From 1e252323b304cef05a5baa093879cf33b96bb235 Mon Sep 17 00:00:00 2001
From: Eitan Suez <eitan@tetrate.io>
Date: Fri, 19 Apr 2024 15:45:31 -0500
Subject: [PATCH 1/3] docs: (#3137) show 'apply yaml' either from stdin, or
 from file using tabs

Signed-off-by: Eitan Suez <eitan@tetrate.io>
---
 .../tasks/traffic/http-request-headers.md     | 152 ++++++++++++++++++
 1 file changed, 152 insertions(+)

diff --git a/site/content/en/latest/tasks/traffic/http-request-headers.md b/site/content/en/latest/tasks/traffic/http-request-headers.md
index 05cb770c4a7..c3e4efdfe26 100644
--- a/site/content/en/latest/tasks/traffic/http-request-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-request-headers.md
@@ -24,6 +24,8 @@ does not have the header configured by the filter, then that header will be adde
 has the header configured by the filter, then the value of the header in the filter will be appended to the value of the
 header in the request.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -54,6 +56,42 @@ spec:
           value: "foo"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: RequestHeaderModifier
+      requestHeaderModifier:
+        add:
+        - name: "add-header"
+          value: "foo"
+```
+{{% /tab %}}
+{{< /tabpane >}}
+
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -107,6 +145,8 @@ will be added, but unlike [adding request headers](#adding-request-headers) whic
 the request already contains it, setting a header will cause the value to be replaced by the value configured in the
 filter.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -137,6 +177,41 @@ spec:
           value: "foo"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: RequestHeaderModifier
+      requestHeaderModifier:
+        set:
+        - name: "set-header"
+          value: "foo"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `headers.example/get` should result in a `200` response from the example Gateway and the output from the
 example app should indicate that the upstream example app received the header `add-header` with the original value
@@ -178,6 +253,8 @@ will be added, but unlike [adding request headers](#adding-request-headers) whic
 the request already contains it, setting a header will cause the value to be replaced by the value configured in the
 filter.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -206,6 +283,39 @@ spec:
         - "remove-header"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: RequestHeaderModifier
+      requestHeaderModifier:
+        remove:
+        - "remove-header"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `headers.example/get` should result in a `200` response from the example Gateway and the output from the
 example app should indicate that the upstream example app received the header `add-header`, but the header
@@ -243,6 +353,8 @@ $ curl -vvv --header "Host: headers.example" "http://${GATEWAY_HOST}/get" --head
 
 Headers can be added/set/removed in a single filter on the same HTTPRoute and they will all perform as expected
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -278,6 +390,46 @@ spec:
         - "removed-header"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: RequestHeaderModifier
+      requestHeaderModifier:
+        add:
+        - name: "add-header-1"
+          value: "foo"
+        set:
+        - name: "set-header-1"
+          value: "bar"
+        remove:
+        - "removed-header"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute/
 [HTTPRoute filters]: https://gateway-api.sigs.k8s.io/reference/spec/#gateway.networking.k8s.io/v1.HTTPRouteFilter

From 2613c33f96263841e65325d7fbb0406ba727ba01 Mon Sep 17 00:00:00 2001
From: Eitan Suez <eitan@tetrate.io>
Date: Fri, 19 Apr 2024 17:02:16 -0500
Subject: [PATCH 2/3] docs: (#3137) retrofit remaining 'kubectl apply' yaml
 snippets using tabs

Signed-off-by: Eitan Suez <eitan@tetrate.io>
---
 .../tasks/extensibility/envoy-patch-policy.md | 111 ++++-
 .../observability/rate-limit-observability.md |  34 ++
 .../tasks/operations/customize-envoyproxy.md  | 381 ++++++++++++++-
 .../tasks/operations/deployment-mode.md       | 258 ++++++++++
 .../en/latest/tasks/security/backend-tls.md   |  55 +++
 .../en/latest/tasks/security/basic-auth.md    |  23 +
 site/content/en/latest/tasks/security/cors.md |  33 ++
 .../en/latest/tasks/security/ext-auth.md      | 134 ++++++
 .../en/latest/tasks/security/mutual-tls.md    |  28 ++
 site/content/en/latest/tasks/security/oidc.md |  55 +++
 .../tasks/security/private-key-provider.md    | 284 +++++++++--
 .../latest/tasks/security/secure-gateways.md  |  55 +++
 .../latest/tasks/traffic/circuit-breaker.md   |  24 +
 .../tasks/traffic/client-traffic-policy.md    |  97 ++++
 .../latest/tasks/traffic/connection-limit.md  |  25 +
 .../latest/tasks/traffic/fault-injection.md   | 125 ++++-
 .../latest/tasks/traffic/global-rate-limit.md | 454 +++++++++++++++++-
 .../en/latest/tasks/traffic/grpc-routing.md   |  72 +++
 .../en/latest/tasks/traffic/http-redirect.md  | 148 +++++-
 .../tasks/traffic/http-request-mirroring.md   | 188 +++++++-
 .../tasks/traffic/http-response-headers.md    | 151 ++++++
 .../en/latest/tasks/traffic/http-routing.md   |  70 +++
 .../en/latest/tasks/traffic/http-timeouts.md  |  70 +++
 .../tasks/traffic/http-traffic-splitting.md   | 199 ++++++++
 .../latest/tasks/traffic/http-urlrewrite.md   |  99 ++++
 site/content/en/latest/tasks/traffic/http3.md |  24 +-
 .../latest/tasks/traffic/local-rate-limit.md  | 120 +++++
 site/content/en/latest/tasks/traffic/retry.md |  34 ++
 .../traffic/routing-outside-kubernetes.md     |  63 ++-
 .../en/latest/tasks/traffic/tcp-routing.md    | 181 ++++++-
 .../en/latest/tasks/traffic/udp-routing.md    |  23 +
 31 files changed, 3569 insertions(+), 49 deletions(-)

diff --git a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
index 83b95065a82..e32c447e750 100644
--- a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
@@ -32,7 +32,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 * The default installation of Envoy Gateway installs a default [EnvoyGateway][] configuration and attaches it
 using a `ConfigMap`. In the next step, we will update this resource to enable EnvoyPatchPolicy.
 
-
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -52,6 +53,30 @@ data:
       enableEnvoyPatchPolicy: true
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    extensionApis:
+      enableEnvoyPatchPolicy: true
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 * After updating the `ConfigMap`, you will need to restart the `envoy-gateway` deployment so the configuration kicks in
 
@@ -68,6 +93,8 @@ the status code is `404`
 
 * Apply the configuration
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -103,10 +130,52 @@ spec:
               inline_string: "could not find what you are looking for"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyPatchPolicy
+metadata:
+  name: custom-response-patch-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  type: JSONPatch
+  jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      # The listener name is of the form <GatewayNamespace>/<GatewayName>/<GatewayListenerName>
+      name: default/eg/http
+      operation:
+        op: add
+        path: "/default_filter_chain/filters/0/typed_config/local_reply_config"
+        value:
+          mappers:
+          - filter:
+              status_code_filter:
+                comparison:
+                  op: EQ
+                  value:
+                    default_value: 404
+                    runtime_key: key_b
+            status_code: 406
+            body:
+              inline_string: "could not find what you are looking for"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 When mergeGateways is enabled, there will be one Envoy deployment for all Gateways in the cluster.
 Then the EnvoyPatchPolicy should target a specific GatewayClass.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -142,6 +211,46 @@ spec:
               inline_string: "could not find what you are looking for"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyPatchPolicy
+metadata:
+  name: custom-response-patch-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: GatewayClass
+    name: eg
+    namespace: default
+  type: JSONPatch
+  jsonPatches:
+    - type: "type.googleapis.com/envoy.config.listener.v3.Listener"
+      # The listener name is of the form <GatewayNamespace>/<GatewayName>/<GatewayListenerName>
+      name: default/eg/http
+      operation:
+        op: add
+        path: "/default_filter_chain/filters/0/typed_config/local_reply_config"
+        value:
+          mappers:
+          - filter:
+              status_code_filter:
+                comparison:
+                  op: EQ
+                  value:
+                    default_value: 404
+                    runtime_key: key_b
+            status_code: 406
+            body:
+              inline_string: "could not find what you are looking for"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 * Edit the HTTPRoute resource from the Quickstart to only match on paths with value `/get`
 
diff --git a/site/content/en/latest/tasks/observability/rate-limit-observability.md b/site/content/en/latest/tasks/observability/rate-limit-observability.md
index 350be4dc4b1..26ffe24a9b1 100644
--- a/site/content/en/latest/tasks/observability/rate-limit-observability.md
+++ b/site/content/en/latest/tasks/observability/rate-limit-observability.md
@@ -35,6 +35,8 @@ You can configure a collector that supports the OTLP protocol, which includes bu
 Assuming the OpenTelemetry Collector is running in the `observability` namespace, and it has a service named `otel-svc`,
 we only want to sample `50%` of the trace data. We would configure it as follows:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -62,6 +64,38 @@ data:
             url: otel-svc.observability.svc.cluster.local:4318
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    rateLimit:
+      backend:
+        type: Redis
+        redis:
+          url: redis-service.default.svc.cluster.local:6379
+      telemetry:
+        tracing:
+          sampleRate: 50
+          provider:
+            url: otel-svc.observability.svc.cluster.local:4318
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After updating the ConfigMap, you will need to restart the envoy-gateway deployment so the configuration kicks in:
 
diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
index 76004a83676..50c2cc26118 100644
--- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
@@ -15,6 +15,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 First, you need to add ParametersRef in GatewayClass, and refer to EnvoyProxy Config:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -30,11 +32,33 @@ spec:
     namespace: envoy-gateway-system
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: custom-proxy-config
+    namespace: envoy-gateway-system
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Customize EnvoyProxy Deployment Replicas
 
 You can customize the EnvoyProxy Deployment Replicas via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -50,6 +74,26 @@ spec:
         replicas: 2
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        replicas: 2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After you apply the config, you should see the replicas of envoyproxy changes to 2.
 And also you can dynamically change the value.
@@ -62,6 +106,8 @@ kubectl get deployment -l gateway.envoyproxy.io/owning-gateway-name=eg -n envoy-
 
 You can customize the EnvoyProxy Image via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -78,6 +124,27 @@ spec:
           image: envoyproxy/envoy:v1.25-latest
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        container:
+          image: envoyproxy/envoy:v1.25-latest
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the config, you can get the deployment image, and see it has changed.
 
@@ -85,6 +152,8 @@ After applying the config, you can get the deployment image, and see it has chan
 
 You can customize the EnvoyProxy Pod Annotations via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -103,6 +172,29 @@ spec:
             custom2: deploy-annotation2
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        pod:
+          annotations:
+            custom1: deploy-annotation1
+            custom2: deploy-annotation2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the config, you can get the envoyproxy pods, and see new annotations has been added.
 
@@ -110,6 +202,8 @@ After applying the config, you can get the envoyproxy pods, and see new annotati
 
 You can customize the EnvoyProxy Deployment Resources via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -132,11 +226,40 @@ spec:
               memory: 1Gi
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        container:
+          resources:
+            requests:
+              cpu: 150m
+              memory: 640Mi
+            limits:
+              cpu: 500m
+              memory: 1Gi
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Customize EnvoyProxy Deployment Env
 
 You can customize the EnvoyProxy Deployment Env via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -157,6 +280,31 @@ spec:
             value: env_b_value
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        container:
+          env:
+          - name: env_a
+            value: env_a_value
+          - name: env_b
+            value: env_b_value
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 > Envoy Gateway has provided two initial `env` `ENVOY_GATEWAY_NAMESPACE` and `ENVOY_POD_NAME` for envoyproxy container.
 
@@ -166,6 +314,8 @@ After applying the config, you can get the envoyproxy deployment, and see resour
 
 You can customize the EnvoyProxy Deployment Volumes or VolumeMounts via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -190,6 +340,35 @@ spec:
               secretName: envoy-cert
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        container:
+          volumeMounts:
+          - mountPath: /certs
+            name: certs
+            readOnly: true
+        pod:
+          volumes:
+          - name: certs
+            secret:
+              secretName: envoy-cert
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the config, you can get the envoyproxy deployment, and see resources has been changed.
 
@@ -197,6 +376,8 @@ After applying the config, you can get the envoyproxy deployment, and see resour
 
 You can customize the EnvoyProxy Service Annotations via EnvoyProxy Config like:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -212,9 +393,30 @@ spec:
         annotations:
           custom1: svc-annotation1
           custom2: svc-annotation2
-
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        annotations:
+          custom1: svc-annotation1
+          custom2: svc-annotation2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the config, you can get the envoyproxy service, and see annotations has been added.
 
