diff --git a/api/v1alpha1/backendtrafficpolicy_types.go b/api/v1alpha1/backendtrafficpolicy_types.go
index 6c7167548a..5069bfc5ee 100644
--- a/api/v1alpha1/backendtrafficpolicy_types.go
+++ b/api/v1alpha1/backendtrafficpolicy_types.go
@@ -49,7 +49,7 @@ type BackendTrafficPolicy struct {
 // +kubebuilder:validation:XValidation:rule="!has(self.admissionControl) || ((!has(self.targetRef) || self.targetRef.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute']) && (!has(self.targetRefs) || self.targetRefs.all(ref, ref.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute'])) && (!has(self.targetSelectors) || self.targetSelectors.all(sel, sel.kind in ['Gateway', 'ListenerSet', 'HTTPRoute', 'GRPCRoute'])))", message="admissionControl can only be used with HTTPRoute, GRPCRoute, Gateway, or ListenerSet targets"
 type BackendTrafficPolicySpec struct {
 	PolicyTargetReferences `json:",inline"`
-	ClusterSettings        `json:",inline"`
+	BackendSettings        `json:",inline"`
 
 	// MergeType determines how this configuration is merged with existing BackendTrafficPolicy
 	// configurations targeting a parent resource. When set, this configuration will be merged
diff --git a/api/v1alpha1/shared_types.go b/api/v1alpha1/shared_types.go
index d33f6544d3..61fcbc69d6 100644
--- a/api/v1alpha1/shared_types.go
+++ b/api/v1alpha1/shared_types.go
@@ -639,12 +639,10 @@ type BackendCluster struct {
 	// to the backend.
 	//
 	// +optional
-	BackendSettings *ClusterSettings `json:"backendSettings,omitempty"`
+	BackendSettings *BackendSettings `json:"backendSettings,omitempty"`
 }
 
-// ClusterSettings provides the various knobs that can be set to control how traffic to a given
-// backend will be configured.
-//
+// ClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster.
 // +kubebuilder:validation:XValidation:rule="!((has(self.connection) && has(self.connection.preconnect) && has(self.connection.preconnect.predictivePercent)) && !(has(self.loadBalancer) && has(self.loadBalancer.type) && self.loadBalancer.type in ['Random', 'RoundRobin']))",message="predictivePercent in preconnect policy only works with RoundRobin or Random load balancers"
 type ClusterSettings struct {
 	// LoadBalancer policy to apply when routing traffic from the gateway to
@@ -652,11 +650,6 @@ type ClusterSettings struct {
 	// +optional
 	LoadBalancer *LoadBalancer `json:"loadBalancer,omitempty"`
 
-	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
-	// If not set, retry will be disabled.
-	// +optional
-	Retry *Retry `json:"retry,omitempty"`
-
 	// ProxyProtocol enables the Proxy Protocol when communicating with the backend.
 	// +optional
 	ProxyProtocol *ProxyProtocol `json:"proxyProtocol,omitempty"`
@@ -699,6 +692,18 @@ type ClusterSettings struct {
 	HTTP2 *HTTP2Settings `json:"http2,omitempty"`
 }
 
+// BackendSettings provides the various knobs that can be set to control how traffic to a given
+// backend will be configured. It embeds ClusterSettings (CDS-only fields) and adds
+// route-level fields like Retry.
+type BackendSettings struct {
+	ClusterSettings `json:",inline"`
+
+	// Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.
+	// If not set, retry will be disabled.
+	// +optional
+	Retry *Retry `json:"retry,omitempty"`
+}
+
 // CIDR defines a CIDR Address range.
 // A CIDR can be an IPv4 address range such as "192.168.1.0/24" or an IPv6 address range such as "2001:0db8:11a3:09d7::/64".
 // +kubebuilder:validation:Pattern=`((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/([0-9]+))|((([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\/([0-9]+))`
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
index 7730ebed2b..aa46a452f8 100644
--- a/api/v1alpha1/zz_generated.deepcopy.go
+++ b/api/v1alpha1/zz_generated.deepcopy.go
@@ -425,7 +425,7 @@ func (in *BackendCluster) DeepCopyInto(out *BackendCluster) {
 	}
 	if in.BackendSettings != nil {
 		in, out := &in.BackendSettings, &out.BackendSettings
-		*out = new(ClusterSettings)
+		*out = new(BackendSettings)
 		(*in).DeepCopyInto(*out)
 	}
 }
@@ -588,6 +588,27 @@ func (in *BackendRef) DeepCopy() *BackendRef {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *BackendSettings) DeepCopyInto(out *BackendSettings) {
+	*out = *in
+	in.ClusterSettings.DeepCopyInto(&out.ClusterSettings)
+	if in.Retry != nil {
+		in, out := &in.Retry, &out.Retry
+		*out = new(Retry)
+		(*in).DeepCopyInto(*out)
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new BackendSettings.
+func (in *BackendSettings) DeepCopy() *BackendSettings {
+	if in == nil {
+		return nil
+	}
+	out := new(BackendSettings)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *BackendSpec) DeepCopyInto(out *BackendSpec) {
 	*out = *in
@@ -806,7 +827,7 @@ func (in *BackendTrafficPolicyList) DeepCopyObject() runtime.Object {
 func (in *BackendTrafficPolicySpec) DeepCopyInto(out *BackendTrafficPolicySpec) {
 	*out = *in
 	in.PolicyTargetReferences.DeepCopyInto(&out.PolicyTargetReferences)
-	in.ClusterSettings.DeepCopyInto(&out.ClusterSettings)
+	in.BackendSettings.DeepCopyInto(&out.BackendSettings)
 	if in.MergeType != nil {
 		in, out := &in.MergeType, &out.MergeType
 		*out = new(MergeType)
@@ -1613,11 +1634,6 @@ func (in *ClusterSettings) DeepCopyInto(out *ClusterSettings) {
 		*out = new(LoadBalancer)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Retry != nil {
-		in, out := &in.Retry, &out.Retry
-		*out = new(Retry)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.ProxyProtocol != nil {
 		in, out := &in.ProxyProtocol, &out.ProxyProtocol
 		*out = new(ProxyProtocol)
diff --git a/internal/gatewayapi/clustersettings.go b/internal/gatewayapi/backendsettings.go
similarity index 97%
rename from internal/gatewayapi/clustersettings.go
rename to internal/gatewayapi/backendsettings.go
index d442c2414d..5536014150 100644
--- a/internal/gatewayapi/clustersettings.go
+++ b/internal/gatewayapi/backendsettings.go
@@ -25,13 +25,13 @@ import (
 	"github.com/envoyproxy/gateway/internal/xds/utils/fractionalpercent"
 )
 
