact-path-match.out.yaml |  1 +
 ...ith-single-rule-with-http-method-match.out.yaml |  1 +
 ...h-path-prefix-and-exact-header-matches.out.yaml |  1 +
 ...h-some-invalid-backend-refs-no-service.out.yaml |  1 +
 ...hing-to-gateway-with-wildcard-hostname.out.yaml |  1 +
 ...hing-to-gateway-with-wildcard-hostname.out.yaml |  2 ++
 ...lrewrite-filter-full-path-replace-http.out.yaml |  1 +
 ...rewrite-filter-hostname-prefix-replace.out.yaml |  1 +
 ...proute-with-urlrewrite-filter-hostname.out.yaml |  1 +
 ...-urlrewrite-filter-invalid-filter-type.out.yaml |  1 +
 ...-urlrewrite-filter-prefix-replace-http.out.yaml |  1 +
 ...taching-to-gateway-with-unset-hostname.out.yaml |  1 +
 .../httproutes-with-multiple-matches.out.yaml      |  7 +++++++
 ...alid-multiple-gateways-multiple-routes.out.yaml |  2 ++
 .../securitypolicy-status-conditions.out.yaml      |  2 ++
 .../securitypolicy-with-basic-auth.out.yaml        |  1 +
 .../testdata/securitypolicy-with-cors.out.yaml     |  3 +++
 ...-with-extauth-invalid-no-matching-port.out.yaml |  1 +
 ...ith-extauth-invalid-no-reference-grant.out.yaml |  1 +
 ...policy-with-extauth-invalid-no-service.out.yaml |  1 +
 .../testdata/securitypolicy-with-extauth.out.yaml  |  2 ++
 ...curitypolicy-with-jwt-and-invalid-oidc.out.yaml |  2 ++
 ...ypolicy-with-jwt-with-custom-extractor.out.yaml |  2 ++
 .../testdata/securitypolicy-with-jwt.out.yaml      |  2 ++
 .../testdata/securitypolicy-with-oidc.out.yaml     |  2 ++
 .../http-route-extension-filter.listeners.yaml     |  2 --
 .../http-route-extension-filter.routes.yaml        |  2 ++
 .../out/extension-xds-ir/http-route.listeners.yaml |  2 --
 .../out/extension-xds-ir/http-route.routes.yaml    |  2 ++
 .../testdata/out/xds-ir/accesslog.listeners.yaml   |  2 --
 .../testdata/out/xds-ir/basic-auth.listeners.yaml  |  2 --
 .../testdata/out/xds-ir/basic-auth.routes.yaml     |  2 ++
 .../out/xds-ir/circuit-breaker.listeners.yaml      |  2 --
 .../out/xds-ir/circuit-breaker.routes.yaml         |  2 ++
 .../out/xds-ir/client-ip-detection.listeners.yaml  |  6 ------
 .../out/xds-ir/client-ip-detection.routes.yaml     |  6 ++++++
 .../out/xds-ir/client-timeout.listeners.yaml       |  2 --
 .../testdata/out/xds-ir/client-timeout.routes.yaml |  2 ++
 .../testdata/out/xds-ir/cors.listeners.yaml        |  2 --
 .../testdata/out/xds-ir/cors.routes.yaml           |  2 ++
 .../testdata/out/xds-ir/ext-auth.listeners.yaml    |  2 --
 .../testdata/out/xds-ir/ext-auth.routes.yaml       |  4 ++++
 .../out/xds-ir/fault-injection.listeners.yaml      |  2 --
 .../out/xds-ir/fault-injection.routes.yaml         | 10 ++++++++++
 .../out/xds-ir/health-check.listeners.yaml         |  2 --
 .../testdata/out/xds-ir/health-check.routes.yaml   |  8 ++++++++
 .../http-route-direct-response.listeners.yaml      |  2 --
 .../xds-ir/http-route-dns-cluster.listeners.yaml   |  2 --
 .../out/xds-ir/http-route-dns-cluster.routes.yaml  |  2 ++
 .../out/xds-ir/http-route-mirror.listeners.yaml    |  2 --
 .../out/xds-ir/http-route-mirror.routes.yaml       |  2 ++
 .../http-route-multiple-matches.listeners.yaml     |  2 --
 .../xds-ir/http-route-multiple-matches.routes.yaml | 14 ++++++++++++++
 .../http-route-multiple-mirrors.listeners.yaml     |  2 --
 .../xds-ir/http-route-multiple-mirrors.routes.yaml |  2 ++
 .../http-route-partial-invalid.listeners.yaml      |  2 --
 .../xds-ir/http-route-partial-invalid.routes.yaml  |  4 ++++
 .../out/xds-ir/http-route-redirect.listeners.yaml  |  2 --
 .../out/xds-ir/http-route-regex.listeners.yaml     |  2 --
 .../out/xds-ir/http-route-regex.routes.yaml        |  2 ++
 .../http-route-request-headers.listeners.yaml      |  2 --
 .../xds-ir/http-route-request-headers.routes.yaml  |  2 ++
 .../http-route-response-add-headers.listeners.yaml |  2 --
 .../http-route-response-add-headers.routes.yaml    |  2 ++
 ...oute-response-add-remove-headers.listeners.yaml |  2 --
 ...p-route-response-add-remove-headers.routes.yaml |  2 ++
 ...tp-route-response-remove-headers.listeners.yaml |  2 --
 .../http-route-response-remove-headers.routes.yaml |  2 ++
 ...ute-rewrite-root-path-url-prefix.listeners.yaml |  2 --
 .../http-route-rewrite-url-fullpath.listeners.yaml |  2 --
 .../http-route-rewrite-url-host.listeners.yaml     |  2 --
 .../http-route-rewrite-url-prefix.listeners.yaml   |  2 --
 .../out/xds-ir/http-route-timeout.listeners.yaml   |  2 --
 .../out/xds-ir/http-route-timeout.routes.yaml      |  2 ++
 .../http-route-weighted-backend.listeners.yaml     |  2 --
 .../xds-ir/http-route-weighted-backend.routes.yaml |  2 ++
 ...p-route-weighted-invalid-backend.listeners.yaml |  2 --
 ...http-route-weighted-invalid-backend.routes.yaml |  2 ++
 .../testdata/out/xds-ir/http-route.listeners.yaml  |  2 --
 .../testdata/out/xds-ir/http-route.routes.yaml     |  2 ++
 .../out/xds-ir/http1-preserve-case.listeners.yaml  |  4 ----
 .../out/xds-ir/http1-preserve-case.routes.yaml     |  4 ++++
 .../out/xds-ir/http1-trailers.listeners.yaml       |  2 --
 .../testdata/out/xds-ir/http1-trailers.routes.yaml |  2 ++
 .../testdata/out/xds-ir/http10.listeners.yaml      |  2 --
 .../testdata/out/xds-ir/http10.routes.yaml         |  2 ++
 .../testdata/out/xds-ir/http2-route.routes.yaml    |  2 ++
 .../testdata/out/xds-ir/http3.listeners.yaml       |  4 ----
 .../testdata/out/xds-ir/http3.routes.yaml          |  2 ++
 .../jsonpatch-add-op-without-value.listeners.yaml  |  2 --
 .../jsonpatch-add-op-without-value.routes.yaml     |  2 ++
 ...jsonpatch-invalid-patch.envoypatchpolicies.yaml |  4 ++--
 .../xds-ir/jsonpatch-invalid-patch.listeners.yaml  |  2 --
 .../out/xds-ir/jsonpatch-invalid-patch.routes.yaml |  2 ++
 .../jsonpatch-missing-resource.listeners.yaml      |  2 --
 .../xds-ir/jsonpatch-missing-resource.routes.yaml  |  2 ++
 .../jsonpatch-move-op-with-value.listeners.yaml    |  2 --
 .../jsonpatch-move-op-with-value.routes.yaml       |  2 ++
 .../testdata/out/xds-ir/jsonpatch.listeners.yaml   |  2 --
 .../testdata/out/xds-ir/jsonpatch.routes.yaml      |  2 ++
 .../out/xds-ir/jwt-custom-extractor.listeners.yaml |  2 --
 .../out/xds-ir/jwt-custom-extractor.routes.yaml    |  2 ++
 .../jwt-multi-route-multi-provider.listeners.yaml  |  2 --
 .../jwt-multi-route-multi-provider.routes.yaml     |  4 ++++
 .../jwt-multi-route-single-provider.listeners.yaml |  2 --
 .../jwt-multi-route-single-provider.routes.yaml    |  4 ++++
 .../out/xds-ir/jwt-ratelimit.listeners.yaml        |  2 --
 .../testdata/out/xds-ir/jwt-ratelimit.routes.yaml  |  6 ++++++
 .../jwt-single-route-single-match.listeners.yaml   |  2 --
 .../jwt-single-route-single-match.routes.yaml      |  2 ++
 .../xds-ir/listener-proxy-protocol.listeners.yaml  |  2 --
 .../out/xds-ir/listener-proxy-protocol.routes.yaml |  2 ++
 .../xds-ir/listener-tcp-keepalive.listeners.yaml   |  4 ----
 .../out/xds-ir/listener-tcp-keepalive.routes.yaml  |  4 ++++
 .../out/xds-ir/load-balancer.listeners.yaml        |  2 --
 .../testdata/out/xds-ir/load-balancer.routes.yaml  | 12 ++++++++++++
 .../out/xds-ir/local-ratelimit.listeners.yaml      |  2 --
 .../out/xds-ir/local-ratelimit.routes.yaml         |  6 ++++++
 .../out/xds-ir/metrics-virtual-host.listeners.yaml |  2 --
 .../out/xds-ir/metrics-virtual-host.routes.yaml    |  2 ++
 .../multiple-listeners-same-port.listeners.yaml    |  6 ------
 .../multiple-listeners-same-port.routes.yaml       |  8 ++++++++
 .../testdata/out/xds-ir/mutual-tls.listeners.yaml  |  2 --
 .../testdata/out/xds-ir/mutual-tls.routes.yaml     |  2 ++
 .../testdata/out/xds-ir/oidc.listeners.yaml        |  2 --
 .../testdata/out/xds-ir/oidc.routes.yaml           |  4 ++++
 .../out/xds-ir/path-settings.listeners.yaml        |  2 --
 .../testdata/out/xds-ir/path-settings.routes.yaml  |  2 ++
 .../xds-ir/proxy-protocol-upstream.listeners.yaml  |  2 --
 .../out/xds-ir/proxy-protocol-upstream.routes.yaml |  2 ++
 .../xds-ir/ratelimit-custom-domain.listeners.yaml  |  2 --
 .../out/xds-ir/ratelimit-custom-domain.routes.yaml |  6 ++++++
 .../out/xds-ir/ratelimit-sourceip.listeners.yaml   |  2 --
 .../out/xds-ir/ratelimit-sourceip.routes.yaml      |  8 ++++++++
 .../testdata/out/xds-ir/ratelimit.listeners.yaml   |  2 --
 .../testdata/out/xds-ir/ratelimit.routes.yaml      |  6 ++++++
 .../xds-ir/retry-partial-invalid.listeners.yaml    |  2 --
 .../out/xds-ir/retry-partial-invalid.routes.yaml   |  4 ++++
 .../testdata/out/xds-ir/simple-tls.listeners.yaml  |  2 --
 .../testdata/out/xds-ir/simple-tls.routes.yaml     |  2 ++
 .../xds-ir/suppress-envoy-headers.listeners.yaml   |  2 --
 .../out/xds-ir/suppress-envoy-headers.routes.yaml  |  2 ++
 .../testdata/out/xds-ir/timeout.listeners.yaml     |  2 --
 .../testdata/out/xds-ir/timeout.routes.yaml        |  2 ++
 .../tls-with-ciphers-versions-alpn.listeners.yaml  |  2 --
 .../tls-with-ciphers-versions-alpn.routes.yaml     |  2 ++
 .../testdata/out/xds-ir/tracing.listeners.yaml     |  2 --
 .../xds-ir/upstream-tcpkeepalive.listeners.yaml    |  2 --
 .../out/xds-ir/upstream-tcpkeepalive.routes.yaml   |  2 ++
 251 files changed, 407 insertions(+), 172 deletions(-)

diff --git a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
index 92a71a6ac1c..2715d144926 100644
--- a/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/default-resources.all.yaml
@@ -814,8 +814,6 @@ xds:
                     routeConfigName: default/eg/http
                   serverHeaderTransformation: PASS_THROUGH
                   statPrefix: http
-                  upgradeConfigs:
-                  - upgradeType: websocket
                   useRemoteAddress: true
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
@@ -1027,6 +1025,8 @@ xds:
               name: httproute/default/backend/rule/0/match/0/www_example_com
               route:
                 cluster: httproute/default/backend/rule/0
+                upgradeConfigs:
+                - upgradeType: websocket
       - routeConfig:
           '@type': type.googleapis.com/envoy.config.route.v3.RouteConfiguration
           ignorePortInHostMatching: true
diff --git a/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml b/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
index c31c5d146f3..757ae8d4c92 100644
--- a/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
@@ -210,8 +210,6 @@ xds:
                     routeConfigName: default/eg/http
                   serverHeaderTransformation: PASS_THROUGH
                   statPrefix: http
-                  upgradeConfigs:
-                  - upgradeType: websocket
                   useRemoteAddress: true
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
index bd7a401d957..1727c9bc87d 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.json
@@ -570,11 +570,6 @@
                           },
                           "serverHeaderTransformation": "PASS_THROUGH",
                           "statPrefix": "http",
-                          "upgradeConfigs": [
-                            {
-                              "upgradeType": "websocket"
-                            }
-                          ],
                           "useRemoteAddress": true
                         }