@@ -226,6 +428,8 @@ There are two ways to customize it:
 * Replace: the whole bootstrap config will be replaced by the config you provided.
 * Merge: the config you provided will be merged into the default bootstrap config.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -309,6 +513,94 @@ spec:
             name: runtime-0
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  bootstrap:
+    type: Replace
+    value: |
+      admin:
+        access_log:
+        - name: envoy.access_loggers.file
+          typed_config:
+            "@type": type.googleapis.com/envoy.extensions.access_loggers.file.v3.FileAccessLog
+            path: /dev/null
+        address:
+          socket_address:
+            address: 127.0.0.1
+            port_value: 20000
+      dynamic_resources:
+        ads_config:
+          api_type: DELTA_GRPC
+          transport_api_version: V3
+          grpc_services:
+          - envoy_grpc:
+              cluster_name: xds_cluster
+          set_node_on_first_message_only: true
+        lds_config:
+          ads: {}
+          resource_api_version: V3
+        cds_config:
+          ads: {}
+          resource_api_version: V3
+      static_resources:
+        clusters:
+        - connect_timeout: 10s
+          load_assignment:
+            cluster_name: xds_cluster
+            endpoints:
+            - lb_endpoints:
+              - endpoint:
+                  address:
+                    socket_address:
+                      address: envoy-gateway
+                      port_value: 18000
+          typed_extension_protocol_options:
+            "envoy.extensions.upstreams.http.v3.HttpProtocolOptions":
+               "@type": "type.googleapis.com/envoy.extensions.upstreams.http.v3.HttpProtocolOptions"
+               "explicit_http_config":
+                 "http2_protocol_options": {}
+          name: xds_cluster
+          type: STRICT_DNS
+          transport_socket:
+            name: envoy.transport_sockets.tls
+            typed_config:
+              "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
+              common_tls_context:
+                tls_params:
+                  tls_maximum_protocol_version: TLSv1_3
+                tls_certificate_sds_secret_configs:
+                - name: xds_certificate
+                  sds_config:
+                    path_config_source:
+                      path: "/sds/xds-certificate.json"
+                    resource_api_version: V3
+                validation_context_sds_secret_config:
+                  name: xds_trusted_ca
+                  sds_config:
+                    path_config_source:
+                      path: "/sds/xds-trusted-ca.json"
+                    resource_api_version: V3
+      layered_runtime:
+        layers:
+        - name: runtime-0
+          rtds_layer:
+            rtds_config:
+              ads: {}
+              resource_api_version: V3
+            name: runtime-0
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 You can use [egctl translate][]
 to get the default xDS Bootstrap configuration used by Envoy Gateway.
@@ -323,6 +615,8 @@ You can enable [Horizontal Pod Autoscaler](https://github.com/envoyproxy/gateway
 
 Once confirmed, you can apply it via EnvoyProxy Config as shown below:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -346,6 +640,34 @@ spec:
             type: Resource
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyHpa:
+        minReplicas: 2
+        maxReplicas: 10
+        metrics:
+          - resource:
+              name: cpu
+              target:
+                averageUtilization: 60
+                type: Utilization
+            type: Resource
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the config, the EnvoyProxy HPA (Horizontal Pod Autoscaler) is generated. However, upon activating the EnvoyProxy's HPA, the Envoy Gateway will no longer reference the `replicas` field specified in the `envoyDeployment`, as outlined [here](#customize-envoyproxy-deployment-replicas).
 
@@ -354,6 +676,8 @@ After applying the config, the EnvoyProxy HPA (Horizontal Pod Autoscaler) is gen
 You can customize the EnvoyProxy Command line options via `spec.extraArgs` in EnvoyProxy Config.
 For example, the following configuration will add `--disable-extensions` arg in order to disable `envoy.access_loggers/envoy.access_loggers.wasm` extension:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -366,6 +690,23 @@ spec:
     - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  extraArgs:
+    - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Customize EnvoyProxy with Patches
 
@@ -373,6 +714,8 @@ You can customize the EnvoyProxy using patches.
 
 For example, the following configuration will add resource limits to the `envoy` and the `shutdown-manager` containers in the `envoyproxy` deployment:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -404,6 +747,42 @@ spec:
                         memory: 1024Mi
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: eg
+  namespace: envoy-gateway-system
+spec:
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyDeployment:
+        patch:
+          type: StrategicMerge
+          value:
+            spec:
+              template:
+                spec:
+                  containers:
+                  - name: envoy
+                    resources:
+                      limits:
+                        cpu: 500m
+                        memory: 1024Mi
+                  - name: shutdown-manager
+                    resources:
+                      limits:
+                        cpu: 200m
+                        memory: 1024Mi
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 After applying the configuration, you will see the change in both containers in the `envoyproxy` deployment.
 
diff --git a/site/content/en/latest/tasks/operations/deployment-mode.md b/site/content/en/latest/tasks/operations/deployment-mode.md
index dd3ea9ea6f8..300c828120a 100644
--- a/site/content/en/latest/tasks/operations/deployment-mode.md
+++ b/site/content/en/latest/tasks/operations/deployment-mode.md
@@ -57,6 +57,8 @@ eg-marketing oci://docker.io/envoyproxy/gateway-helm \
 
 Lets create a `GatewayClass` linked to the marketing team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -157,6 +159,111 @@ spec:
             value: /
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg-marketing
+spec:
+  controllerName: gateway.envoyproxy.io/marketing-gatewayclass-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+  namespace: marketing
+spec:
+  gatewayClassName: eg-marketing
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 8080
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: marketing
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: marketing
+  labels:
+    app: backend
+    service: backend
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: marketing
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend
+        version: v1
+    spec:
+      serviceAccountName: backend
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+  namespace: marketing
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - "www.marketing.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Lets port forward to the generated envoy proxy service in the `marketing` namespace and send a request to it.
 
@@ -235,6 +342,8 @@ eg-product oci://docker.io/envoyproxy/gateway-helm \
 
 Lets create a `GatewayClass` linked to the product team's Envoy Gateway controller, and as well other resources linked to it, so the `backend` application operated by this team can be exposed to external clients.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -335,6 +444,111 @@ spec:
             value: /
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg-product
+spec:
+  controllerName: gateway.envoyproxy.io/product-gatewayclass-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+  namespace: product
+spec:
+  gatewayClassName: eg-product
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 8080
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend
+  namespace: product
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend
+  namespace: product
+  labels:
+    app: backend
+    service: backend
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: product
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend
+        version: v1
+    spec:
+      serviceAccountName: backend
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+  namespace: product
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - "www.product.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Lets port forward to the generated envoy proxy service in the `product` namespace and send a request to it.
 
@@ -608,6 +822,8 @@ kubectl apply -f https://github.com/envoyproxy/gateway/releases/download/latest/
 
 Lets create also and additional `Gateway` linked to the GatewayClass and `backend` application from Quickstart example.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -645,6 +861,48 @@ spec:
             value: /
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg-2
+  namespace: default
+spec:
+  gatewayClassName: eg
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 8080
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: eg-2
+  namespace: default
+spec:
+  parentRefs:
+    - name: eg-2
+  hostnames:
+    - "www.quickstart.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify that Gateways are deployed and programmed
 
diff --git a/site/content/en/latest/tasks/security/backend-tls.md b/site/content/en/latest/tasks/security/backend-tls.md
index 9eadf4dd9d8..80ed3593305 100644
--- a/site/content/en/latest/tasks/security/backend-tls.md
+++ b/site/content/en/latest/tasks/security/backend-tls.md
@@ -81,6 +81,8 @@ kubectl patch deployment backend --type=json --patch '
 
 Create a service that exposes port 443 on the backend service. 
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -101,9 +103,36 @@ spec:
     targetPort: 8443
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app: backend
+    service: backend
+  name: tls-backend
+  namespace: default
+spec:
+  selector:
+    app: backend
+  ports:
+  - name: https
+    port: 443
+    protocol: TCP
+    targetPort: 8443
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Create a [BackendTLSPolicy][] instructing Envoy Gateway to establish a TLS connection with the backend and validate the backend certificate is issued by a trusted CA and contains an appropriate DNS SAN.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -125,6 +154,32 @@ spec:
     hostname: www.example.com
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: BackendTLSPolicy
+metadata:
+  name: enable-backend-tls
+  namespace: default
+spec:
+  targetRef:
+    group: ''
+    kind: Service
+    name: tls-backend
+    sectionName: "443"
+  tls:
+    caCertRefs:
+    - name: example-ca
+      group: ''
+      kind: ConfigMap
+    hostname: www.example.com
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Patch the HTTPRoute's backend reference, so that it refers to the new TLS-enabled service:
 
diff --git a/site/content/en/latest/tasks/security/basic-auth.md b/site/content/en/latest/tasks/security/basic-auth.md
index 3061ec90918..c9560f56f88 100644
--- a/site/content/en/latest/tasks/security/basic-auth.md
+++ b/site/content/en/latest/tasks/security/basic-auth.md
@@ -100,6 +100,8 @@ kubectl create secret generic basic-auth --from-file=.htpasswd
 The below example defines a SecurityPolicy that authenticates requests against the user list in the kubernetes
 secret generated in the previous step.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -116,6 +118,27 @@ spec:
       name: "basic-auth"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: basic-auth-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  basicAuth:
+    users:
+      name: "basic-auth"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the SecurityPolicy configuration:
 
diff --git a/site/content/en/latest/tasks/security/cors.md b/site/content/en/latest/tasks/security/cors.md
index aa2994200a5..9243d6a5905 100644
--- a/site/content/en/latest/tasks/security/cors.md
+++ b/site/content/en/latest/tasks/security/cors.md
@@ -22,6 +22,8 @@ In addition to that the entire origin (with or without specifying a scheme) can
 
 The below example defines a SecurityPolicy that allows CORS for all HTTP requests originating from `www.foo.com`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -48,6 +50,37 @@ spec:
     - "x-header-4"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: cors-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+  cors:
+    allowOrigins:
+    - "http://*.foo.com"
+    - "http://*.foo.com:80"
+    allowMethods:
+    - GET
+    - POST
+    allowHeaders:
+    - "x-header-1"
+    - "x-header-2"
+    exposeHeaders:
+    - "x-header-3"
+    - "x-header-4"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the SecurityPolicy configuration:
 
diff --git a/site/content/en/latest/tasks/security/ext-auth.md b/site/content/en/latest/tasks/security/ext-auth.md
index 223d3b53c4b..455b986283f 100644
--- a/site/content/en/latest/tasks/security/ext-auth.md
+++ b/site/content/en/latest/tasks/security/ext-auth.md
@@ -34,6 +34,8 @@ kubectl apply -f https://raw.githubusercontent.com/envoyproxy/gateway/latest/exa
 
 Create a new HTTPRoute resource to route traffic on the path `/myapp` to the backend service.  
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -55,6 +57,32 @@ spec:
       port: 3000   
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000   
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the HTTPRoute status:
 
@@ -69,6 +97,8 @@ Create a new SecurityPolicy resource to configure the external authorization. Th
 authorization. The `headersToBackend` field specifies the headers that will be sent to the backend service if the request
 is successfully authorized.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -88,6 +118,30 @@ spec:
       headersToBackend: ["x-current-user"]
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ext-auth-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: myapp
+  extAuth:
+    http:
+      backendRef:
+        name: http-ext-auth
+        port: 9002
+      headersToBackend: ["x-current-user"]
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the SecurityPolicy configuration:
 
@@ -162,6 +216,8 @@ not created the HTTPRoute, you can create it now.
 
 Create a new HTTPRoute resource to route traffic on the path `/myapp` to the backend service.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -183,6 +239,32 @@ spec:
       port: 3000   
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000   
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the HTTPRoute status:
 
@@ -195,6 +277,8 @@ kubectl get httproute/myapp -o yaml
 Update the SecurityPolicy that was created in the previous section to use the gRPC external authorization service.
 It calls the gRPC external authorization service "grpc-ext-auth" on port 9002 for authorization. 
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -213,6 +297,29 @@ spec:
         port: 9002
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ext-auth-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: myapp
+  extAuth:
+    grpc:
+      backendRef:
+        name: grpc-ext-auth
+        port: 9002
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the SecurityPolicy configuration:
 
@@ -223,6 +330,8 @@ kubectl get securitypolicy/ext-auth-example -o yaml
 Because the gRPC external authorization service is enabled with TLS, a BackendTLSConfig needs to be created to configure
 the communication between the Envoy proxy and the gRPC auth service.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -243,6 +352,31 @@ spec:
     hostname: grpc-ext-auth
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: BackendTLSPolicy
+metadata:
+  name: grpc-ext-auth-btls
+spec:
+  targetRef:
+    group: ''
+    kind: Service
+    name: grpc-ext-auth
+    sectionName: "9002"
+  tls:
+    caCertRefs:
+    - name: grpc-ext-auth-ca
+      group: ''
+      kind: ConfigMap
+    hostname: grpc-ext-auth
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the BackendTLSPolicy configuration:
 
diff --git a/site/content/en/latest/tasks/security/mutual-tls.md b/site/content/en/latest/tasks/security/mutual-tls.md
index 1a68174e6fe..769f3bd4535 100644
--- a/site/content/en/latest/tasks/security/mutual-tls.md
+++ b/site/content/en/latest/tasks/security/mutual-tls.md
@@ -78,6 +78,8 @@ kubectl get gateway/eg -o yaml
 
 Create a [ClientTrafficPolicy][] to enforce client validation using the CA Certificate as a trusted anchor.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -99,6 +101,32 @@ spec:
         name: "example-ca-cert"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-mtls
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  tls:
+    clientValidation:
+      caCertificateRefs:
+      - kind: "Secret"
+        group: ""
+        name: "example-ca-cert"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Testing
 
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index 7fce6f9257e..b754d35163d 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -29,6 +29,8 @@ This task demonstrates the configuration of OIDC at the HTTPRoute level.
 
 Let's create an HTTPRoute that represents an application protected by OIDC.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -49,6 +51,31 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: myapp
+spec:
+  parentRefs:
+  - name: eg
+  hostnames: ["www.example.com"]
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /myapp
+    backendRefs:
+    - name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the HTTPRoute status:
 
@@ -93,6 +120,8 @@ by the OAuth2 filter on that HTTPRoute.
 
 Note: please replace the ${CLIENT_ID} in the below yaml snippet with the actual Client ID that you got from the OIDC provider.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -114,6 +143,32 @@ spec:
     logoutPath: "/myapp/logout"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: oidc-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: myapp
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "${CLIENT_ID}"
+    clientSecret:
+      name: "my-app-client-secret"
+    redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
+    logoutPath: "/myapp/logout"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the SecurityPolicy configuration:
 
diff --git a/site/content/en/latest/tasks/security/private-key-provider.md b/site/content/en/latest/tasks/security/private-key-provider.md
index 447e61cb353..18d3afc5fd0 100644
--- a/site/content/en/latest/tasks/security/private-key-provider.md
+++ b/site/content/en/latest/tasks/security/private-key-provider.md
@@ -114,25 +114,49 @@ It required the node with 3rd generation Intel Xeon Scalable processor server pr
 
 * Follow the steps from the [Quickstart](../quickstart) to install Envoy Gateway.
 
-* Lets enable the EnvoyPatchPolicy feature, which will allow us to directly configure the Private Key Provider Envoy Filter, since Envoy Gateway does not directly expose this functionality.
+* Enable the EnvoyPatchPolicy feature, which will allow us to directly configure the Private Key Provider Envoy Filter, since Envoy Gateway does not directly expose this functionality.
 
-  ```shell
-  cat <<EOF | kubectl apply -f -
-  apiVersion: v1
-  kind: ConfigMap
-  metadata:
-    name: envoy-gateway-config
-    namespace: envoy-gateway-system
-  data:
-    envoy-gateway.yaml: |
-      apiVersion: gateway.envoyproxy.io/v1alpha1
-      kind: EnvoyGateway
-      gateway:
-        controllerName: gateway.envoyproxy.io/gatewayclass-controller
-      extensionApis:
-        enableEnvoyPatchPolicy: true
-  EOF
-  ```
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    extensionApis:
+      enableEnvoyPatchPolicy: true
+EOF
+```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    extensionApis:
+      enableEnvoyPatchPolicy: true
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 * After updating the `ConfigMap`, you will need to restart the `envoy-gateway` deployment so the configuration kicks in
 
@@ -146,26 +170,50 @@ It required the node with 3rd generation Intel Xeon Scalable processor server pr
 
 * Update GatewayClass for using the envoyproxy image with contrib extensions and requests required resources.
 
-  ```shell
-  cat <<EOF | kubectl apply -f -
-  apiVersion: gateway.networking.k8s.io/v1
-  kind: GatewayClass
-  metadata:
-    name: eg
-  spec:
-    controllerName: gateway.envoyproxy.io/gatewayclass-controller
-    parametersRef:
-      group: gateway.envoyproxy.io
-      kind: EnvoyProxy
-      name: custom-proxy-config
-      namespace: envoy-gateway-system
-  EOF
-  ```
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: custom-proxy-config
+    namespace: envoy-gateway-system
+EOF
+```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+  parametersRef:
+    group: gateway.envoyproxy.io
+    kind: EnvoyProxy
+    name: custom-proxy-config
+    namespace: envoy-gateway-system
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### Change EnvoyProxy configuration for QAT
 
 Using the envoyproxy image with contrib extensions and add qat resources requesting, ensure the k8s scheduler find out a machine with required resource.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -194,11 +242,46 @@ spec:
               qat.intel.com/cy: '1'
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  concurrency: 1
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        type: NodePort
+      envoyDeployment:
+        container:
+          image: envoyproxy/envoy-contrib-dev:latest
+          resources:
+            requests:
+              cpu: 1000m
+              memory: 4096Mi
+              qat.intel.com/cy: '1'
+            limits:
+              cpu: 1000m
+              memory: 4096Mi
+              qat.intel.com/cy: '1'
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### Change EnvoyProxy configuration for CryptoMB
 
 Using the envoyproxy image with contrib extensions and add the node affinity to scheduling the Envoy Gateway pod on the machine with required CPU instructions.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -241,6 +324,53 @@ spec:
                     operator: Exists
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyProxy
+metadata:
+  name: custom-proxy-config
+  namespace: envoy-gateway-system
+spec:
+  concurrency: 1
+  provider:
+    type: Kubernetes
+    kubernetes:
+      envoyService:
+        type: NodePort
+      envoyDeployment:
+        container:
+          image: envoyproxy/envoy-contrib-dev:latest
+          resources:
+            requests:
+              cpu: 1000m
+              memory: 4096Mi
+            limits:
+              cpu: 1000m
+              memory: 4096Mi
+        pod:
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                - matchExpressions:
+                  - key: feature.node.kubernetes.io/cpu-cpuid.AVX512F
+                    operator: Exists
+                  - key: feature.node.kubernetes.io/cpu-cpuid.AVX512DQ
+                    operator: Exists
+                  - key: feature.node.kubernetes.io/cpu-cpuid.AVX512BW
+                    operator: Exists
+                  - key: feature.node.kubernetes.io/cpu-cpuid.AVX512IFMA
+                    operator: Exists
+                  - key: feature.node.kubernetes.io/cpu-cpuid.AVX512VBMI2
+                    operator: Exists
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Or using `preferredDuringSchedulingIgnoredDuringExecution` for best effort scheduling, or not doing any node affinity, just doing the random scheduling. The CryptoMB private key provider supports software fallback if the required CPU instructions aren't here.
 
@@ -276,6 +406,8 @@ fortio load -c 10 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NO
 
 ### For QAT
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -313,9 +445,53 @@ spec:
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyPatchPolicy
+metadata:
+  name: key-provider-patch-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  type: JSONPatch
+  jsonPatches:
+    - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
+      name: default/example-cert
+      operation:
+        op: add
+        path: "/tls_certificate/private_key_provider"
+        value:
+          provider_name: qat
+          typed_config:
+            "@type": "type.googleapis.com/envoy.extensions.private_key_providers.qat.v3alpha.QatPrivateKeyMethodConfig"
+            private_key:
+              inline_string: |
+                abcd
+            poll_delay: 0.001s
+          fallback: true
+    - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
+      name: default/example-cert
+      operation:
+        op: copy
+        from: "/tls_certificate/private_key"
+        path: "/tls_certificate/private_key_provider/typed_config/private_key"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### For CryptoMB
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -353,6 +529,48 @@ spec:
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: EnvoyPatchPolicy
+metadata:
+  name: key-provider-patch-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  type: JSONPatch
+  jsonPatches:
+    - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
+      name: default/example-cert
+      operation:
+        op: add
+        path: "/tls_certificate/private_key_provider"
+        value:
+          provider_name: cryptomb
+          typed_config:  
+            "@type": "type.googleapis.com/envoy.extensions.private_key_providers.cryptomb.v3alpha.CryptoMbPrivateKeyMethodConfig"
+            private_key:
+              inline_string: |
+                abcd
+            poll_delay: 0.001s
+          fallback: true
+    - type: "type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret"
+      name: default/example-cert
+      operation:
+        op: copy
+        from: "/tls_certificate/private_key"
+        path: "/tls_certificate/private_key_provider/typed_config/private_key"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### Benchmark after enabling private key provider
 
diff --git a/site/content/en/latest/tasks/security/secure-gateways.md b/site/content/en/latest/tasks/security/secure-gateways.md
index e56a496e022..199ac976005 100644
--- a/site/content/en/latest/tasks/security/secure-gateways.md
+++ b/site/content/en/latest/tasks/security/secure-gateways.md
@@ -165,6 +165,8 @@ Before proceeding, ensure you can query the HTTPS backend service from the [Test
 To demonstrate cross namespace certificate references, create a ReferenceGrant that allows Gateways from the "default"
 namespace to reference Secrets in the "envoy-gateway-system" namespace:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1beta1
@@ -182,6 +184,28 @@ spec:
     kind: Secret
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: example
+  namespace: envoy-gateway-system
+spec:
+  from:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    namespace: default
+  to:
+  - group: ""
+    kind: Secret
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Delete the previously created Secret:
 
@@ -204,6 +228,8 @@ kubectl create secret tls example-cert -n envoy-gateway-system --key=www.example
 
 Update the Gateway HTTPS listener with `namespace: envoy-gateway-system`, for example:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -228,6 +254,35 @@ spec:
             namespace: envoy-gateway-system
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+spec:
+  gatewayClassName: eg
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+    - name: https
+      protocol: HTTPS
+      port: 443
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - kind: Secret
+            group: ""
+            name: example-cert
+            namespace: envoy-gateway-system
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The Gateway HTTPS listener status should now surface the `Ready: True` condition and you should once again be able to
 query the HTTPS backend through the Gateway.
diff --git a/site/content/en/latest/tasks/traffic/circuit-breaker.md b/site/content/en/latest/tasks/traffic/circuit-breaker.md
index cf00d926a2c..1d3a2e85bbf 100644
--- a/site/content/en/latest/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/latest/tasks/traffic/circuit-breaker.md
@@ -62,6 +62,8 @@ The default circuit breaker threshold (1024) is not met. As a result, requests d
 
 In order to fail fast, apply a `BackendTrafficPolicy` that limits concurrent requests to 10 and pending requests to 0.  
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -79,6 +81,28 @@ spec:
     maxParallelRequests: 10
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: circuitbreaker-for-route
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+    namespace: default
+  circuitBreaker:
+    maxPendingRequests: 0
+    maxParallelRequests: 10
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Execute the load simulation again.  
 
diff --git a/site/content/en/latest/tasks/traffic/client-traffic-policy.md b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
index 98659941f72..dc461d7c702 100644
--- a/site/content/en/latest/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
@@ -23,6 +23,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 ### Support TCP keepalive for downstream client
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -42,6 +44,30 @@ spec:
     probes: 3
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-tcp-keepalive-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  tcpKeepalive:
+    idleTime: 20m
+    interval: 60s
+    probes: 3
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify that ClientTrafficPolicy is Accepted:
 
@@ -176,6 +202,8 @@ You can see keepalive connection marked by the output in:
 
 This example configures Proxy Protocol for downstream clients.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -192,6 +220,27 @@ spec:
   enableProxyProtocol: true
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-proxy-protocol-policy
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  enableProxyProtocol: true
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify that ClientTrafficPolicy is Accepted:
 
@@ -289,6 +338,8 @@ You should now expect 200 response status and also see that source IP was preser
 
 This example configures the number of additional ingress proxy hops from the right side of XFF HTTP headers to trust when determining the origin client's IP address and determines whether or not `x-forwarded-proto` headers will be trusted. Refer to https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_conn_man/headers#x-forwarded-for for details.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -307,6 +358,29 @@ spec:
       numTrustedHops: 2
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: http-client-ip-detection
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  clientIPDetection:
+    xForwardedFor:
+      numTrustedHops: 2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify that ClientTrafficPolicy is Accepted:
 
@@ -415,6 +489,8 @@ Handling connection for 8888
 This feature allows you to limit the take taken by the Envoy Proxy fleet to receive the entire request from the client, which is useful in preventing certain clients from consuming too much memory in Envoy
 This example configures the HTTP request timeout for the client, please check out the details [here](https://www.envoyproxy.io/docs/envoy/latest/faq/configuration/timeouts#stream-timeouts). 
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -431,6 +507,27 @@ spec:
       requestReceivedTimeout: 2s
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: client-timeout
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  timeout:
+    http:
+      requestReceivedTimeout: 2s
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Curl the example app through Envoy proxy:
 
diff --git a/site/content/en/latest/tasks/traffic/connection-limit.md b/site/content/en/latest/tasks/traffic/connection-limit.md
index 138e620bf9b..20bce016805 100644
--- a/site/content/en/latest/tasks/traffic/connection-limit.md
+++ b/site/content/en/latest/tasks/traffic/connection-limit.md
@@ -57,6 +57,8 @@ There are no connection limits, and so all 100 requests succeed.
 
 Next, we apply a limit of 5 connections. 
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -75,6 +77,29 @@ spec:
       value: 5    
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: connection-limit-ctp
+  namespace: default
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+  connection:
+    connectionLimit:
+      value: 5    
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Execute the load simulation again.
 
diff --git a/site/content/en/latest/tasks/traffic/fault-injection.md b/site/content/en/latest/tasks/traffic/fault-injection.md
index 657b3e1453d..cc8bea6f6fe 100644
--- a/site/content/en/latest/tasks/traffic/fault-injection.md
+++ b/site/content/en/latest/tasks/traffic/fault-injection.md
@@ -26,6 +26,8 @@ Allow requests with a valid faultInjection by creating an [BackendTrafficPolicy]
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -96,11 +98,88 @@ spec:
     - path:
         type: PathPrefix
         value: /bar
-
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: fault-injection-50-percent-abort
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: foo
+  faultInjection:
+    abort:
+      httpStatus: 501
+      percentage: 50
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: fault-injection-delay
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: bar
+  faultInjection:
+    delay:
+      fixedDelay: 2s
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: foo
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /foo
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: bar
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - "www.example.com"
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /bar
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
-Two HTTPRoute has been created, one for `/foo` and another for `/bar`.  `fault-injection-abort` BackendTrafficPolicy has been created and targeted HTTPRoute foo to abort requests for `/foo`. `fault-injection-delay` BackendTrafficPolicy has been created and targeted HTTPRoute foo to delay `2s` requests for `/bar`. 
+
+Two HTTPRoute resources were created, one for `/foo` and another for `/bar`.  `fault-injection-abort` BackendTrafficPolicy has been created and targeted HTTPRoute foo to abort requests for `/foo`. `fault-injection-delay` BackendTrafficPolicy has been created and targeted HTTPRoute foo to delay `2s` requests for `/bar`. 
 