                       }
@@ -923,7 +918,12 @@
                         },
                         "name": "httproute/default/backend/rule/0/match/0/www_example_com",
                         "route": {
-                          "cluster": "httproute/default/backend/rule/0"
+                          "cluster": "httproute/default/backend/rule/0",
+                          "upgradeConfigs": [
+                            {
+                              "upgradeType": "websocket"
+                            }
+                          ]
                         }
                       }
                     ]
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
index ed5c71ea602..67a8a03c0c0 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.all.yaml
@@ -340,8 +340,6 @@ xds:
                     routeConfigName: default/eg/http
                   serverHeaderTransformation: PASS_THROUGH
                   statPrefix: http
-                  upgradeConfigs:
-                  - upgradeType: websocket
                   useRemoteAddress: true
             name: default/eg/http
             perConnectionBufferLimitBytes: 32768
@@ -553,6 +551,8 @@ xds:
               name: httproute/default/backend/rule/0/match/0/www_example_com
               route:
                 cluster: httproute/default/backend/rule/0
+                upgradeConfigs:
+                - upgradeType: websocket
       - routeConfig:
           '@type': type.googleapis.com/envoy.config.route.v3.RouteConfiguration
           ignorePortInHostMatching: true
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml
index bc904a54906..cdc20900592 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.listener.yaml
@@ -57,8 +57,6 @@ xds:
                   routeConfigName: default/eg/http
                 serverHeaderTransformation: PASS_THROUGH
                 statPrefix: http
-                upgradeConfigs:
-                - upgradeType: websocket
                 useRemoteAddress: true
           name: default/eg/http
           perConnectionBufferLimitBytes: 32768
diff --git a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.route.yaml b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.route.yaml
index 318efe2352f..65f1f62961e 100644
--- a/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.route.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/from-gateway-api-to-xds.route.yaml
@@ -16,6 +16,8 @@ xds:
             name: httproute/default/backend/rule/0/match/0/www_example_com
             route:
               cluster: httproute/default/backend/rule/0
+              upgradeConfigs:
+              - upgradeType: websocket
     - routeConfig:
         '@type': type.googleapis.com/envoy.config.route.v3.RouteConfiguration
         ignorePortInHostMatching: true
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
index c776a2f53b3..f560e26e356 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.json
@@ -447,11 +447,6 @@
                           },
                           "serverHeaderTransformation": "PASS_THROUGH",
                           "statPrefix": "http",
-                          "upgradeConfigs": [
-                            {
-                              "upgradeType": "websocket"
-                            }
-                          ],
                           "useRemoteAddress": true
                         }
                       }
@@ -485,7 +480,12 @@
                         },
                         "name": "httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com",
                         "route": {
-                          "cluster": "httproute/envoy-gateway-system/backend/rule/0"
+                          "cluster": "httproute/envoy-gateway-system/backend/rule/0",
+                          "upgradeConfigs": [
+                            {
+                              "upgradeType": "websocket"
+                            }
+                          ]
                         },
                         "typedPerFilterConfig": {
                           "envoy.filters.http.jwt_authn": {
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
index 94acbe31904..cf16f74c30c 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.all.yaml
@@ -267,8 +267,6 @@ xds:
                     routeConfigName: envoy-gateway-system/eg/http
                   serverHeaderTransformation: PASS_THROUGH
                   statPrefix: http
-                  upgradeConfigs:
-                  - upgradeType: websocket
                   useRemoteAddress: true
             name: envoy-gateway-system/eg/http
             perConnectionBufferLimitBytes: 32768
@@ -288,6 +286,8 @@ xds:
               name: httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com
               route:
                 cluster: httproute/envoy-gateway-system/backend/rule/0
+                upgradeConfigs:
+                - upgradeType: websocket
               typedPerFilterConfig:
                 envoy.filters.http.jwt_authn:
                   '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml
index acc9e8afdee..5ee4e32724b 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.listener.yaml
@@ -74,8 +74,6 @@ xds:
                   routeConfigName: envoy-gateway-system/eg/http
                 serverHeaderTransformation: PASS_THROUGH
                 statPrefix: http
-                upgradeConfigs:
-                - upgradeType: websocket
                 useRemoteAddress: true
           name: envoy-gateway-system/eg/http
           perConnectionBufferLimitBytes: 32768
diff --git a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.route.yaml b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.route.yaml
index 476fb3e582e..a02553f1008 100644
--- a/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.route.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/jwt-single-route-single-match-to-xds.route.yaml
@@ -16,6 +16,8 @@ xds:
             name: httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com
             route:
               cluster: httproute/envoy-gateway-system/backend/rule/0
+              upgradeConfigs:
+              - upgradeType: websocket
             typedPerFilterConfig:
               envoy.filters.http.jwt_authn:
                 '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/cmd/egctl/testdata/translate/out/multiple-xds.route.json b/internal/cmd/egctl/testdata/translate/out/multiple-xds.route.json
index c2d43139edd..b311b711839 100644
--- a/internal/cmd/egctl/testdata/translate/out/multiple-xds.route.json
+++ b/internal/cmd/egctl/testdata/translate/out/multiple-xds.route.json
@@ -21,7 +21,12 @@
                     },
                     "name": "httproute/default/backend/rule/0/match/0/www_example_com",
                     "route": {
-                      "cluster": "httproute/default/backend/rule/0"
+                      "cluster": "httproute/default/backend/rule/0",
+                      "upgradeConfigs": [
+                        {
+                          "upgradeType": "websocket"
+                        }
+                      ]
                     }
                   }
                 ]
@@ -52,7 +57,12 @@
                     },
                     "name": "httproute/default/backend/rule/0/match/0/www_example2_com",
                     "route": {
-                      "cluster": "httproute/default/backend/rule/0"
+                      "cluster": "httproute/default/backend/rule/0",
+                      "upgradeConfigs": [
+                        {
+                          "upgradeType": "websocket"
+                        }
+                      ]
                     }
                   }
                 ]
diff --git a/internal/cmd/egctl/testdata/translate/out/quickstart.route.yaml b/internal/cmd/egctl/testdata/translate/out/quickstart.route.yaml
index 12104d66b08..f358d4066ef 100644
--- a/internal/cmd/egctl/testdata/translate/out/quickstart.route.yaml
+++ b/internal/cmd/egctl/testdata/translate/out/quickstart.route.yaml
@@ -16,3 +16,5 @@ xds:
             name: httproute/envoy-gateway-system/backend/rule/0/match/0/www_example_com
             route:
               cluster: httproute/envoy-gateway-system/backend/rule/0
+              upgradeConfigs:
+              - upgradeType: websocket
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
index 8d808860337..429b235bb9e 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-conditions.out.yaml
@@ -360,6 +360,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
@@ -390,4 +391,5 @@ xdsIR:
           exact: foo
           name: magic
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
index 67f60a56cdd..d712794bd95 100755
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-status-fault-injection.out.yaml
@@ -333,6 +333,7 @@ xdsIR:
             fixedDelay: 5.4s
             percentage: 80
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
   envoy-gateway/gateway-2:
     accessLog:
@@ -366,6 +367,7 @@ xdsIR:
             httpStatus: 14
             percentage: 0.01
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -391,6 +393,7 @@ xdsIR:
             fixedDelay: 5.4s
             percentage: 80
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
index 5d6239cac0e..913635d6c66 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers-error.out.yaml
@@ -141,4 +141,5 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
index bcb293af7e3..8ff4e800f63 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-circuitbreakers.out.yaml
@@ -265,6 +265,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
   envoy-gateway/gateway-2:
     accessLog:
@@ -298,6 +299,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
index c17d82f6c58..78b8946cc3e 100755
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-healthcheck.out.yaml
@@ -459,6 +459,7 @@ xdsIR:
             interval: 2s
             maxEjectionPercent: 100
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
   envoy-gateway/gateway-2:
     accessLog:
@@ -503,6 +504,7 @@ xdsIR:
             interval: 1s
             maxEjectionPercent: 100
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -536,6 +538,7 @@ xdsIR:
             interval: 8ms
             maxEjectionPercent: 11
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-3/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -572,6 +575,7 @@ xdsIR:
             interval: 1s
             maxEjectionPercent: 100
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
index 9d5bcd090da..bab8fe348b4 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-loadbalancer.out.yaml
@@ -341,6 +341,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         loadBalancer:
           random: {}
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
@@ -372,6 +373,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         loadBalancer:
           leastRequest:
             slowStart:
@@ -394,6 +396,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         loadBalancer:
           consistentHash:
             sourceIP: true
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
index abc03a88998..e228e877699 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-default-route-level-limit.out.yaml
@@ -167,6 +167,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
index cb2cc3a2d65..b5b012fec27 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-limit-unit.out.yaml
@@ -171,6 +171,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
index e1ad598d0d0..7dd5dc16199 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-match-type.out.yaml
@@ -167,6 +167,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
index 6aa90e650eb..44be1dd47f2 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit-invalid-multiple-route-level-limits.out.yaml
@@ -173,6 +173,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
index b6a440898a5..d6dfc3c0cd4 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-local-ratelimit.out.yaml
@@ -170,6 +170,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
index 9a6a9484204..04dfca6761d 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-proxyprotocol.out.yaml
@@ -255,6 +255,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         proxyProtocol:
           version: V1
@@ -286,6 +287,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
index 4a807fcd435..489f48f5a36 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit-invalid-regex.out.yaml
@@ -153,4 +153,5 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
index 9d0268467bb..87cd06f079c 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-ratelimit.out.yaml
@@ -275,6 +275,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         rateLimit:
           global:
@@ -316,6 +317,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
index 76347ce5b79..9d3f4a10de7 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-retries.out.yaml
@@ -274,6 +274,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         retry:
           perRetry:
@@ -312,6 +313,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
index 08a24c14b4b..206a51d78e8 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-same-prefix-httproutes.out.yaml
@@ -189,6 +189,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -207,6 +208,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
index 3f9bbb33a3e..b8edd449b87 100644
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-tcpkeepalive.out.yaml
@@ -259,6 +259,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         tcpKeepalive:
           idleTime: 1200
@@ -292,6 +293,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
index 6feff83ca6b..672c34f5bc4 100755
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout-error.out.yaml
@@ -145,4 +145,5 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
index 9c5fe2dca53..5dc17c1c327 100755
--- a/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/backendtrafficpolicy-with-timeout.out.yaml
@@ -263,6 +263,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         timeout:
           http:
@@ -298,6 +299,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
index 1ffbde52972..cafbbaa06ae 100644
--- a/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
+++ b/internal/gatewayapi/testdata/clienttrafficpolicy-http3.out.yaml
@@ -148,6 +148,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/extensions/httproute-with-valid-extension-filter.out.yaml b/internal/gatewayapi/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
index bee2d20033d..b468c423db5 100644
--- a/internal/gatewayapi/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
+++ b/internal/gatewayapi/testdata/extensions/httproute-with-valid-extension-filter.out.yaml
@@ -139,6 +139,7 @@ xdsIR:
             spec:
               data: stuff
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
index 93253e5b9dd..4b5c58da3f1 100644
--- a/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-allows-same-namespace-with-allowed-httproute.out.yaml
@@ -119,6 +119,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
index 57e77d7b5f5..c83cb118ca4 100644
--- a/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-infrastructure.out.yaml
@@ -137,6 +137,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
index f72ccd5db18..3149574f2a7 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-secret-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -126,6 +126,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
index e8683486282..10d648c3c07 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-tls-terminate-and-passthrough.out.yaml
@@ -195,6 +195,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo_bar_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
index e2cd9a173fe..f4d7c106a12 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration-with-same-algorithm-different-fqdn.out.yaml
@@ -128,6 +128,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
index 741785be4b6..d7ead7a8e2b 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-multiple-tls-configuration.out.yaml
@@ -128,6 +128,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
index bc02d7f9543..3c5182cc5a2 100644
--- a/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-listener-with-valid-tls-configuration.out.yaml
@@ -125,6 +125,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
index da6a4630591..d2dce6e0af7 100644
--- a/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-preexisting-status-condition.out.yaml
@@ -119,6 +119,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
index aae3821da4d..72c9325677f 100644
--- a/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-stale-status-condition.out.yaml
@@ -125,6 +125,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
index 450ca22686f..267296982ad 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-multiple-httproutes.out.yaml
@@ -191,6 +191,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.com
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/foo_com
         pathMatch:
           distinct: false
@@ -209,6 +210,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo_com
         pathMatch:
           distinct: false
@@ -237,6 +239,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
@@ -255,6 +258,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
index 28c85b2b592..61119e9b76a 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-tcp-protocol.out.yaml
@@ -186,6 +186,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
index 15218199088..fb19c1102f6 100644
--- a/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
+++ b/internal/gatewayapi/testdata/gateway-with-two-listeners-with-same-port-http-udp-protocol.out.yaml
@@ -186,6 +186,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
index c7dc5625f0d..d2abc957458 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-header-match.out.yaml
@@ -127,4 +127,5 @@ xdsIR:
           exact: foo
           name: magic
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
index c5bf727817f..45acfd7e614 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-and-service-match.out.yaml
@@ -127,6 +127,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
@@ -145,6 +146,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/1/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
index 864dddf6f6b..67ed17a35f4 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-method-match.out.yaml
@@ -125,6 +125,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/1/*
         pathMatch:
           distinct: false
@@ -147,4 +148,5 @@ xdsIR:
           name: :path
           suffix: /ExampleExact
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/0/*
diff --git a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
index 879cc4470ce..76f8148dce5 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-request-header-modifier.out.yaml
@@ -128,4 +128,5 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
diff --git a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
index 231851d40de..9624ffcaab1 100644
--- a/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
+++ b/internal/gatewayapi/testdata/grpcroute-with-service-match.out.yaml
@@ -125,6 +125,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
@@ -143,6 +144,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/1/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
index 7087de39768..2cb3682b846 100755
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout-error.out.yaml
@@ -150,6 +150,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
index 4f34e9e2b46..9fd9cf55b56 100755
--- a/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-and-backendtrafficpolicy-with-timeout.out.yaml
@@ -264,6 +264,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
         timeout:
           http:
@@ -299,6 +300,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
index 6fe027dc93d..9d0c0d570c9 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-different-listeners.out.yaml
@@ -379,6 +379,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo_com
         pathMatch:
           distinct: false
@@ -407,6 +408,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
@@ -435,6 +437,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo1.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo1_com
         pathMatch:
           distinct: false
@@ -463,6 +466,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar1.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar1_com
         pathMatch:
           distinct: false
@@ -491,6 +495,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo2.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo2_com
         pathMatch:
           distinct: false
@@ -519,6 +524,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar2.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar2_com
         pathMatch:
           distinct: false
@@ -547,6 +553,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo3.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo3_com
         pathMatch:
           distinct: false
@@ -575,6 +582,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar3.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar3_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
index 2e7dfc189f5..90041233336 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-more-listeners.out.yaml
@@ -330,6 +330,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo_com
         pathMatch:
           distinct: false
@@ -358,6 +359,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
@@ -386,6 +388,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo1.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo1_com
         pathMatch:
           distinct: false
@@ -414,6 +417,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar1.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar1_com
         pathMatch:
           distinct: false
@@ -442,6 +446,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo2.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo2_com
         pathMatch:
           distinct: false
@@ -470,6 +475,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar2.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar2_com
         pathMatch:
           distinct: false