 Verify the HTTPRoute configuration and status:
 
@@ -118,6 +197,8 @@ kubectl get backendtrafficpolicy/fault-injection-delay -o yaml
 
 ### GRPCRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -153,6 +234,46 @@ spec:
       weight: 1
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: fault-injection-abort
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: GRPCRoute
+    name: yages
+  faultInjection:
+    abort:
+      grpcStatus: 14
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+  - name: example-gateway
+  hostnames:
+  - "grpc-example.com"
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: yages
+      port: 9000
+      weight: 1
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 A BackendTrafficPolicy has been created and targeted GRPCRoute yages to abort requests for `yages` service..
 
diff --git a/site/content/en/latest/tasks/traffic/global-rate-limit.md b/site/content/en/latest/tasks/traffic/global-rate-limit.md
index a0734928bd7..97cda03a4a5 100644
--- a/site/content/en/latest/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/global-rate-limit.md
@@ -35,6 +35,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 * The global rate limit feature is based on [Envoy Ratelimit][] which requires a Redis instance as its caching layer.
 Lets install a Redis deployment in the `redis-system` namespce.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 kind: Namespace
@@ -87,10 +89,67 @@ spec:
     targetPort: 6379
   selector:
     app: redis
----
-
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: redis-system 
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: redis-system
+  labels:
+    app: redis
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+      - image: redis:6.0.6
+        imagePullPolicy: IfNotPresent
+        name: redis
+        resources:
+          limits:
+            cpu: 1500m
+            memory: 512Mi
+          requests:
+            cpu: 200m
+            memory: 256Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  namespace: redis-system 
+  labels:
+    app: redis
+  annotations:
+spec:
+  ports:
+  - name: redis
+    port: 6379
+    protocol: TCP
+    targetPort: 6379
+  selector:
+    app: redis
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### Enable Global Rate limit in Envoy Gateway
 
@@ -98,7 +157,8 @@ EOF
 using a `ConfigMap`. In the next step, we will update this resource to enable rate limit in Envoy Gateway
 as well as configure the URL for the Redis instance used for Global rate limiting.
 
-
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -121,6 +181,33 @@ data:
           url: redis.redis-system.svc.cluster.local:6379
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    rateLimit:
+      backend:
+        type: Redis
+        redis:
+          url: redis.redis-system.svc.cluster.local:6379
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 * After updating the `ConfigMap`, you will need to restart the `envoy-gateway` deployment so the configuration kicks in
 