@@ -498,6 +504,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo3.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo3_com
         pathMatch:
           distinct: false
@@ -526,6 +533,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar3.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar3_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
index fbb816e0e08..5637d770bc7 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners-with-different-ports.out.yaml
@@ -161,6 +161,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
@@ -189,6 +190,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
index bfa550205f1..cda246ecc6c 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway-with-two-listeners.out.yaml
@@ -150,6 +150,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/foo_com
         pathMatch:
           distinct: false
@@ -178,6 +179,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
index 77055214392..39834ebc86e 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-gateway.out.yaml
@@ -119,6 +119,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
index affe7bd4a7d..813d9250277 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-matching-port.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
index 7d6a3662201..bbc2f85502a 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-on-gateway-with-two-listeners.out.yaml
@@ -161,6 +161,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: bar.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/bar_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
index 3ec90700af6..967713517a0 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-diff-address-type.out.yaml
@@ -133,6 +133,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
index fb9339aea14..2a60e150ec6 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-multiple-serviceimport-backendrefs-same-address-type.out.yaml
@@ -133,6 +133,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
index 77dca838d87..369959e0c7d 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-fqdn-address-type.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
index 7f2664975bc..cd98ee93cc8 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref-mixed-address-type.out.yaml
@@ -125,6 +125,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
index 94da4357e7b..8ffa5793822 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener-with-serviceimport-backendref.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
index 0eb0237ab30..55c1ac1b83d 100644
--- a/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-attaching-to-listener.out.yaml
@@ -121,6 +121,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
index d30ba8e8970..e448a02bf2d 100644
--- a/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-backend-request-timeout.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
index 6001280e097..ec80e30e1e8 100644
--- a/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-request-timeout.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
index 643f69900d0..048b705766e 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-no-weights.out.yaml
@@ -135,6 +135,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
index 8cb654878a7..53038b2348b 100644
--- a/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-rule-with-multiple-backends-and-weights.out.yaml
@@ -141,6 +141,7 @@ xdsIR:
             protocol: HTTP
             weight: 3
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
index 87fbbab63cc..b827af53150 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -121,6 +121,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
index d4210c16826..485d59bcde1 100644
--- a/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-backendref-serviceimport-in-other-namespace-allowed-by-refgrant.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
index 3548d51c01e..5ef60eccf6a 100644
--- a/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-empty-matches.out.yaml
@@ -118,4 +118,5 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/-1/*
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
index aae26304aa7..9d439afa3c6 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -149,6 +149,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
index b8502e6f6d5..7d69c437116 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-adds.out.yaml
@@ -165,6 +165,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
index 9a5096c8977..f8a325b46ee 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -135,6 +135,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
index 6578feab64f..53c939f2b0d 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-duplicate-removes.out.yaml
@@ -130,6 +130,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
index 7705fdfabae..b5193139bbe 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-empty-header-values.out.yaml
@@ -140,6 +140,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
index 7a884c68a64..c3ab6b9f021 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-no-headers.out.yaml
@@ -127,6 +127,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
index c477945ad91..3ac50c40bac 100644
--- a/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-header-filter-remove.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
index 01c173f38ac..9c3bab389cf 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-bad-port.out.yaml
@@ -113,6 +113,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
index b276db33814..5f78538385f 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-group.out.yaml
@@ -117,6 +117,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
index 4a803481a22..b38425e7563 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-invalid-kind.out.yaml
@@ -114,6 +114,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
index 71bde7725ea..6668252cdbc 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-port.out.yaml
@@ -113,6 +113,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
index 00148a729ab..da0bce317d6 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.import.out.yaml
@@ -115,6 +115,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
index dc732a9e634..ddaccd43a10 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backend-ref-no-service.out.yaml
@@ -113,6 +113,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
index c5b4a11fc63..8d622b36680 100644
--- a/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-invalid-backendref-in-other-namespace.out.yaml
@@ -114,6 +114,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
index 83ebeba62da..431a85a1dca 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-duplicates.out.yaml
@@ -137,6 +137,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         mirrors:
         - name: httproute/default/httproute-1/rule/0-mirror-0
           settings:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
index 7c62a1f0c23..8588726a36e 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-multiple.out.yaml
@@ -159,6 +159,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         mirrors:
         - name: httproute/default/httproute-1/rule/0-mirror-1
           settings:
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
index 8437bcb0702..a5b71817a08 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-no-port.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
index dd562ce8c9f..a9fb238b04f 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter-service-not-found.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
index df106f915c6..d324d246514 100644
--- a/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-mirror-filter.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         mirrors:
         - name: httproute/default/httproute-1/rule/0-mirror-0
           settings:
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
index 3947ff48a90..a786efec283 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-full-path-replace-https.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
           invalid: 0
           valid: 0
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
index aa327a0b959..97f129b026c 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-hostname.out.yaml
@@ -121,6 +121,7 @@ xdsIR:
           invalid: 0
           valid: 0
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
index c6fe24cbab1..09be04932d9 100644
--- a/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-redirect-filter-prefix-replace-with-port-http.out.yaml
@@ -124,6 +124,7 @@ xdsIR:
           invalid: 0
           valid: 0
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
index 9392479ccea..43c7a116b4b 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-adds.out.yaml
@@ -161,6 +161,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
index fee2bd21097..4fba4eb7b99 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-add-multiple-filters.out.yaml
@@ -149,6 +149,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
index a91ca6103c4..61441d6a1d6 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-adds.out.yaml
@@ -165,6 +165,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
index 5ab2a26ae47..4f58c01222d 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-remove-multiple-filters.out.yaml
@@ -135,6 +135,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
index 2bb71c3ed7e..0cd94a754a4 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-duplicate-removes.out.yaml
@@ -130,6 +130,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
index 3752d8e55a0..b7f3e26ef42 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-empty-header-values.out.yaml
@@ -140,6 +140,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
index 23dc715f356..48c3b5f8f5b 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-no-headers.out.yaml
@@ -127,6 +127,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
index 04fde189169..1ea53e4797d 100644
--- a/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-response-header-filter-remove.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
index 45c81d7d396..0b9bc1037ec 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-exact-path-match.out.yaml
@@ -120,6 +120,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
index bf140ce157c..291e21eebcc 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-http-method-match.out.yaml
@@ -122,4 +122,5 @@ xdsIR:
           exact: POST
           name: :method
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
diff --git a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
index 00156188b42..b16e4cfe932 100644
--- a/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-single-rule-with-path-prefix-and-exact-header-matches.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
           exact: Val-2
           name: Header-2
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
index 0f7128fea24..ad7e977d4a8 100644
--- a/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-some-invalid-backend-refs-no-service.out.yaml
@@ -124,6 +124,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
index 42931795df8..2beec1c17f5 100644
--- a/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-specific-hostname-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -122,6 +122,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
index b3920b0478a..a2a913ec417 100644
--- a/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-two-specific-hostnames-attaching-to-gateway-with-wildcard-hostname.out.yaml
@@ -123,6 +123,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -141,6 +142,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: whales.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/whales_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
index 39989471f38..8b2138f2100 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-full-path-replace-http.out.yaml
@@ -130,6 +130,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
index 7e1364ae96e..9ea570c292b 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname-prefix-replace.out.yaml
@@ -131,6 +131,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
index 2209165a18f..bf682e88b35 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-hostname.out.yaml
@@ -128,6 +128,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
index bfbe2d70d28..b85ff6e2db3 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-invalid-filter-type.out.yaml
@@ -128,6 +128,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
index c23a593b95b..bc23aabd4d7 100644
--- a/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-urlrewrite-filter-prefix-replace-http.out.yaml
@@ -130,6 +130,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
index 0570ee57378..8d436c384cb 100644
--- a/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
+++ b/internal/gatewayapi/testdata/httproute-with-wildcard-hostname-attaching-to-gateway-with-unset-hostname.out.yaml
@@ -121,6 +121,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*.envoyproxy.io'
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/*_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
index 6a2feea08a3..325c79da51d 100644
--- a/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
+++ b/internal/gatewayapi/testdata/httproutes-with-multiple-matches.out.yaml
@@ -306,6 +306,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: example.com
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-2/rule/0/match/0/example_com
         pathMatch:
           distinct: false
@@ -328,6 +329,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: example.com
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-3/rule/0/match/0/example_com
         pathMatch:
           distinct: false
@@ -350,6 +352,7 @@ xdsIR:
           exact: one
           name: version
         hostname: example.net
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-4/rule/0/match/0/example_net
         pathMatch:
           distinct: false
@@ -368,6 +371,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: example.net
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-5/rule/0/match/0/example_net
         pathMatch:
           distinct: false
@@ -386,6 +390,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*.com'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_com
         pathMatch:
           distinct: false
@@ -404,6 +409,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*.net'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*_net
         pathMatch:
           distinct: false
@@ -422,6 +428,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: '*'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
index e3c17952320..073d47f8cfc 100644
--- a/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
+++ b/internal/gatewayapi/testdata/merge-valid-multiple-gateways-multiple-routes.out.yaml
@@ -246,6 +246,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -283,6 +284,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: example.com
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/example_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
index d4471cd24f3..a0317b8cb59 100644
--- a/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-status-conditions.out.yaml
@@ -360,6 +360,7 @@ xdsIR:
         directResponse:
           statusCode: 500
         hostname: '*'
+        isHTTP2: false
         name: httproute/envoy-gateway/httproute-1/rule/0/match/0/*
         pathMatch:
           distinct: false
@@ -390,4 +391,5 @@ xdsIR:
           exact: foo
           name: magic
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/envoy-gateway/grpcroute-1/rule/0/match/0/*
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
index 96c93cd3e93..793ada202e9 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-basic-auth.out.yaml
@@ -150,6 +150,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
index c50b5e03ad6..40e431d4324 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-cors.out.yaml
@@ -426,6 +426,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         name: grpcroute/default/grpcroute-1/rule/0/match/-1/*
   envoy-gateway/gateway-2:
     accessLog:
@@ -473,6 +474,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
@@ -521,6 +523,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/gateway_envoyproxy_io
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
index d7acc9b0a32..bf16c864b02 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-matching-port.out.yaml
@@ -152,6 +152,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: www.foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
index 46f93304a50..975f2f7f894 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-reference-grant.out.yaml
@@ -153,6 +153,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: www.foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
index dfd4c3f88d1..d314d430d0b 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth-invalid-no-service.out.yaml
@@ -152,6 +152,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: www.foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
index 412c5643809..76d0285f006 100755
--- a/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-extauth.out.yaml
@@ -233,6 +233,7 @@ xdsIR:
           - header1
           - header2
         hostname: www.foo.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_foo_com
         pathMatch:
           distinct: false
@@ -267,6 +268,7 @@ xdsIR:
             - header2
             path: /auth
         hostname: www.bar.com
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/www_bar_com
         pathMatch:
           distinct: false
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
index 367f2d30acf..17072300d82 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-and-invalid-oidc.out.yaml
@@ -238,6 +238,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         jwt:
           providers:
           - audiences:
@@ -267,6 +268,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         jwt:
           providers:
           - audiences:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
index 10b9b7e2d4e..b3bd5c88ce7 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt-with-custom-extractor.out.yaml
@@ -290,6 +290,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         jwt:
           providers:
           - audiences:
@@ -339,6 +340,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         jwt:
           providers:
           - audiences:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
index c7e397cc54c..9d808e2ae57 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-jwt.out.yaml
@@ -282,6 +282,7 @@ xdsIR:
             protocol: GRPC
             weight: 1
         hostname: '*'
+        isHTTP2: true
         jwt:
           providers:
           - audiences:
@@ -331,6 +332,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: gateway.envoyproxy.io
+        isHTTP2: false
         jwt:
           providers:
           - audiences:
diff --git a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
index 30b5971ece3..a0953830c23 100644
--- a/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
+++ b/internal/gatewayapi/testdata/securitypolicy-with-oidc.out.yaml
@@ -228,6 +228,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: www.example.com
+        isHTTP2: false
         name: httproute/default/httproute-1/rule/0/match/0/www_example_com
         oidc:
           clientID: client2.oauth.foo.com
@@ -260,6 +261,7 @@ xdsIR:
             protocol: HTTP
             weight: 1
         hostname: www.example.com
+        isHTTP2: false
         name: httproute/default/httproute-2/rule/0/match/0/www_example_com
         oidc:
           clientID: client1.apps.googleusercontent.com
diff --git a/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.listeners.yaml b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.listeners.yaml
index c5835215d89..78de85eaf85 100644
--- a/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.listeners.yaml
+++ b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: extension-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: extension-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.routes.yaml b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.routes.yaml
index 243339164de..b259daf0c76 100644
--- a/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.routes.yaml
+++ b/internal/xds/translator/testdata/out/extension-xds-ir/http-route-extension-filter.routes.yaml
@@ -29,3 +29,5 @@
           value: foo.example.io/v1alpha1
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/extension-xds-ir/http-route.listeners.yaml b/internal/xds/translator/testdata/out/extension-xds-ir/http-route.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/extension-xds-ir/http-route.listeners.yaml
+++ b/internal/xds/translator/testdata/out/extension-xds-ir/http-route.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/extension-xds-ir/http-route.routes.yaml b/internal/xds/translator/testdata/out/extension-xds-ir/http-route.routes.yaml
index 738eb0a2d2a..7030f6f4cd7 100644
--- a/internal/xds/translator/testdata/out/extension-xds-ir/http-route.routes.yaml
+++ b/internal/xds/translator/testdata/out/extension-xds-ir/http-route.routes.yaml
@@ -21,3 +21,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/accesslog.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/accesslog.listeners.yaml
index a3bf0b5bc88..b686e3e3ba5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/accesslog.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/accesslog.listeners.yaml
@@ -138,8 +138,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/basic-auth.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
index 11ecc856c2d..43ae33619b3 100644
--- a/internal/xds/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/basic-auth.listeners.yaml
@@ -34,8 +34,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/basic-auth.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/basic-auth.routes.yaml
index 6fdefbdf7c1..f87be11474a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/basic-auth.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/basic-auth.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.basic_auth_first-route:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/circuit-breaker.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.listeners.yaml