@@ -128,12 +215,13 @@ EOF
 kubectl rollout restart deployment envoy-gateway -n envoy-gateway-system
 ```
 
-
 ## Rate Limit Specific User 
 
 Here is an example of a rate limit implemented by the application developer to limit a specific user by matching on a custom `x-user-id` header
 with a value set to `one`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -159,9 +247,41 @@ spec:
           unit: Hour
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+    namespace: default
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - clientSelectors:
+        - headers:
+          - name: x-user-id
+            value: one
+        limit:
+          requests: 3
+          unit: Hour
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -185,6 +305,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -286,6 +434,8 @@ Here is an example of a rate limit implemented by the application developer to l
 value in the `x-user-id` header. Here, user `one` (recognised from the traffic flow using the header `x-user-id` and value `one`) will be rate limited at 3 requests/hour
 and so will user `two` (recognised from the traffic flow using the header `x-user-id` and value `two`).
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -311,9 +461,41 @@ spec:
           unit: Hour
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+    namespace: default
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - clientSelectors:
+        - headers:
+          - type: Distinct
+            name: x-user-id
+        limit:
+          requests: 3
+          unit: Hour
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -337,6 +519,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Lets run the same command again with the header `x-user-id` and value `one` set in the request. We should the first 3 requests succeeding and
 the 4th request being rate limited.
@@ -421,6 +631,8 @@ transfer-encoding: chunked
 
 This example shows you how to rate limit all requests matching the HTTPRoute rule at 3 requests/Hour by leaving the `clientSelectors` field unset.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -442,9 +654,37 @@ spec:
           unit: Hour
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+    namespace: default
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - limit:
+          requests: 3
+          unit: Hour
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -468,6 +708,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```shell
 for i in {1..4}; do curl -I --header "Host: ratelimit.example" http://${GATEWAY_HOST}/get ; sleep 1; done
@@ -515,6 +783,8 @@ Note: EG supports two kinds of rate limit for the IP address: exact and distinct
 * exact means that all IP addresses within the specified Source IP CIDR share the same rate limit bucket.
 * distinct means that each IP address within the specified Source IP CIDR has its own rate limit bucket.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -560,6 +830,56 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit 
+    namespace: default
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - clientSelectors:
+        - sourceCIDR: 
+            value: 0.0.0.0/0
+            type: distinct
+        limit:
+          requests: 3
+          unit: Hour
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```shell
 for i in {1..4}; do curl -I --header "Host: ratelimit.example" http://${GATEWAY_HOST}/get ; sleep 1; done
@@ -602,6 +922,8 @@ transfer-encoding: chunked
 
 Here is an example of a rate limit implemented by the application developer to limit distinct users who can be differentiated based on the value of the Jwt claims carried.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -665,6 +987,74 @@ spec:
         value: /foo
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: jwt-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: example
+  jwt:
+    providers:
+    - name: example
+      remoteJWKS:
+        uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
+      claimToHeaders:
+      - claim: name
+        header: x-claim-name
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: example 
+  rateLimit:
+    type: Global
+    global:
+      rules:
+      - clientSelectors:
+        - headers:
+          - name: x-claim-name
+            value: John Doe
+        limit:
+          requests: 3
+          unit: Hour
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: example
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /foo
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Get the JWT used for testing request authentication:
 
@@ -767,6 +1157,8 @@ like container `image`, `securityContext`, `env` and pod `annotations` and `secu
 
 * `tls.certificateRef` set the client certificate for redis server TLS connections.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -816,6 +1208,60 @@ data:
               name: ratelimit-cert
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: envoy-gateway-config
+  namespace: envoy-gateway-system
+data:
+  envoy-gateway.yaml: |
+    apiVersion: gateway.envoyproxy.io/v1alpha1
+    kind: EnvoyGateway
+    provider:
+      type: Kubernetes
+      kubernetes:
+        rateLimitDeployment:
+          replicas: 1
+          container:
+            image: envoyproxy/ratelimit:master
+            env:
+            - name: CACHE_KEY_PREFIX
+              value: "eg:rl:"
+            resources:
+              requests:
+                cpu: 100m
+                memory: 512Mi
+            securityContext:
+              runAsUser: 2000
+              allowPrivilegeEscalation: false
+          pod:
+            annotations:
+              key1: val1
+              key2: val2
+            securityContext:
+              runAsUser: 1000
+              runAsGroup: 3000
+              fsGroup: 2000
+              fsGroupChangePolicy: "OnRootMismatch"
+    gateway:
+      controllerName: gateway.envoyproxy.io/gatewayclass-controller
+    rateLimit:
+      backend:
+        type: Redis
+        redis:
+          url: redis.redis-system.svc.cluster.local:6379
+          tls:
+            certificateRef:
+              name: ratelimit-cert
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 * After updating the `ConfigMap`, you will need to restart the `envoy-gateway` deployment so the configuration kicks in
 
diff --git a/site/content/en/latest/tasks/traffic/grpc-routing.md b/site/content/en/latest/tasks/traffic/grpc-routing.md
index 4c27ef993cc..3165405aad5 100644
--- a/site/content/en/latest/tasks/traffic/grpc-routing.md
+++ b/site/content/en/latest/tasks/traffic/grpc-routing.md
@@ -95,6 +95,8 @@ It supports two match types: `Exact` and `RegularExpression`.
 The following example shows how to match a request based on the service and method names for `grpc.reflection.v1alpha.ServerReflection/ServerReflectionInfo`,
 as well as a match for all services with a method name `Ping` which matches `yages.Echo/Ping` in our deployment.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -123,6 +125,39 @@ spec:
           weight: 1
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+    - name: example-gateway
+  hostnames:
+    - "grpc-example.com"
+  rules:
+    - matches:
+      - method:
+          method: ServerReflectionInfo
+          service: grpc.reflection.v1alpha.ServerReflection
+      - method:
+          method: Ping
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: yages
+          port: 9000
+          weight: 1
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the GRPCRoute status:
 
@@ -142,6 +177,8 @@ The following example shows how to match a request based on the service and meth
 with match type `RegularExpression`. It matches all the services and methods with pattern
 `/.*.Echo/Pin.+`, which matches `yages.Echo/Ping` in our deployment.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -172,6 +209,41 @@ spec:
           weight: 1
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+    - name: example-gateway
+  hostnames:
+    - "grpc-example.com"
+  rules:
+    - matches:
+      - method:
+          method: ServerReflectionInfo
+          service: grpc.reflection.v1alpha.ServerReflection
+      - method:
+          method: "Pin.+"
+          service: ".*.Echo"
+          type: RegularExpression
+      backendRefs:
+        - group: ""
+          kind: Service
+          name: yages
+          port: 9000
+          weight: 1
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the GRPCRoute status:
 
diff --git a/site/content/en/latest/tasks/traffic/http-redirect.md b/site/content/en/latest/tasks/traffic/http-redirect.md
index 8639c2c9d7c..a8fc7d2e82c 100644
--- a/site/content/en/latest/tasks/traffic/http-redirect.md
+++ b/site/content/en/latest/tasks/traffic/http-redirect.md
@@ -19,6 +19,8 @@ Redirects return HTTP 3XX responses to a client, instructing it to retrieve a di
 For example, to issue a permanent redirect (301) from HTTP to HTTPS, configure `requestRedirect.statusCode=301` and
 `requestRedirect.scheme="https"`:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -40,6 +42,32 @@ spec:
           port: 443
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-to-https-filter-redirect
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - redirect.example
+  rules:
+    - filters:
+      - type: RequestRedirect
+        requestRedirect:
+          scheme: https
+          statusCode: 301
+          hostname: www.example.com
+          port: 443
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 __Note:__ `301` (default) and `302` are the only supported statusCodes.
 
@@ -104,8 +132,10 @@ kubectl create secret tls example-com --key=tls.key --cert=tls.crt
 
 Define a https listener on the existing gateway
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
-cat <<EOF | kubectl apply -n default -f -
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
 kind: Gateway
 metadata:
@@ -128,6 +158,35 @@ spec:
         name: example-com
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: eg
+spec:
+  gatewayClassName: eg
+  listeners:
+  - name: http
+    port: 80
+    protocol: HTTP
+    # hostname: "*.example.com"
+  - name: https
+    port: 443
+    protocol: HTTPS
+    # hostname: "*.example.com"
+    tls:
+      mode: Terminate
+      certificateRefs:
+      - kind: Secret
+        name: example-com
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Check for any TLS certificate issues on the gateway.
 
@@ -137,9 +196,10 @@ kubectl -n default describe gateway eg
 
 Create two HTTPRoutes and attach them to the HTTP and HTTPS listeners using the [sectionName][] field.
 
-
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
-cat <<EOF | kubectl apply -n default -f -
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -180,6 +240,53 @@ spec:
             value: /
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: tls-redirect
+spec:
+  parentRefs:
+    - name: eg
+      sectionName: http
+  hostnames:
+    # - "*.example.com" # catch all hostnames
+    - "www.example.com"
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  parentRefs:
+    - name: eg
+      sectionName: https
+  hostnames:
+    - "www.example.com"
+  rules:
+    - backendRefs:
+        - group: ""
+          kind: Service
+          name: backend
+          port: 3000
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Curl the example app through http listener:
 
@@ -200,6 +307,8 @@ curl -v -H 'Host:www.example.com' --resolve "www.example.com:443:$GATEWAY_HOST"
 Path redirects use an HTTP Path Modifier to replace either entire paths or path prefixes. For example, the HTTPRoute
 below will issue a 302 redirect to all `path.redirect.example` requests whose path begins with `/get` to `/status/200`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -228,6 +337,39 @@ spec:
         port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-path-redirect
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.redirect.example
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /get
+      filters:
+      - type: RequestRedirect
+        requestRedirect:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /status/200
+          statusCode: 302
+      backendRefs:
+      - name: backend
+        port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
diff --git a/site/content/en/latest/tasks/traffic/http-request-mirroring.md b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
index e5caa3fdc89..ed214ac8fc3 100644
--- a/site/content/en/latest/tasks/traffic/http-request-mirroring.md
+++ b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
@@ -16,8 +16,10 @@ Before proceeding, you should be able to query the example backend using HTTP.
 Next, create a new `Deployment` and `Service` to mirror requests to. The following example will use
 a second instance of the application deployed in the quickstart.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
-kubectl apply -f - <<EOF
+cat <<EOF | kubectl apply -f -
 ---
 apiVersion: v1
 kind: ServiceAccount
@@ -73,12 +75,74 @@ spec:
                   fieldPath: metadata.namespace
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
 
+```yaml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend-2
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-2
+  labels:
+    app: backend-2
+    service: backend-2
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend-2
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend-2
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend-2
+        version: v1
+    spec:
+      serviceAccountName: backend-2
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend-2
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+```
+{{% /tab %}}
+{{< /tabpane >}}
 Then create an `HTTPRoute` that uses a `HTTPRequestMirrorFilter` to send requests to the original
 service from the quickstart, and mirror request to the service that was just deployed.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
-kubectl apply -f - <<EOF
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
@@ -107,6 +171,41 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-mirror
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: RequestMirror
+      requestMirror:
+        backendRef:
+          kind: Service
+          name: backend-2
+          port: 3000
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -142,6 +241,7 @@ $ curl -v --header "Host: backends.example" "http://${GATEWAY_HOST}/get"
 < server: envoy
 <
 ...
+
  "namespace": "default",
  "ingress": "",
  "service": "",
@@ -164,6 +264,8 @@ Echoing back request made to /get to client (10.42.0.10:45096)
 
 When an `HTTPRoute` has multiple `backendRefs` and an `HTTPRequestMirrorFilter`, traffic splitting will still behave the same as it normally would for the main `backendRefs` while the `backendRef` of the `HTTPRequestMirrorFilter` will continue receiving mirrored copies of the incoming requests.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -198,11 +300,52 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-mirror
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: RequestMirror
+      requestMirror:
+        backendRef:
+          kind: Service
+          name: backend-2
+          port: 3000
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+    - group: ""
+      kind: Service
+      name: backend-3
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Multiple HTTPRequestMirrorFilters
 
 Multiple `HTTPRequestMirrorFilters` are not supported on the same `HTTPRoute` `rule`. When attempting to do so, the admission webhook will reject the configuration.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -239,6 +382,47 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-mirror
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: RequestMirror
+      requestMirror:
+        backendRef:
+          kind: Service
+          name: backend-2
+          port: 3000
+    - type: RequestMirror
+      requestMirror:
+        backendRef:
+          kind: Service
+          name: backend-3
+          port: 3000
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```console
 Error from server: error when creating "STDIN": admission webhook "validate.gateway.networking.k8s.io" denied the request: spec.rules[0].filters: Invalid value: "RequestMirror": cannot be used multiple times in the same rule
diff --git a/site/content/en/latest/tasks/traffic/http-response-headers.md b/site/content/en/latest/tasks/traffic/http-response-headers.md
index 8e13f146493..df6f4369fd2 100644
--- a/site/content/en/latest/tasks/traffic/http-response-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-response-headers.md
@@ -22,6 +22,8 @@ does not have the header configured by the filter, then that header will be adde
 already has the header configured by the filter, then the value of the header in the filter will be appended to the
 value of the header in the response.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -52,6 +54,41 @@ spec:
           value: "foo"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: ResponseHeaderModifier
+      responseHeaderModifier:
+        add:
+        - name: "add-header"
+          value: "foo"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -105,6 +142,8 @@ will be added, but unlike [adding response headers](#adding-response-headers) wh
 if the response already contains it, setting a header will cause the value to be replaced by the value configured in the
 filter.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -135,6 +174,41 @@ spec:
           value: "foo"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    filters:
+    - type: ResponseHeaderModifier
+      responseHeaderModifier:
+        set:
+        - name: "set-header"
+          value: "foo"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `headers.example/get` should result in a `200` response from the example Gateway and the output from the
 example app should indicate that the downstream client received the header `set-header` with the original value `value1`
@@ -177,6 +251,8 @@ will be added, but unlike [adding response headers](#adding-response-headers) wh
 if the response already contains it, setting a header will cause the value to be replaced by the value configured in the
 filter.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -205,6 +281,39 @@ spec:
         - "remove-header"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: ResponseHeaderModifier
+      responseHeaderModifier:
+        remove:
+        - "remove-header"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `headers.example/get` should result in a `200` response from the example Gateway and the output from the
 example app should indicate that the header `remove-header` that was sent by curl was removed before the upstream
@@ -242,6 +351,8 @@ $ curl -vvv --header "Host: headers.example" "http://${GATEWAY_HOST}/get" -H 'X-
 
 Headers can be added/set/removed in a single filter on the same HTTPRoute and they will all perform as expected
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -277,6 +388,46 @@ spec:
         - "removed-header"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - headers.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    filters:
+    - type: ResponseHeaderModifier
+      responseHeaderModifier:
+        add:
+        - name: "add-header-1"
+          value: "foo"
+        set:
+        - name: "set-header-1"
+          value: "bar"
+        remove:
+        - "removed-header"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute/
 [Gateway API documentation]: https://gateway-api.sigs.k8s.io/
diff --git a/site/content/en/latest/tasks/traffic/http-routing.md b/site/content/en/latest/tasks/traffic/http-routing.md
index 4f4ed06e588..94a492d51da 100644
--- a/site/content/en/latest/tasks/traffic/http-routing.md
+++ b/site/content/en/latest/tasks/traffic/http-routing.md
@@ -131,6 +131,8 @@ For this feature to work please make sure
 * you have a fallback route rule defined, the backend for this route rule can be invalid.
 * The SecurityPolicy is applied to both the fallback route as well as the route with the claim header matches, to avoid spoofing.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -194,6 +196,74 @@ spec:
             value: /
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: jwt-example
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: jwt-claim-routing
+  jwt:
+    providers:
+      - name: example
+        recomputeRoute: true
+        claimToHeaders:
+          - claim: sub
+            header: x-sub
+          - claim: admin
+            header: x-admin
+          - claim: name
+            header: x-name
+        remoteJWKS:
+          uri: https://raw.githubusercontent.com/envoyproxy/gateway/main/examples/kubernetes/jwt/jwks.json
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: jwt-claim-routing
+spec:
+  parentRefs:
+    - name: eg
+  rules:
+    - backendRefs:
+        - kind: Service
+          name: foo-svc
+          port: 8080
+          weight: 1
+      matches:
+        - headers:
+            - name: x-name
+              value: John Doe
+    - backendRefs:
+        - kind: Service
+          name: bar-svc
+          port: 8080
+          weight: 1
+      matches:
+        - headers:
+            - name: x-name
+              value: Tom
+    # catch all
+    - backendRefs:
+        - kind: Service
+          name: infra-backend-invalid
+          port: 8080
+          weight: 1
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Get the JWT used for testing request authentication:
 
diff --git a/site/content/en/latest/tasks/traffic/http-timeouts.md b/site/content/en/latest/tasks/traffic/http-timeouts.md
index 01e166fe87e..322707d823d 100644
--- a/site/content/en/latest/tasks/traffic/http-timeouts.md
+++ b/site/content/en/latest/tasks/traffic/http-timeouts.md
@@ -22,6 +22,8 @@ backend has the ability to delay responses; we use it as the backend to control
 ### request timeout
 We configure the backend to delay responses by 3 seconds, then we set the request timeout to 4 seconds. Envoy Gateway will successfully respond to the request.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -50,6 +52,39 @@ spec:
       request: "4s"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  hostnames:
+  - timeout.example.com
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    timeouts:
+      request: "4s"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```shell
 curl --header "Host: timeout.example.com" http://${GATEWAY_HOST}/?delay=3s  -I
@@ -65,6 +100,8 @@ content-length: 480
 
 Then we set the request timeout to 2 seconds. In this case, Envoy Gateway will respond with a timeout.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -93,6 +130,39 @@ spec:
       request: "2s"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backend
+spec:
+  hostnames:
+  - timeout.example.com
+  parentRefs:
+  - group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+  rules:
+  - backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 1
+    matches:
+    - path:
+        type: PathPrefix
+        value: /
+    timeouts:
+      request: "2s"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```shell
 curl --header "Host: timeout.example.com" http://${GATEWAY_HOST}/?delay=3s  -v
diff --git a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
index 924d36970e9..e2ec77dd3ab 100644
--- a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
+++ b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
@@ -15,6 +15,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 When a single backendRef is configured in a HTTPRoute, it will receive 100% of the traffic.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -38,6 +40,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -87,6 +117,8 @@ configured.
 
 First, create a second instance of the example app from the quickstart:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 ---
@@ -144,9 +176,72 @@ spec:
                   fieldPath: metadata.namespace
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backend-2
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-2
+  labels:
+    app: backend-2
+    service: backend-2
+spec:
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+  selector:
+    app: backend-2
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend-2
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend-2
+        version: v1
+    spec:
+      serviceAccountName: backend-2
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend-2
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Then create an HTTPRoute that uses both the app from the quickstart and the second instance that was just created
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -174,6 +269,38 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+    - group: ""
+      kind: Service
+      name: backend-2
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `backends.example/get` should result in `200` responses from the example Gateway and the output from the
 example app that indicates which pod handled the request should switch between the first pod and the second one from the
@@ -217,6 +344,8 @@ HTTPRoute. The weight is not a percentage and the sum of all weights does not ne
 The HTTPRoute below will configure the gateway to send 80% of the traffic to the backend service, and 20% to the
 backend-2 service.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -246,6 +375,40 @@ spec:
       weight: 2
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 8
+    - group: ""
+      kind: Service
+      name: backend-2
+      port: 3000
+      weight: 2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ## Invalid backendRefs
 
@@ -263,6 +426,8 @@ Modifying the above example to make the backend-2 backendRef invalid by using a
 will result in 80% of the traffic being sent to the backend service, and 20% of the traffic receiving an HTTP response
 with status code `500`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -292,6 +457,40 @@ spec:
       weight: 2
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-headers
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - backends.example
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+      weight: 8
+    - group: ""
+      kind: Service
+      name: backend-2
+      port: 9000
+      weight: 2
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Querying `backends.example/get` should result in `200` responses 80% of the time, and `500` responses 20% of the time.
 
diff --git a/site/content/en/latest/tasks/traffic/http-urlrewrite.md b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
index 5acca036714..2e6ec3f0612 100644
--- a/site/content/en/latest/tasks/traffic/http-urlrewrite.md
+++ b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
@@ -15,6 +15,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 You can configure to rewrite the prefix in the url like below. In this example, any curls to
 `http://${GATEWAY_HOST}/get/xxx` will be rewritten to `http://${GATEWAY_HOST}/replace/xxx`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -41,6 +43,37 @@ spec:
         port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-url-rewrite
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.rewrite.example
+  rules:
+    - matches:
+      - path:
+          value: "/get"
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplacePrefixMatch
+            replacePrefixMatch: /replace
+      backendRefs:
+      - name: backend
+        port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -114,6 +147,8 @@ You can configure to rewrite the fullpath in the url like below. In this example
 `http://${GATEWAY_HOST}/get/origin/path/xxxx` will be rewritten to
 `http://${GATEWAY_HOST}/force/replace/fullpath`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -141,6 +176,38 @@ spec:
         port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-url-rewrite
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.rewrite.example
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: "/get/origin/path"
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          path:
+            type: ReplaceFullPath
+            replaceFullPath: /force/replace/fullpath
+      backendRefs:
+      - name: backend
+        port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -208,6 +275,8 @@ You can see that the `X-Envoy-Original-Path` is `/get/origin/path/extra`, but th
 You can configure to rewrite the hostname like below. In this example, any requests sent to
 `http://${GATEWAY_HOST}/get` with `--header "Host: path.rewrite.example"` will rewrite host into `envoygateway.io`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -233,6 +302,36 @@ spec:
         port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-filter-url-rewrite
+spec:
+  parentRefs:
+    - name: eg
+  hostnames:
+    - path.rewrite.example
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: "/get"
+      filters:
+      - type: URLRewrite
+        urlRewrite:
+          hostname: "envoygateway.io"
+      backendRefs:
+      - name: backend
+        port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
diff --git a/site/content/en/latest/tasks/traffic/http3.md b/site/content/en/latest/tasks/traffic/http3.md
index 702a3e3716f..a55e6c58e24 100644
--- a/site/content/en/latest/tasks/traffic/http3.md
+++ b/site/content/en/latest/tasks/traffic/http3.md
@@ -59,8 +59,10 @@ kubectl patch gateway eg --type=json --patch '
 
 Apply the following ClientTrafficPolicy to enable HTTP3
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
-kubectl apply -f - <<EOF
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
@@ -74,6 +76,26 @@ spec:
     namespace: default
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: ClientTrafficPolicy
+metadata:
+  name: enable-http3
+spec:
+  http3: {}
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: Gateway
+    name: eg
+    namespace: default
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the Gateway status:
 
diff --git a/site/content/en/latest/tasks/traffic/local-rate-limit.md b/site/content/en/latest/tasks/traffic/local-rate-limit.md
index 067756b3109..afda7d125a6 100644
--- a/site/content/en/latest/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/local-rate-limit.md
@@ -36,6 +36,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 Here is an example of a rate limit implemented by the application developer to limit a specific user by matching on a custom `x-user-id` header
 with a value set to `one`.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -61,9 +63,41 @@ spec:
           unit: Hour
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+    namespace: default
+  rateLimit:
+    type: Local
+    local:
+      rules:
+      - clientSelectors:
+        - headers:
+          - name: x-user-id
+            value: one
+        limit:
+          requests: 3
+          unit: Hour
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -87,6 +121,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 The HTTPRoute status should indicate that it has been accepted and is bound to the example Gateway.
 
@@ -186,6 +248,8 @@ server: envoy
 
 This example shows you how to rate limit all requests matching the HTTPRoute rule at 3 requests/Hour by leaving the `clientSelectors` field unset.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -207,9 +271,37 @@ spec:
           unit: Hour
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy 
+metadata:
+  name: policy-httproute
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: http-ratelimit
+    namespace: default
+  rateLimit:
+    type: Local
+    local:
+      rules:
+      - limit:
+          requests: 3
+          unit: Hour
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ### HTTPRoute
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -233,6 +325,34 @@ spec:
       port: 3000
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-ratelimit
+spec:
+  parentRefs:
+  - name: eg
+  hostnames:
+  - ratelimit.example 
+  rules:
+  - matches:
+    - path:
+        type: PathPrefix
+        value: /
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: backend
+      port: 3000
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 ```shell
 for i in {1..4}; do curl -I --header "Host: ratelimit.example" http://${GATEWAY_HOST}/get ; sleep 1; done
diff --git a/site/content/en/latest/tasks/traffic/retry.md b/site/content/en/latest/tasks/traffic/retry.md
index cde27f5c2bf..d5ab467a38b 100644
--- a/site/content/en/latest/tasks/traffic/retry.md
+++ b/site/content/en/latest/tasks/traffic/retry.md
@@ -46,6 +46,8 @@ Let's create a `BackendTrafficPolicy` with a retry setting.
 
 The request will be retried 5 times with a 100ms base interval and a 10s maximum interval.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -73,6 +75,38 @@ spec:
         - retriable-status-codes
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: BackendTrafficPolicy
+metadata:
+  name: retry-for-route
+spec:
+  targetRef:
+    group: gateway.networking.k8s.io
+    kind: HTTPRoute
+    name: backend
+    namespace: default
+  retry:
+    numRetries: 5
+    perRetry:
+      backOff:
+        baseInterval: 100ms
+        maxInterval: 10s
+      timeout: 250ms
+    retryOn:
+      httpStatusCodes:
+        - 500
+      triggers:
+        - connect-failure
+        - retriable-status-codes
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Execute the test again.
 
diff --git a/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md b/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
index e43052073cb..e2acfbfc393 100644
--- a/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
+++ b/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
@@ -14,6 +14,8 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 Define a Service and EndpointSlice that represents https://httpbin.org
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -45,6 +47,42 @@ endpoints:
   - "httpbin.org"
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: httpbin
+  namespace: default
+spec:
+  ports:
+    - port: 443
+      protocol: TCP
+      targetPort: 443
+      name: https
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: httpbin
+  namespace: default
+  labels:
+    kubernetes.io/service-name: httpbin 
+addressType: FQDN
+ports:
+- name: https
+  protocol: TCP
+  port: 443
+endpoints:
+- addresses:
+  - "httpbin.org"
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Update the [Gateway][] to include a TLS Listener on port 443
 
@@ -63,6 +101,8 @@ kubectl patch gateway eg --type=json --patch '
 
 Add a [TLSRoute][] that can route incoming traffic to the above backend that we created
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -78,7 +118,28 @@ spec:
     - name: httpbin
       port: 443
 EOF
-```    
+```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TLSRoute
+metadata:
+  name: httpbin 
+spec:
+  parentRefs:
+  - name: eg 
+    sectionName: tls
+  rules:
+  - backendRefs:
+    - name: httpbin
+      port: 443
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Get the Gateway address:
 
diff --git a/site/content/en/latest/tasks/traffic/tcp-routing.md b/site/content/en/latest/tasks/traffic/tcp-routing.md
index 4eea863f5f8..878ed917e50 100644
--- a/site/content/en/latest/tasks/traffic/tcp-routing.md
+++ b/site/content/en/latest/tasks/traffic/tcp-routing.md
@@ -23,6 +23,8 @@ TCPRoutes, note that the protocol set for the listeners on the Gateway is TCP:
 
 Install the GatewayClass and a `tcp-gateway` Gateway first.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 kind: GatewayClass
@@ -53,9 +55,46 @@ spec:
       - kind: TCPRoute
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
 
-Install two services `foo` and `bar`, which are binded to `backend-1` and `backend-2`.
+```yaml
+---
+kind: GatewayClass
+apiVersion: gateway.networking.k8s.io/v1
+metadata:
+  name: eg
+spec:
+  controllerName: gateway.envoyproxy.io/gatewayclass-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: tcp-gateway
+spec:
+  gatewayClassName: eg
+  listeners:
+  - name: foo
+    protocol: TCP
+    port: 8088
+    allowedRoutes:
+      kinds:
+      - kind: TCPRoute
+  - name: bar
+    protocol: TCP
+    port: 8089
+    allowedRoutes:
+      kinds:
+      - kind: TCPRoute
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
+Install two services `foo` and `bar`, which are bound to `backend-1` and `backend-2`.
+
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -155,9 +194,115 @@ spec:
               value: bar
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: foo
+  labels:
+    app: backend-1
+spec:
+  ports:
+    - name: http
+      port: 3001
+      targetPort: 3000
+  selector:
+    app: backend-1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bar
+  labels:
+    app: backend-2
+spec:
+  ports:
+    - name: http
+      port: 3002
+      targetPort: 3000
+  selector:
+    app: backend-2
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend-1
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend-1
+        version: v1
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend-1
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: SERVICE_NAME
+              value: foo
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend-2
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: backend-2
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: backend-2
+        version: v1
+    spec:
+      containers:
+        - image: gcr.io/k8s-staging-gateway-api/echo-basic:v20231214-v1.0.0-140-gf544a46e
+          imagePullPolicy: IfNotPresent
+          name: backend-2
+          ports:
+            - containerPort: 3000
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: SERVICE_NAME
+              value: bar
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Install two TCPRoutes `tcp-app-1` and `tcp-app-2` with different `sectionName`:
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -187,6 +332,40 @@ spec:
       port: 3002
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resources to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: tcp-app-1
+spec:
+  parentRefs:
+  - name: tcp-gateway
+    sectionName: foo
+  rules:
+  - backendRefs:
+    - name: foo
+      port: 3001
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: tcp-app-2
+spec:
+  parentRefs:
+  - name: tcp-gateway
+    sectionName: bar
+  rules:
+  - backendRefs:
+    - name: bar
+      port: 3002
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 In the above example we separate the traffic for the two separate backend TCP Services by using the sectionName field in
 the parentRefs:
diff --git a/site/content/en/latest/tasks/traffic/udp-routing.md b/site/content/en/latest/tasks/traffic/udp-routing.md
index 497d0781b98..d20287476b9 100644
--- a/site/content/en/latest/tasks/traffic/udp-routing.md
+++ b/site/content/en/latest/tasks/traffic/udp-routing.md
@@ -56,6 +56,8 @@ kubectl get gateway/eg -o yaml
 
 Create a UDPRoute resource to route UDP traffic received on Gateway port 5300 to the CoredDNS backend.
 
+{{< tabpane text=true >}}
+{{% tab header="Apply from stdin" %}}
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -72,6 +74,27 @@ spec:
           port: 53
 EOF
 ```
+{{% /tab %}}
+{{% tab header="Apply from file" %}}
+Save and apply the following resource to your cluster:
+
+```yaml
+---
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: UDPRoute
+metadata:
+  name: coredns
+spec:
+  parentRefs:
+    - name: eg
+      sectionName: coredns
+  rules:
+    - backendRefs:
+        - name: coredns
+          port: 53
+```
+{{% /tab %}}
+{{< /tabpane >}}
 