index 102b968f145..4a7a9d7b2d1 100755
--- a/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.listeners.yaml
@@ -26,8 +26,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
         xffNumTrustedHops: 2
   name: first-listener
@@ -66,8 +64,6 @@
           routeConfigName: second-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: false
   name: second-listener
   perConnectionBufferLimitBytes: 32768
@@ -107,8 +103,6 @@
           routeConfigName: third-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: false
   name: third-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.routes.yaml
index 724f80699c7..12a38a14ef8 100755
--- a/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/client-ip-detection.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: second-listener
   virtualHosts:
@@ -22,6 +24,8 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: third-listener
   virtualHosts:
@@ -34,3 +38,5 @@
       name: third-route
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
index e6e99e720bf..5c15af1329f 100644
--- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.listeners.yaml
@@ -29,8 +29,6 @@
         requestTimeout: 5s
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/client-timeout.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/cors.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/cors.listeners.yaml
index b9858e6777a..f5269c85d61 100644
--- a/internal/xds/translator/testdata/out/xds-ir/cors.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/cors.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml
index fc0fdea378e..f776257868c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/cors.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.cors:
           '@type': type.googleapis.com/envoy.extensions.filters.http.cors.v3.CorsPolicy
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
index ec6f73b212f..39e40d86862 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth.listeners.yaml
@@ -55,8 +55,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ext-auth.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ext-auth.routes.yaml
index d8aae14302a..0b039af3da3 100755
--- a/internal/xds/translator/testdata/out/xds-ir/ext-auth.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ext-auth.routes.yaml
@@ -10,6 +10,8 @@
       name: httproute/default/httproute-1/rule/0/match/0/www_example_com
       route:
         cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.ext_authz_httproute/default/httproute-1/rule/0/match/0/www_example_com:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
@@ -19,6 +21,8 @@
       name: httproute/default/httproute-2/rule/0/match/0/www_example_com
       route:
         cluster: httproute/default/httproute-2/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.ext_authz_httproute/default/httproute-2/rule/0/match/0/www_example_com:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/fault-injection.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
index 7586adc78b0..17eedce3c8e 100755
--- a/internal/xds/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/fault-injection.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/fault-injection.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/fault-injection.routes.yaml
index bed4a696e0a..1f093f5a0c2 100755
--- a/internal/xds/translator/testdata/out/xds-ir/fault-injection.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/fault-injection.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.fault:
           '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
@@ -23,6 +25,8 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.fault:
           '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
@@ -36,6 +40,8 @@
       name: third-route
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.fault:
           '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
@@ -54,6 +60,8 @@
       name: fourth-route
       route:
         cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.fault:
           '@type': type.googleapis.com/envoy.extensions.filters.http.fault.v3.HTTPFault
@@ -72,3 +80,5 @@
       name: fifth-route
       route:
         cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/health-check.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/health-check.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/health-check.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/health-check.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/health-check.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/health-check.routes.yaml
index 79c66f88204..de4249178e4 100644
--- a/internal/xds/translator/testdata/out/xds-ir/health-check.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/health-check.routes.yaml
@@ -10,18 +10,26 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: third-route
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: fourth-route
       route:
         cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-direct-response.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
index 7b23a59dfee..c27e2ea5779 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-dns-cluster.routes.yaml
@@ -14,3 +14,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
index c5f6e70b254..c5a187d2c26 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-mirror.routes.yaml
@@ -10,3 +10,5 @@
       name: mirror-route
       route:
         cluster: route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
index 2db7970b38a..25584aa3a91 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-matches.routes.yaml
@@ -14,11 +14,15 @@
       name: envoy-gateway/httproute-2/rule/0/match/0/example.com
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         pathSeparatedPrefix: /v1/example
       name: envoy-gateway/httproute-3/rule/0/match/0/example.com
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - example.net
     name: first-listener/example_net
@@ -32,11 +36,15 @@
       name: envoy-gateway/httproute-4/rule/0/match/0/example.net
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         pathSeparatedPrefix: /v1/status
       name: envoy-gateway/httproute-5/rule/0/match/0/example.net
       route:
         cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - '*.com'
     name: first-listener/*_com
@@ -46,6 +54,8 @@
       name: envoy-gateway/httproute-1/rule/0/match/0/*.com
       route:
         cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - '*.net'
     name: first-listener/*_net
@@ -55,6 +65,8 @@
       name: envoy-gateway/httproute-1/rule/0/match/0/*.net
       route:
         cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - '*'
     name: first-listener/*
@@ -64,3 +76,5 @@
       name: envoy-gateway/httproute-1/rule/0/match/0/*
       route:
         cluster: seventh-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
index 1429b4da64e..f46cc50eb52 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-multiple-mirrors.routes.yaml
@@ -13,3 +13,5 @@
         requestMirrorPolicies:
         - cluster: mirror-route-dest
         - cluster: mirror-route-dest1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
index ac7c41d9846..61face5a3a3 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-partial-invalid.routes.yaml
@@ -21,6 +21,8 @@
       name: valid-route
       route:
         cluster: valid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         headers:
         - name: user
@@ -37,3 +39,5 @@
       name: invalid-route
       route:
         cluster: invalid-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-redirect.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-regex.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-regex.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
index a3c115b6da9..7bc7d162a85 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-regex.routes.yaml
@@ -21,3 +21,5 @@
       name: regex-route
       route:
         cluster: regex-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
index 3ded1e7105d..f91a70cb2ee 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-request-headers.routes.yaml
@@ -32,3 +32,5 @@
       - some-header6
       route:
         cluster: request-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
index a57c32ff84a..b2241a1181c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-headers.routes.yaml
@@ -29,3 +29,5 @@
         keepEmptyValue: true
       route:
         cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
index f8c7a7ff5bb..b09594aecda 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-add-remove-headers.routes.yaml
@@ -32,3 +32,5 @@
       - some-header6
       route:
         cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
index 4052f973e28..58a4e272090 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-response-remove-headers.routes.yaml
@@ -13,3 +13,5 @@
       - some-header6
       route:
         cluster: response-header-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-root-path-url-prefix.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-fullpath.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-host.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-rewrite-url-prefix.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
index 52a166770bc..db3dbd4ba6a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-timeout.routes.yaml
@@ -15,3 +15,5 @@
       route:
         cluster: first-route-dest
         timeout: 5s
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-backend.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
index 5b56c04dbae..235dea42729 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route-weighted-invalid-backend.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         clusterNotFoundResponseCode: INTERNAL_SERVER_ERROR
+        upgradeConfigs:
+        - upgradeType: websocket
         weightedClusters:
           clusters:
           - name: invalid-backend-cluster
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http-route.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http-route.routes.yaml
index 738eb0a2d2a..7030f6f4cd7 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http-route.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http-route.routes.yaml
@@ -21,3 +21,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
index 51679103175..97027d4ddd3 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.listeners.yaml
@@ -34,8 +34,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
@@ -76,8 +74,6 @@
           routeConfigName: second-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: second-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
index d36b9824e31..ff93cfff360 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http1-preserve-case.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: second-listener
   virtualHosts:
@@ -22,3 +24,5 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
index 59592df658a..deeec73ee85 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http1-trailers.listeners.yaml
@@ -30,8 +30,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http1-trailers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http1-trailers.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http10.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http10.listeners.yaml
index cb4e1c75776..4833fb5d95d 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http10.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http10.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/http10.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http10.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http10.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http10.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http2-route.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http2-route.routes.yaml
index 59831c3176d..a32852fcd88 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http2-route.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http2-route.routes.yaml
@@ -18,3 +18,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/http3.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/http3.listeners.yaml
index 5c05193ce62..b702b2028ca 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http3.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http3.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: envoy-gateway/gateway-1/tls
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.quic
@@ -81,8 +79,6 @@
           routeConfigName: envoy-gateway/gateway-1/tls
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/http3.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/http3.routes.yaml
index d129cf7589d..0680b361d15 100644
--- a/internal/xds/translator/testdata/out/xds-ir/http3.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/http3.routes.yaml
@@ -15,3 +15,5 @@
           value: h3=":10443"; ma=86400
       route:
         cluster: httproute/default/httproute-1/rule/0
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
index d0e88f02b41..cc9cac0f374 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
@@ -39,8 +39,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
index dc48be19646..4a412b3576a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.routes.yaml
@@ -14,3 +14,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.envoypatchpolicies.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.envoypatchpolicies.yaml
index 8d9f6918bd1..b56bc6e6ec7 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.envoypatchpolicies.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.envoypatchpolicies.yaml
@@ -3,8 +3,8 @@
   status:
     conditions:
     - lastTransitionTime: null
-      message: 'unable to unmarshal xds resource {"name":"first-listener","address":{"socket_address":{"address":"0.0.0.0","port_value":10080}},"default_filter_chain":{"filters":[{"name":"envoy.filters.network.http_connection_manager","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","stat_prefix":"http","rds":{"config_source":{"ads":{},"resource_api_version":"V3"},"route_config_name":"first-listener"},"http_filters":[{"name":"envoy.filters.http.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router","suppress_envoy_headers":true}}],"common_http_protocol_options":{"headers_with_underscores_action":"REJECT_REQUEST"},"http2_protocol_options":{"max_concurrent_streams":100,"initial_stream_window_size":65536,"initial_connection_window_size":1048576},"server_header_transformation":"PASS_THROUGH","use_remote_address":true,"upgrade_configs":[{"upgrade_type":"websocket"}],"normalize_path":true,"merge_slashes":true,"path_with_escaped_slashes_action":"UNESCAPE_AND_REDIRECT"}}]},"per_connection_buffer_limit_bytes":32768,"this":{"path":{"never":{"existed":{"name":"envoy.filters.http.ratelimit","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit","domain":"eg-ratelimit","failure_mode_deny":true,"rate_limit_service":{"grpc_service":{"envoy_grpc":{"cluster_name":"rate-limit-cluster"}},"transport_api_version":"V3"},"timeout":"1s"}}}}}},
-        err:proto: (line 1:1099): unknown field "this"'
+      message: 'unable to unmarshal xds resource {"name":"first-listener","address":{"socket_address":{"address":"0.0.0.0","port_value":10080}},"default_filter_chain":{"filters":[{"name":"envoy.filters.network.http_connection_manager","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager","stat_prefix":"http","rds":{"config_source":{"ads":{},"resource_api_version":"V3"},"route_config_name":"first-listener"},"http_filters":[{"name":"envoy.filters.http.router","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.router.v3.Router","suppress_envoy_headers":true}}],"common_http_protocol_options":{"headers_with_underscores_action":"REJECT_REQUEST"},"http2_protocol_options":{"max_concurrent_streams":100,"initial_stream_window_size":65536,"initial_connection_window_size":1048576},"server_header_transformation":"PASS_THROUGH","use_remote_address":true,"normalize_path":true,"merge_slashes":true,"path_with_escaped_slashes_action":"UNESCAPE_AND_REDIRECT"}}]},"per_connection_buffer_limit_bytes":32768,"this":{"path":{"never":{"existed":{"name":"envoy.filters.http.ratelimit","typed_config":{"@type":"type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit","domain":"eg-ratelimit","failure_mode_deny":true,"rate_limit_service":{"grpc_service":{"envoy_grpc":{"cluster_name":"rate-limit-cluster"}},"transport_api_version":"V3"},"timeout":"1s"}}}}}},
+        err:proto: (line 1:1050): unknown field "this"'
       reason: Invalid
       status: "False"
       type: Programmed
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
index dc48be19646..4a412b3576a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-invalid-patch.routes.yaml
@@ -14,3 +14,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
index dc48be19646..4a412b3576a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-missing-resource.routes.yaml
@@ -14,3 +14,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
index d0e88f02b41..cc9cac0f374 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
@@ -39,8 +39,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
index dc48be19646..4a412b3576a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.routes.yaml
@@ -14,3 +14,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
index d0e88f02b41..cc9cac0f374 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch.listeners.yaml
@@ -39,8 +39,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/jsonpatch.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
index fae73436c2f..3f4a7333a60 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jsonpatch.routes.yaml
@@ -17,3 +17,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.listeners.yaml
index b8a88fd7937..dd56da6385e 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.listeners.yaml
@@ -56,8 +56,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.routes.yaml
index c73bec09093..321ecc1ced2 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-custom-extractor.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.listeners.yaml
index df761c63a07..2fe288a18ea 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.listeners.yaml
@@ -112,8 +112,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.routes.yaml
index 630157c4b40..5cd81b5d475 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-multi-provider.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route-www.test.com
       route:
         cluster: first-route-www.test.com-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
@@ -19,6 +21,8 @@
       name: second-route-www.test.com
       route:
         cluster: second-route-www.test.com-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.listeners.yaml
index e16c2673208..696a3a7cd8f 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.listeners.yaml
@@ -90,8 +90,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.routes.yaml
index 2078809a694..7c52b6de16d 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-multi-route-single-provider.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
@@ -19,6 +21,8 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
index 72c2f332e63..ead9542a53c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
@@ -59,8 +59,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.routes.yaml
index 019897bf021..0e312fd928c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.routes.yaml
@@ -23,6 +23,8 @@
               - name: x-user-id
                 stringMatch:
                   exact: one
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
@@ -40,6 +42,8 @@
           - requestHeaders:
               descriptorKey: rule-0-match-0
               headerName: x-user-id
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: test
       name: third-route
@@ -53,3 +57,5 @@
           - genericKey:
               descriptorKey: rule-0-match--1
               descriptorValue: rule-0-match--1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.listeners.yaml
index 945509a0522..a25e8b6b7c9 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.listeners.yaml
@@ -49,8 +49,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.routes.yaml
index c73bec09093..321ecc1ced2 100644
--- a/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/jwt-single-route-single-match.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.jwt_authn:
           '@type': type.googleapis.com/envoy.extensions.filters.http.jwt_authn.v3.PerRouteConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
index 4df723a0307..b6beea79e4b 100644
--- a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/listener-proxy-protocol.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
index 203f36be5a5..5acf269fa9a 100644
--- a/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
@@ -68,8 +66,6 @@
           routeConfigName: second-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: second-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
index d36b9824e31..ff93cfff360 100644
--- a/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/listener-tcp-keepalive.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: second-listener
   virtualHosts:
@@ -22,3 +24,5 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/load-balancer.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/load-balancer.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/load-balancer.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/load-balancer.routes.yaml
index d2a33c64849..49db596538b 100644
--- a/internal/xds/translator/testdata/out/xds-ir/load-balancer.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/load-balancer.routes.yaml
@@ -10,16 +10,22 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: third-route
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: fourth-route
@@ -28,13 +34,19 @@
         hashPolicy:
         - connectionProperties:
             sourceIp: true
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: fifth-route
       route:
         cluster: fifth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         prefix: /
       name: sixth-route
       route:
         cluster: sixth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.listeners.yaml
index 3841aa65768..afa59059ebd 100644