 Verify the UDPRoute status:
 

From c73859a4212eb4a860f2efed81627f7a788b4a77 Mon Sep 17 00:00:00 2001
From: Eitan Suez <eitan@tetrate.io>
Date: Fri, 19 Apr 2024 17:47:24 -0500
Subject: [PATCH 3/3] docs: (#3137) surrounds shell blocks with blank lines for
 linting

Signed-off-by: Eitan Suez <eitan@tetrate.io>
---
 .../tasks/extensibility/envoy-patch-policy.md |  9 +++++
 .../observability/rate-limit-observability.md |  3 ++
 .../tasks/operations/customize-envoyproxy.md  | 36 +++++++++++++++++++
 .../tasks/operations/deployment-mode.md       |  9 +++++
 .../en/latest/tasks/security/backend-tls.md   |  6 ++++
 .../en/latest/tasks/security/basic-auth.md    |  3 ++
 site/content/en/latest/tasks/security/cors.md |  3 ++
 .../en/latest/tasks/security/ext-auth.md      | 15 ++++++++
 .../en/latest/tasks/security/mutual-tls.md    |  3 ++
 site/content/en/latest/tasks/security/oidc.md |  6 ++++
 .../tasks/security/private-key-provider.md    | 18 ++++++++++
 .../latest/tasks/security/secure-gateways.md  |  6 ++++
 .../latest/tasks/traffic/circuit-breaker.md   |  3 ++
 .../tasks/traffic/client-traffic-policy.md    | 12 +++++++
 .../latest/tasks/traffic/connection-limit.md  |  3 ++
 .../latest/tasks/traffic/fault-injection.md   |  6 ++++
 .../latest/tasks/traffic/global-rate-limit.md | 33 +++++++++++++++++
 .../en/latest/tasks/traffic/grpc-routing.md   |  6 ++++
 .../en/latest/tasks/traffic/http-redirect.md  | 12 +++++++
 .../tasks/traffic/http-request-headers.md     | 12 +++++++
 .../tasks/traffic/http-request-mirroring.md   | 12 +++++++
 .../tasks/traffic/http-response-headers.md    | 12 +++++++
 .../en/latest/tasks/traffic/http-routing.md   |  3 ++
 .../en/latest/tasks/traffic/http-timeouts.md  |  6 ++++
 .../tasks/traffic/http-traffic-splitting.md   | 15 ++++++++
 .../latest/tasks/traffic/http-urlrewrite.md   |  9 +++++
 site/content/en/latest/tasks/traffic/http3.md |  3 ++
 .../latest/tasks/traffic/local-rate-limit.md  | 12 +++++++
 site/content/en/latest/tasks/traffic/retry.md |  3 ++
 .../traffic/routing-outside-kubernetes.md     |  6 ++++
 .../en/latest/tasks/traffic/tcp-routing.md    |  9 +++++
 .../en/latest/tasks/traffic/udp-routing.md    |  3 ++
 32 files changed, 297 insertions(+)