--- a/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.listeners.yaml
@@ -32,8 +32,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.routes.yaml
index 3f28acd5a15..9b5dd3f7d03 100644
--- a/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/local-ratelimit.routes.yaml
@@ -28,6 +28,8 @@
               - name: x-org-id
                 stringMatch:
                   exact: foo
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.local_ratelimit:
           '@type': type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
@@ -95,6 +97,8 @@
                   exact: bar
           - maskedRemoteAddress:
               v4PrefixMaskLen: 16
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.local_ratelimit:
           '@type': type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
@@ -136,6 +140,8 @@
       name: third-route-ratelimit-no-rule
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.local_ratelimit:
           '@type': type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
diff --git a/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
index 0d2cb8567b8..41594a227db 100644
--- a/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/metrics-virtual-host.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
     virtualClusters:
     - headers:
       - name: :authority
diff --git a/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
index 102fe74e070..848a62deab3 100644
--- a/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: third-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   filterChains:
   - filterChainMatch:
@@ -60,8 +58,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
@@ -104,8 +100,6 @@
           routeConfigName: second-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
index cd8f24c1194..c94d2c09f70 100644
--- a/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/multiple-listeners-same-port.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: second-listener
   virtualHosts:
@@ -22,6 +24,8 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
 - ignorePortInHostMatching: true
   name: third-listener
   virtualHosts:
@@ -34,6 +38,8 @@
       name: third-route
       route:
         cluster: third-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - '*'
     name: fourth-listener/*
@@ -43,3 +49,5 @@
       name: fourth-route
       route:
         cluster: fourth-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
index 4726fb8aa0e..f0a783d1225 100644
--- a/internal/xds/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/mutual-tls.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/mutual-tls.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/mutual-tls.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
index 8173e9f9e29..e2ed7593b71 100644
--- a/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/oidc.listeners.yaml
@@ -110,8 +110,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/oidc.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/oidc.routes.yaml
index f4ba1044899..a093d6967ac 100644
--- a/internal/xds/translator/testdata/out/xds-ir/oidc.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/oidc.routes.yaml
@@ -10,6 +10,8 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.oauth2_first-route:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
@@ -19,6 +21,8 @@
       name: second-route
       route:
         cluster: second-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
       typedPerFilterConfig:
         envoy.filters.http.oauth2_second-route:
           '@type': type.googleapis.com/envoy.config.route.v3.FilterConfig
diff --git a/internal/xds/translator/testdata/out/xds-ir/path-settings.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/path-settings.listeners.yaml
index 88def256e95..3396e1ded63 100644
--- a/internal/xds/translator/testdata/out/xds-ir/path-settings.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/path-settings.listeners.yaml
@@ -27,8 +27,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/path-settings.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/path-settings.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/path-settings.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/path-settings.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/proxy-protocol-upstream.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
index be0d4a05bfd..def74e6c3aa 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
@@ -38,8 +38,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.routes.yaml
index 8146d71a226..479c2cd143c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.routes.yaml
@@ -23,6 +23,8 @@
               - name: x-user-id
                 stringMatch:
                   exact: one
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: example
       name: second-route
@@ -36,6 +38,8 @@
           - requestHeaders:
               descriptorKey: rule-0-match-0
               headerName: x-user-id
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: test
       name: third-route
@@ -49,3 +53,5 @@
           - genericKey:
               descriptorKey: rule-0-match--1
               descriptorValue: rule-0-match--1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
index be0d4a05bfd..def74e6c3aa 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
@@ -38,8 +38,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.routes.yaml
index cb60f39a5db..a82f9d5c459 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.routes.yaml
@@ -17,6 +17,8 @@
               descriptorValue: first-route
           - maskedRemoteAddress:
               v4PrefixMaskLen: 16
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: example
       name: second-route
@@ -29,6 +31,8 @@
               descriptorValue: second-route
           - maskedRemoteAddress:
               v4PrefixMaskLen: 24
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: test
       name: third-route
@@ -42,6 +46,8 @@
           - genericKey:
               descriptorKey: rule-0-match--1
               descriptorValue: rule-0-match--1
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: distinct
       name: fourth-route
@@ -55,3 +61,5 @@
           - maskedRemoteAddress:
               v4PrefixMaskLen: 16
           - remoteAddress: {}
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
index be0d4a05bfd..def74e6c3aa 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
@@ -38,8 +38,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/ratelimit.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/ratelimit.routes.yaml
index 8146d71a226..479c2cd143c 100644
--- a/internal/xds/translator/testdata/out/xds-ir/ratelimit.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/ratelimit.routes.yaml
@@ -23,6 +23,8 @@
               - name: x-user-id
                 stringMatch:
                   exact: one
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: example
       name: second-route
@@ -36,6 +38,8 @@
           - requestHeaders:
               descriptorKey: rule-0-match-0
               headerName: x-user-id
+        upgradeConfigs:
+        - upgradeType: websocket
     - match:
         path: test
       name: third-route
@@ -49,3 +53,5 @@
           - genericKey:
               descriptorKey: rule-0-match--1
               descriptorValue: rule-0-match--1
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
index e71f0c41be5..e1b4ffe7bf1 100644
--- a/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/retry-partial-invalid.routes.yaml
@@ -20,6 +20,8 @@
             baseInterval: 0.100s
             maxInterval: 10s
           retryOn: connect-failure,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - foo
     name: first-listener/foo
@@ -34,6 +36,8 @@
           retriableStatusCodes:
           - 503
           retryOn: connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes
+        upgradeConfigs:
+        - upgradeType: websocket
   - domains:
     - bar
     name: first-listener/bar
diff --git a/internal/xds/translator/testdata/out/xds-ir/simple-tls.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
index 3fd6384f903..469471fbbe9 100644
--- a/internal/xds/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/simple-tls.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/simple-tls.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/simple-tls.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/simple-tls.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/simple-tls.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
index 9c68dc1ab54..7857a5110d9 100644
--- a/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.listeners.yaml
@@ -30,8 +30,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/suppress-envoy-headers.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/timeout.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/timeout.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/timeout.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/timeout.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/timeout.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/timeout.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/timeout.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/timeout.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
index a404ab4d9f6..002b05c25de 100644
--- a/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.listeners.yaml
@@ -31,8 +31,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: https
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
     transportSocket:
       name: envoy.transport_sockets.tls
diff --git a/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/tls-with-ciphers-versions-alpn.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket
diff --git a/internal/xds/translator/testdata/out/xds-ir/tracing.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/tracing.listeners.yaml
index e27bb6fec3a..4932ef2516f 100644
--- a/internal/xds/translator/testdata/out/xds-ir/tracing.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/tracing.listeners.yaml
@@ -56,8 +56,6 @@
               serviceName: fake-name.fake-ns
           randomSampling:
             value: 90
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml b/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
index 046589e0fd8..e9224a23bd5 100644
--- a/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.listeners.yaml
@@ -28,8 +28,6 @@
           routeConfigName: first-listener
         serverHeaderTransformation: PASS_THROUGH
         statPrefix: http
-        upgradeConfigs:
-        - upgradeType: websocket
         useRemoteAddress: true
   name: first-listener
   perConnectionBufferLimitBytes: 32768
diff --git a/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml b/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
index 2734c7cc42a..0b5b4bee7bb 100644
--- a/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
+++ b/internal/xds/translator/testdata/out/xds-ir/upstream-tcpkeepalive.routes.yaml
@@ -10,3 +10,5 @@
       name: first-route
       route:
         cluster: first-route-dest
+        upgradeConfigs:
+        - upgradeType: websocket