diff --git a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
index e32c447e750..ff819754d1f 100644
--- a/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
+++ b/site/content/en/latest/tasks/extensibility/envoy-patch-policy.md
@@ -34,6 +34,7 @@ using a `ConfigMap`. In the next step, we will update this resource to enable En
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -53,6 +54,7 @@ data:
       enableEnvoyPatchPolicy: true
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -75,6 +77,7 @@ data:
     extensionApis:
       enableEnvoyPatchPolicy: true
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -95,6 +98,7 @@ the status code is `404`
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -130,6 +134,7 @@ spec:
               inline_string: "could not find what you are looking for"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -168,6 +173,7 @@ spec:
             body:
               inline_string: "could not find what you are looking for"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -176,6 +182,7 @@ Then the EnvoyPatchPolicy should target a specific GatewayClass.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -211,6 +218,7 @@ spec:
               inline_string: "could not find what you are looking for"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -249,6 +257,7 @@ spec:
             body:
               inline_string: "could not find what you are looking for"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/observability/rate-limit-observability.md b/site/content/en/latest/tasks/observability/rate-limit-observability.md
index 26ffe24a9b1..478b85859b9 100644
--- a/site/content/en/latest/tasks/observability/rate-limit-observability.md
+++ b/site/content/en/latest/tasks/observability/rate-limit-observability.md
@@ -37,6 +37,7 @@ we only want to sample `50%` of the trace data. We would configure it as follows
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -64,6 +65,7 @@ data:
             url: otel-svc.observability.svc.cluster.local:4318
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -94,6 +96,7 @@ data:
           provider:
             url: otel-svc.observability.svc.cluster.local:4318
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/operations/customize-envoyproxy.md b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
index 50c2cc26118..152f9e7ff44 100644
--- a/site/content/en/latest/tasks/operations/customize-envoyproxy.md
+++ b/site/content/en/latest/tasks/operations/customize-envoyproxy.md
@@ -17,6 +17,7 @@ First, you need to add ParametersRef in GatewayClass, and refer to EnvoyProxy Co
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -32,6 +33,7 @@ spec:
     namespace: envoy-gateway-system
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -50,6 +52,7 @@ spec:
     name: custom-proxy-config
     namespace: envoy-gateway-system
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -59,6 +62,7 @@ You can customize the EnvoyProxy Deployment Replicas via EnvoyProxy Config like:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -74,6 +78,7 @@ spec:
         replicas: 2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -92,6 +97,7 @@ spec:
       envoyDeployment:
         replicas: 2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -108,6 +114,7 @@ You can customize the EnvoyProxy Image via EnvoyProxy Config like:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -124,6 +131,7 @@ spec:
           image: envoyproxy/envoy:v1.25-latest
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -143,6 +151,7 @@ spec:
         container:
           image: envoyproxy/envoy:v1.25-latest
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -154,6 +163,7 @@ You can customize the EnvoyProxy Pod Annotations via EnvoyProxy Config like:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -172,6 +182,7 @@ spec:
             custom2: deploy-annotation2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -193,6 +204,7 @@ spec:
             custom1: deploy-annotation1
             custom2: deploy-annotation2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -204,6 +216,7 @@ You can customize the EnvoyProxy Deployment Resources via EnvoyProxy Config like
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -226,6 +239,7 @@ spec:
               memory: 1Gi
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -251,6 +265,7 @@ spec:
               cpu: 500m
               memory: 1Gi
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -260,6 +275,7 @@ You can customize the EnvoyProxy Deployment Env via EnvoyProxy Config like:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -280,6 +296,7 @@ spec:
             value: env_b_value
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -303,6 +320,7 @@ spec:
           - name: env_b
             value: env_b_value
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -316,6 +334,7 @@ You can customize the EnvoyProxy Deployment Volumes or VolumeMounts via EnvoyPro
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -340,6 +359,7 @@ spec:
               secretName: envoy-cert
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -367,6 +387,7 @@ spec:
             secret:
               secretName: envoy-cert
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -378,6 +399,7 @@ You can customize the EnvoyProxy Service Annotations via EnvoyProxy Config like:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -395,6 +417,7 @@ spec:
           custom2: svc-annotation2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -415,6 +438,7 @@ spec:
           custom1: svc-annotation1
           custom2: svc-annotation2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -430,6 +454,7 @@ There are two ways to customize it:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -513,6 +538,7 @@ spec:
             name: runtime-0
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -599,6 +625,7 @@ spec:
               resource_api_version: V3
             name: runtime-0
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -617,6 +644,7 @@ Once confirmed, you can apply it via EnvoyProxy Config as shown below:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -640,6 +668,7 @@ spec:
             type: Resource
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -666,6 +695,7 @@ spec:
                 type: Utilization
             type: Resource
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -678,6 +708,7 @@ For example, the following configuration will add `--disable-extensions` arg in
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -690,6 +721,7 @@ spec:
     - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -705,6 +737,7 @@ spec:
   extraArgs:
     - --disable-extensions envoy.access_loggers/envoy.access_loggers.wasm 
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -716,6 +749,7 @@ For example, the following configuration will add resource limits to the `envoy`
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -747,6 +781,7 @@ spec:
                         memory: 1024Mi
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -781,6 +816,7 @@ spec:
                         cpu: 200m
                         memory: 1024Mi
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/operations/deployment-mode.md b/site/content/en/latest/tasks/operations/deployment-mode.md
index 300c828120a..16b339fe571 100644
--- a/site/content/en/latest/tasks/operations/deployment-mode.md
+++ b/site/content/en/latest/tasks/operations/deployment-mode.md
@@ -59,6 +59,7 @@ Lets create a `GatewayClass` linked to the marketing team's Envoy Gateway contro
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -159,6 +160,7 @@ spec:
             value: /
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -262,6 +264,7 @@ spec:
             type: PathPrefix
             value: /
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -344,6 +347,7 @@ Lets create a `GatewayClass` linked to the product team's Envoy Gateway controll
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -444,6 +448,7 @@ spec:
             value: /
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -547,6 +552,7 @@ spec:
             type: PathPrefix
             value: /
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -824,6 +830,7 @@ Lets create also and additional `Gateway` linked to the GatewayClass and `backen
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -861,6 +868,7 @@ spec:
             value: /
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -901,6 +909,7 @@ spec:
             type: PathPrefix
             value: /
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/backend-tls.md b/site/content/en/latest/tasks/security/backend-tls.md
index 80ed3593305..706d25ae60d 100644
--- a/site/content/en/latest/tasks/security/backend-tls.md
+++ b/site/content/en/latest/tasks/security/backend-tls.md
@@ -83,6 +83,7 @@ Create a service that exposes port 443 on the backend service.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -103,6 +104,7 @@ spec:
     targetPort: 8443
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -126,6 +128,7 @@ spec:
     protocol: TCP
     targetPort: 8443
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -133,6 +136,7 @@ Create a [BackendTLSPolicy][] instructing Envoy Gateway to establish a TLS conne
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -154,6 +158,7 @@ spec:
     hostname: www.example.com
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -178,6 +183,7 @@ spec:
       kind: ConfigMap
     hostname: www.example.com
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/basic-auth.md b/site/content/en/latest/tasks/security/basic-auth.md
index c9560f56f88..04559a8d2bc 100644
--- a/site/content/en/latest/tasks/security/basic-auth.md
+++ b/site/content/en/latest/tasks/security/basic-auth.md
@@ -102,6 +102,7 @@ secret generated in the previous step.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -118,6 +119,7 @@ spec:
       name: "basic-auth"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -137,6 +139,7 @@ spec:
     users:
       name: "basic-auth"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/cors.md b/site/content/en/latest/tasks/security/cors.md
index 9243d6a5905..cfbe979cd22 100644
--- a/site/content/en/latest/tasks/security/cors.md
+++ b/site/content/en/latest/tasks/security/cors.md
@@ -24,6 +24,7 @@ The below example defines a SecurityPolicy that allows CORS for all HTTP request
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -50,6 +51,7 @@ spec:
     - "x-header-4"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -79,6 +81,7 @@ spec:
     - "x-header-3"
     - "x-header-4"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/ext-auth.md b/site/content/en/latest/tasks/security/ext-auth.md
index 455b986283f..1676b60ded1 100644
--- a/site/content/en/latest/tasks/security/ext-auth.md
+++ b/site/content/en/latest/tasks/security/ext-auth.md
@@ -36,6 +36,7 @@ Create a new HTTPRoute resource to route traffic on the path `/myapp` to the bac
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -57,6 +58,7 @@ spec:
       port: 3000   
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -81,6 +83,7 @@ spec:
     - name: backend
       port: 3000   
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -99,6 +102,7 @@ is successfully authorized.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -118,6 +122,7 @@ spec:
       headersToBackend: ["x-current-user"]
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -140,6 +145,7 @@ spec:
         port: 9002
       headersToBackend: ["x-current-user"]
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -218,6 +224,7 @@ Create a new HTTPRoute resource to route traffic on the path `/myapp` to the bac
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -239,6 +246,7 @@ spec:
       port: 3000   
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -263,6 +271,7 @@ spec:
     - name: backend
       port: 3000   
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -279,6 +288,7 @@ It calls the gRPC external authorization service "grpc-ext-auth" on port 9002 fo
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -297,6 +307,7 @@ spec:
         port: 9002
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -318,6 +329,7 @@ spec:
         name: grpc-ext-auth
         port: 9002
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -332,6 +344,7 @@ the communication between the Envoy proxy and the gRPC auth service.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -352,6 +365,7 @@ spec:
     hostname: grpc-ext-auth
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -375,6 +389,7 @@ spec:
       kind: ConfigMap
     hostname: grpc-ext-auth
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/mutual-tls.md b/site/content/en/latest/tasks/security/mutual-tls.md
index 769f3bd4535..a848d8334cf 100644
--- a/site/content/en/latest/tasks/security/mutual-tls.md
+++ b/site/content/en/latest/tasks/security/mutual-tls.md
@@ -80,6 +80,7 @@ Create a [ClientTrafficPolicy][] to enforce client validation using the CA Certi
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -101,6 +102,7 @@ spec:
         name: "example-ca-cert"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -125,6 +127,7 @@ spec:
         group: ""
         name: "example-ca-cert"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/oidc.md b/site/content/en/latest/tasks/security/oidc.md
index b754d35163d..0360ccd496f 100644
--- a/site/content/en/latest/tasks/security/oidc.md
+++ b/site/content/en/latest/tasks/security/oidc.md
@@ -31,6 +31,7 @@ Let's create an HTTPRoute that represents an application protected by OIDC.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -51,6 +52,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -74,6 +76,7 @@ spec:
     - name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -122,6 +125,7 @@ Note: please replace the ${CLIENT_ID} in the below yaml snippet with the actual
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -143,6 +147,7 @@ spec:
     logoutPath: "/myapp/logout"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -167,6 +172,7 @@ spec:
     redirectURL: "http://www.example.com:8080/myapp/oauth2/callback"
     logoutPath: "/myapp/logout"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/private-key-provider.md b/site/content/en/latest/tasks/security/private-key-provider.md
index 18d3afc5fd0..cf40a96e9e1 100644
--- a/site/content/en/latest/tasks/security/private-key-provider.md
+++ b/site/content/en/latest/tasks/security/private-key-provider.md
@@ -118,6 +118,7 @@ It required the node with 3rd generation Intel Xeon Scalable processor server pr
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -135,6 +136,7 @@ data:
       enableEnvoyPatchPolicy: true
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -155,6 +157,7 @@ data:
     extensionApis:
       enableEnvoyPatchPolicy: true
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -172,6 +175,7 @@ data:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -187,6 +191,7 @@ spec:
     namespace: envoy-gateway-system
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -205,6 +210,7 @@ spec:
     name: custom-proxy-config
     namespace: envoy-gateway-system
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -214,6 +220,7 @@ Using the envoyproxy image with contrib extensions and add qat resources request
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -242,6 +249,7 @@ spec:
               qat.intel.com/cy: '1'
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -273,6 +281,7 @@ spec:
               memory: 4096Mi
               qat.intel.com/cy: '1'
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -282,6 +291,7 @@ Using the envoyproxy image with contrib extensions and add the node affinity to
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -324,6 +334,7 @@ spec:
                     operator: Exists
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -369,6 +380,7 @@ spec:
                   - key: feature.node.kubernetes.io/cpu-cpuid.AVX512VBMI2
                     operator: Exists
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -408,6 +420,7 @@ fortio load -c 10 -k -qps 0 -t 30s -keepalive=false https://www.example.com:${NO
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -445,6 +458,7 @@ spec:
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -485,6 +499,7 @@ spec:
         from: "/tls_certificate/private_key"
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -492,6 +507,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -529,6 +545,7 @@ spec:
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -569,6 +586,7 @@ spec:
         from: "/tls_certificate/private_key"
         path: "/tls_certificate/private_key_provider/typed_config/private_key"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/security/secure-gateways.md b/site/content/en/latest/tasks/security/secure-gateways.md
index 199ac976005..e57b1236389 100644
--- a/site/content/en/latest/tasks/security/secure-gateways.md
+++ b/site/content/en/latest/tasks/security/secure-gateways.md
@@ -167,6 +167,7 @@ namespace to reference Secrets in the "envoy-gateway-system" namespace:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1beta1
@@ -184,6 +185,7 @@ spec:
     kind: Secret
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -204,6 +206,7 @@ spec:
   - group: ""
     kind: Secret
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -230,6 +233,7 @@ Update the Gateway HTTPS listener with `namespace: envoy-gateway-system`, for ex
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -254,6 +258,7 @@ spec:
             namespace: envoy-gateway-system
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -281,6 +286,7 @@ spec:
             name: example-cert
             namespace: envoy-gateway-system
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/circuit-breaker.md b/site/content/en/latest/tasks/traffic/circuit-breaker.md
index 1d3a2e85bbf..9480a86a2cd 100644
--- a/site/content/en/latest/tasks/traffic/circuit-breaker.md
+++ b/site/content/en/latest/tasks/traffic/circuit-breaker.md
@@ -64,6 +64,7 @@ In order to fail fast, apply a `BackendTrafficPolicy` that limits concurrent req
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -81,6 +82,7 @@ spec:
     maxParallelRequests: 10
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -101,6 +103,7 @@ spec:
     maxPendingRequests: 0
     maxParallelRequests: 10
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/client-traffic-policy.md b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
index dc461d7c702..7132453da38 100644
--- a/site/content/en/latest/tasks/traffic/client-traffic-policy.md
+++ b/site/content/en/latest/tasks/traffic/client-traffic-policy.md
@@ -25,6 +25,7 @@ Before proceeding, you should be able to query the example backend using HTTP.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -44,6 +45,7 @@ spec:
     probes: 3
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -66,6 +68,7 @@ spec:
     interval: 60s
     probes: 3
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -204,6 +207,7 @@ This example configures Proxy Protocol for downstream clients.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -220,6 +224,7 @@ spec:
   enableProxyProtocol: true
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -239,6 +244,7 @@ spec:
     namespace: default
   enableProxyProtocol: true
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -340,6 +346,7 @@ This example configures the number of additional ingress proxy hops from the rig
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -358,6 +365,7 @@ spec:
       numTrustedHops: 2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -379,6 +387,7 @@ spec:
     xForwardedFor:
       numTrustedHops: 2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -491,6 +500,7 @@ This example configures the HTTP request timeout for the client, please check ou
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -507,6 +517,7 @@ spec:
       requestReceivedTimeout: 2s
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -526,6 +537,7 @@ spec:
     http:
       requestReceivedTimeout: 2s
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/connection-limit.md b/site/content/en/latest/tasks/traffic/connection-limit.md
index 20bce016805..aac8437dc45 100644
--- a/site/content/en/latest/tasks/traffic/connection-limit.md
+++ b/site/content/en/latest/tasks/traffic/connection-limit.md
@@ -59,6 +59,7 @@ Next, we apply a limit of 5 connections.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -77,6 +78,7 @@ spec:
       value: 5    
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -98,6 +100,7 @@ spec:
     connectionLimit:
       value: 5    
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/fault-injection.md b/site/content/en/latest/tasks/traffic/fault-injection.md
index cc8bea6f6fe..d4f536dbb33 100644
--- a/site/content/en/latest/tasks/traffic/fault-injection.md
+++ b/site/content/en/latest/tasks/traffic/fault-injection.md
@@ -28,6 +28,7 @@ Allow requests with a valid faultInjection by creating an [BackendTrafficPolicy]
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -100,6 +101,7 @@ spec:
         value: /bar
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -175,6 +177,7 @@ spec:
         type: PathPrefix
         value: /bar
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -199,6 +202,7 @@ kubectl get backendtrafficpolicy/fault-injection-delay -o yaml
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -234,6 +238,7 @@ spec:
       weight: 1
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -272,6 +277,7 @@ spec:
       port: 9000
       weight: 1
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/global-rate-limit.md b/site/content/en/latest/tasks/traffic/global-rate-limit.md
index 97cda03a4a5..dfd1e5cf2a3 100644
--- a/site/content/en/latest/tasks/traffic/global-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/global-rate-limit.md
@@ -37,6 +37,7 @@ Lets install a Redis deployment in the `redis-system` namespce.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 kind: Namespace
@@ -91,6 +92,7 @@ spec:
     app: redis
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -148,6 +150,7 @@ spec:
   selector:
     app: redis
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -159,6 +162,7 @@ as well as configure the URL for the Redis instance used for Global rate limitin
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -181,6 +185,7 @@ data:
           url: redis.redis-system.svc.cluster.local:6379
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -206,6 +211,7 @@ data:
         redis:
           url: redis.redis-system.svc.cluster.local:6379
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -222,6 +228,7 @@ with a value set to `one`.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -247,6 +254,7 @@ spec:
           unit: Hour
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -275,6 +283,7 @@ spec:
           requests: 3
           unit: Hour
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -282,6 +291,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -305,6 +315,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -331,6 +342,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -436,6 +448,7 @@ and so will user `two` (recognised from the traffic flow using the header `x-use
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -461,6 +474,7 @@ spec:
           unit: Hour
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -489,6 +503,7 @@ spec:
           requests: 3
           unit: Hour
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -496,6 +511,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -519,6 +535,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -545,6 +562,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -633,6 +651,7 @@ This example shows you how to rate limit all requests matching the HTTPRoute rul
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -654,6 +673,7 @@ spec:
           unit: Hour
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -678,6 +698,7 @@ spec:
           requests: 3
           unit: Hour
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -685,6 +706,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -708,6 +730,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -734,6 +757,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -785,6 +809,7 @@ Note: EG supports two kinds of rate limit for the IP address: exact and distinct
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -830,6 +855,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -878,6 +904,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -924,6 +951,7 @@ Here is an example of a rate limit implemented by the application developer to l
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -987,6 +1015,7 @@ spec:
         value: /foo
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -1053,6 +1082,7 @@ spec:
         type: PathPrefix
         value: /foo
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -1159,6 +1189,7 @@ like container `image`, `securityContext`, `env` and pod `annotations` and `secu
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -1208,6 +1239,7 @@ data:
               name: ratelimit-cert
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -1260,6 +1292,7 @@ data:
             certificateRef:
               name: ratelimit-cert
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/grpc-routing.md b/site/content/en/latest/tasks/traffic/grpc-routing.md
index 3165405aad5..7c41b54c885 100644
--- a/site/content/en/latest/tasks/traffic/grpc-routing.md
+++ b/site/content/en/latest/tasks/traffic/grpc-routing.md
@@ -97,6 +97,7 @@ as well as a match for all services with a method name `Ping` which matches `yag
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -125,6 +126,7 @@ spec:
           weight: 1
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -156,6 +158,7 @@ spec:
           port: 9000
           weight: 1
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -179,6 +182,7 @@ with match type `RegularExpression`. It matches all the services and methods wit
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -209,6 +213,7 @@ spec:
           weight: 1
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -242,6 +247,7 @@ spec:
           port: 9000
           weight: 1
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-redirect.md b/site/content/en/latest/tasks/traffic/http-redirect.md
index a8fc7d2e82c..2a41777f80b 100644
--- a/site/content/en/latest/tasks/traffic/http-redirect.md
+++ b/site/content/en/latest/tasks/traffic/http-redirect.md
@@ -21,6 +21,7 @@ For example, to issue a permanent redirect (301) from HTTP to HTTPS, configure `
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -42,6 +43,7 @@ spec:
           port: 443
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -66,6 +68,7 @@ spec:
           hostname: www.example.com
           port: 443
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -134,6 +137,7 @@ Define a https listener on the existing gateway
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -158,6 +162,7 @@ spec:
         name: example-com
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -185,6 +190,7 @@ spec:
       - kind: Secret
         name: example-com
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -198,6 +204,7 @@ Create two HTTPRoutes and attach them to the HTTP and HTTPS listeners using the
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -240,6 +247,7 @@ spec:
             value: /
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -285,6 +293,7 @@ spec:
             type: PathPrefix
             value: /
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -309,6 +318,7 @@ below will issue a 302 redirect to all `path.redirect.example` requests whose pa
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -337,6 +347,7 @@ spec:
         port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -368,6 +379,7 @@ spec:
       - name: backend
         port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-request-headers.md b/site/content/en/latest/tasks/traffic/http-request-headers.md
index c3e4efdfe26..7bc709c49c6 100644
--- a/site/content/en/latest/tasks/traffic/http-request-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-request-headers.md
@@ -26,6 +26,7 @@ header in the request.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -56,6 +57,7 @@ spec:
           value: "foo"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -89,6 +91,7 @@ spec:
         - name: "add-header"
           value: "foo"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -147,6 +150,7 @@ filter.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -177,6 +181,7 @@ spec:
           value: "foo"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -210,6 +215,7 @@ spec:
         - name: "set-header"
           value: "foo"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -255,6 +261,7 @@ filter.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -283,6 +290,7 @@ spec:
         - "remove-header"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -314,6 +322,7 @@ spec:
         remove:
         - "remove-header"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -355,6 +364,7 @@ Headers can be added/set/removed in a single filter on the same HTTPRoute and th
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -390,6 +400,7 @@ spec:
         - "removed-header"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -428,6 +439,7 @@ spec:
         remove:
         - "removed-header"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-request-mirroring.md b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
index ed214ac8fc3..f22ef51da36 100644
--- a/site/content/en/latest/tasks/traffic/http-request-mirroring.md
+++ b/site/content/en/latest/tasks/traffic/http-request-mirroring.md
@@ -18,6 +18,7 @@ a second instance of the application deployed in the quickstart.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 ---
@@ -75,6 +76,7 @@ spec:
                   fieldPath: metadata.namespace
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -134,6 +136,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 Then create an `HTTPRoute` that uses a `HTTPRequestMirrorFilter` to send requests to the original
@@ -141,6 +144,7 @@ service from the quickstart, and mirror request to the service that was just dep
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -171,6 +175,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -204,6 +209,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -266,6 +272,7 @@ When an `HTTPRoute` has multiple `backendRefs` and an `HTTPRequestMirrorFilter`,
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -300,6 +307,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -337,6 +345,7 @@ spec:
       name: backend-3
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -346,6 +355,7 @@ Multiple `HTTPRequestMirrorFilters` are not supported on the same `HTTPRoute` `r
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -382,6 +392,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -421,6 +432,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-response-headers.md b/site/content/en/latest/tasks/traffic/http-response-headers.md
index df6f4369fd2..60121674b00 100644
--- a/site/content/en/latest/tasks/traffic/http-response-headers.md
+++ b/site/content/en/latest/tasks/traffic/http-response-headers.md
@@ -24,6 +24,7 @@ value of the header in the response.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -54,6 +55,7 @@ spec:
           value: "foo"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -87,6 +89,7 @@ spec:
         - name: "add-header"
           value: "foo"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -144,6 +147,7 @@ filter.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -174,6 +178,7 @@ spec:
           value: "foo"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -207,6 +212,7 @@ spec:
         - name: "set-header"
           value: "foo"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -253,6 +259,7 @@ filter.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -281,6 +288,7 @@ spec:
         - "remove-header"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -312,6 +320,7 @@ spec:
         remove:
         - "remove-header"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -353,6 +362,7 @@ Headers can be added/set/removed in a single filter on the same HTTPRoute and th
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -388,6 +398,7 @@ spec:
         - "removed-header"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -426,6 +437,7 @@ spec:
         remove:
         - "removed-header"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-routing.md b/site/content/en/latest/tasks/traffic/http-routing.md
index 94a492d51da..aba57adc9b2 100644
--- a/site/content/en/latest/tasks/traffic/http-routing.md
+++ b/site/content/en/latest/tasks/traffic/http-routing.md
@@ -133,6 +133,7 @@ For this feature to work please make sure
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -196,6 +197,7 @@ spec:
             value: /
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -262,6 +264,7 @@ spec:
             type: PathPrefix
             value: /
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-timeouts.md b/site/content/en/latest/tasks/traffic/http-timeouts.md
index 322707d823d..3ab863608ce 100644
--- a/site/content/en/latest/tasks/traffic/http-timeouts.md
+++ b/site/content/en/latest/tasks/traffic/http-timeouts.md
@@ -24,6 +24,7 @@ We configure the backend to delay responses by 3 seconds, then we set the reques
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -52,6 +53,7 @@ spec:
       request: "4s"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -83,6 +85,7 @@ spec:
     timeouts:
       request: "4s"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -102,6 +105,7 @@ Then we set the request timeout to 2 seconds. In this case, Envoy Gateway will r
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -130,6 +134,7 @@ spec:
       request: "2s"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -161,6 +166,7 @@ spec:
     timeouts:
       request: "2s"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
index e2ec77dd3ab..06e4a236589 100644
--- a/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
+++ b/site/content/en/latest/tasks/traffic/http-traffic-splitting.md
@@ -17,6 +17,7 @@ When a single backendRef is configured in a HTTPRoute, it will receive 100% of t
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -40,6 +41,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -66,6 +68,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -119,6 +122,7 @@ First, create a second instance of the example app from the quickstart:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 ---
@@ -176,6 +180,7 @@ spec:
                   fieldPath: metadata.namespace
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -235,6 +240,7 @@ spec:
                 fieldRef:
                   fieldPath: metadata.namespace
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -242,6 +248,7 @@ Then create an HTTPRoute that uses both the app from the quickstart and the seco
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -269,6 +276,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -299,6 +307,7 @@ spec:
       name: backend-2
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -346,6 +355,7 @@ backend-2 service.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -375,6 +385,7 @@ spec:
       weight: 2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -407,6 +418,7 @@ spec:
       port: 3000
       weight: 2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -428,6 +440,7 @@ with status code `500`.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -457,6 +470,7 @@ spec:
       weight: 2
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -489,6 +503,7 @@ spec:
       port: 9000
       weight: 2
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http-urlrewrite.md b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
index 2e6ec3f0612..0ebb7595c22 100644
--- a/site/content/en/latest/tasks/traffic/http-urlrewrite.md
+++ b/site/content/en/latest/tasks/traffic/http-urlrewrite.md
@@ -17,6 +17,7 @@ You can configure to rewrite the prefix in the url like below. In this example,
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -43,6 +44,7 @@ spec:
         port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -72,6 +74,7 @@ spec:
       - name: backend
         port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -149,6 +152,7 @@ You can configure to rewrite the fullpath in the url like below. In this example
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -176,6 +180,7 @@ spec:
         port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -206,6 +211,7 @@ spec:
       - name: backend
         port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -277,6 +283,7 @@ You can configure to rewrite the hostname like below. In this example, any reque
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -302,6 +309,7 @@ spec:
         port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -330,6 +338,7 @@ spec:
       - name: backend
         port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/http3.md b/site/content/en/latest/tasks/traffic/http3.md
index a55e6c58e24..502c37496b6 100644
--- a/site/content/en/latest/tasks/traffic/http3.md
+++ b/site/content/en/latest/tasks/traffic/http3.md
@@ -61,6 +61,7 @@ Apply the following ClientTrafficPolicy to enable HTTP3
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -76,6 +77,7 @@ spec:
     namespace: default
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -94,6 +96,7 @@ spec:
     name: eg
     namespace: default
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/local-rate-limit.md b/site/content/en/latest/tasks/traffic/local-rate-limit.md
index afda7d125a6..37fb5590a44 100644
--- a/site/content/en/latest/tasks/traffic/local-rate-limit.md
+++ b/site/content/en/latest/tasks/traffic/local-rate-limit.md
@@ -38,6 +38,7 @@ with a value set to `one`.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -63,6 +64,7 @@ spec:
           unit: Hour
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -91,6 +93,7 @@ spec:
           requests: 3
           unit: Hour
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -98,6 +101,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -121,6 +125,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -147,6 +152,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -250,6 +256,7 @@ This example shows you how to rate limit all requests matching the HTTPRoute rul
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -271,6 +278,7 @@ spec:
           unit: Hour
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -295,6 +303,7 @@ spec:
           requests: 3
           unit: Hour
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -302,6 +311,7 @@ spec:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1
@@ -325,6 +335,7 @@ spec:
       port: 3000
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -351,6 +362,7 @@ spec:
       name: backend
       port: 3000
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/retry.md b/site/content/en/latest/tasks/traffic/retry.md
index d5ab467a38b..4de8f604f96 100644
--- a/site/content/en/latest/tasks/traffic/retry.md
+++ b/site/content/en/latest/tasks/traffic/retry.md
@@ -48,6 +48,7 @@ The request will be retried 5 times with a 100ms base interval and a 10s maximum
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.envoyproxy.io/v1alpha1
@@ -75,6 +76,7 @@ spec:
         - retriable-status-codes
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -105,6 +107,7 @@ spec:
         - connect-failure
         - retriable-status-codes
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md b/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
index e2acfbfc393..7720d899954 100644
--- a/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
+++ b/site/content/en/latest/tasks/traffic/routing-outside-kubernetes.md
@@ -16,6 +16,7 @@ Define a Service and EndpointSlice that represents https://httpbin.org
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -47,6 +48,7 @@ endpoints:
   - "httpbin.org"
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -81,6 +83,7 @@ endpoints:
 - addresses:
   - "httpbin.org"
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -103,6 +106,7 @@ Add a [TLSRoute][] that can route incoming traffic to the above backend that we
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -119,6 +123,7 @@ spec:
       port: 443
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -138,6 +143,7 @@ spec:
     - name: httpbin
       port: 443
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/tcp-routing.md b/site/content/en/latest/tasks/traffic/tcp-routing.md
index 878ed917e50..d36f145e266 100644
--- a/site/content/en/latest/tasks/traffic/tcp-routing.md
+++ b/site/content/en/latest/tasks/traffic/tcp-routing.md
@@ -25,6 +25,7 @@ Install the GatewayClass and a `tcp-gateway` Gateway first.
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 kind: GatewayClass
@@ -55,6 +56,7 @@ spec:
       - kind: TCPRoute
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -88,6 +90,7 @@ spec:
       kinds:
       - kind: TCPRoute
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -95,6 +98,7 @@ Install two services `foo` and `bar`, which are bound to `backend-1` and `backen
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: v1
@@ -194,6 +198,7 @@ spec:
               value: bar
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -296,6 +301,7 @@ spec:
             - name: SERVICE_NAME
               value: bar
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
@@ -303,6 +309,7 @@ Install two TCPRoutes `tcp-app-1` and `tcp-app-2` with different `sectionName`:
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -332,6 +339,7 @@ spec:
       port: 3002
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resources to your cluster:
@@ -364,6 +372,7 @@ spec:
     - name: bar
       port: 3002
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}
 
diff --git a/site/content/en/latest/tasks/traffic/udp-routing.md b/site/content/en/latest/tasks/traffic/udp-routing.md
index d20287476b9..b9d8e379282 100644
--- a/site/content/en/latest/tasks/traffic/udp-routing.md
+++ b/site/content/en/latest/tasks/traffic/udp-routing.md
@@ -58,6 +58,7 @@ Create a UDPRoute resource to route UDP traffic received on Gateway port 5300 to
 
 {{< tabpane text=true >}}
 {{% tab header="Apply from stdin" %}}
+
 ```shell
 cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1alpha2
@@ -74,6 +75,7 @@ spec:
           port: 53
 EOF
 ```
+
 {{% /tab %}}
 {{% tab header="Apply from file" %}}
 Save and apply the following resource to your cluster:
@@ -93,6 +95,7 @@ spec:
         - name: coredns
           port: 53
 ```
+
 {{% /tab %}}
 {{< /tabpane >}}