-func translateTrafficFeatures(policy *egv1a1.ClusterSettings) (*ir.TrafficFeatures, error) {
+func translateTrafficFeatures(policy *egv1a1.BackendSettings) (*ir.TrafficFeatures, error) {
 	if policy == nil {
 		return nil, nil
 	}
 	ret := &ir.TrafficFeatures{}
 
-	if timeout, err := buildClusterSettingsTimeout(policy); err != nil {
+	if timeout, err := buildBackendSettingsTimeout(policy); err != nil {
 		return nil, err
 	} else {
 		ret.Timeout = timeout
@@ -89,7 +89,7 @@ func translateTrafficFeatures(policy *egv1a1.ClusterSettings) (*ir.TrafficFeatur
 	return ret, nil
 }
 
-func buildClusterSettingsTimeout(policy *egv1a1.ClusterSettings) (*ir.Timeout, error) {
+func buildBackendSettingsTimeout(policy *egv1a1.BackendSettings) (*ir.Timeout, error) {
 	if policy.Timeout == nil {
 		return nil, nil
 	}
@@ -174,7 +174,7 @@ func buildClusterSettingsTimeout(policy *egv1a1.ClusterSettings) (*ir.Timeout, e
 	return to, errs
 }
 
-func buildBackendConnection(policy *egv1a1.ClusterSettings) (*ir.BackendConnection, error) {
+func buildBackendConnection(policy *egv1a1.BackendSettings) (*ir.BackendConnection, error) {
 	if policy.Connection == nil {
 		return nil, nil
 	}
@@ -213,7 +213,7 @@ func buildBackendConnection(policy *egv1a1.ClusterSettings) (*ir.BackendConnecti
 	return bcIR, nil
 }
 
-func buildTCPKeepAlive(policy *egv1a1.ClusterSettings) (*ir.TCPKeepalive, error) {
+func buildTCPKeepAlive(policy *egv1a1.BackendSettings) (*ir.TCPKeepalive, error) {
 	if policy.TCPKeepalive == nil {
 		return nil, nil
 	}
@@ -243,7 +243,7 @@ func buildTCPKeepAlive(policy *egv1a1.ClusterSettings) (*ir.TCPKeepalive, error)
 	return ka, nil
 }
 
-func buildCircuitBreaker(policy *egv1a1.ClusterSettings) (*ir.CircuitBreaker, error) {
+func buildCircuitBreaker(policy *egv1a1.BackendSettings) (*ir.CircuitBreaker, error) {
 	if policy.CircuitBreaker == nil {
 		return nil, nil
 	}
@@ -312,7 +312,7 @@ func buildCircuitBreaker(policy *egv1a1.ClusterSettings) (*ir.CircuitBreaker, er
 	return cb, nil
 }
 
-func buildLoadBalancer(policy *egv1a1.ClusterSettings) (*ir.LoadBalancer, error) {
+func buildLoadBalancer(policy *egv1a1.BackendSettings) (*ir.LoadBalancer, error) {
 	if policy.LoadBalancer == nil {
 		return nil, nil
 	}
@@ -512,7 +512,7 @@ func buildEndpointOverride(policy egv1a1.EndpointOverride) *ir.EndpointOverride
 	return endpointOverride
 }
 
-func buildProxyProtocol(policy *egv1a1.ClusterSettings) *ir.ProxyProtocol {
+func buildProxyProtocol(policy *egv1a1.BackendSettings) *ir.ProxyProtocol {
 	if policy.ProxyProtocol == nil {
 		return nil
 	}
@@ -531,7 +531,7 @@ func buildProxyProtocol(policy *egv1a1.ClusterSettings) *ir.ProxyProtocol {
 	return pp
 }
 
-func buildHealthCheck(policy *egv1a1.ClusterSettings) *ir.HealthCheck {
+func buildHealthCheck(policy *egv1a1.BackendSettings) *ir.HealthCheck {
 	if policy.HealthCheck == nil {
 		return nil
 	}
@@ -712,7 +712,7 @@ func translateActiveHealthCheckPayload(p *egv1a1.ActiveHealthCheckPayload) *ir.H
 	return irPayload
 }
 
-func translateDNS(policy *egv1a1.ClusterSettings, policyName string) *ir.DNS {
+func translateDNS(policy *egv1a1.BackendSettings, policyName string) *ir.DNS {
 	if policy.DNS == nil {
 		return nil
 	}
diff --git a/internal/gatewayapi/clustersettings_backendutilization_test.go b/internal/gatewayapi/backendsettings_backendutilization_test.go
similarity index 86%
rename from internal/gatewayapi/clustersettings_backendutilization_test.go
rename to internal/gatewayapi/backendsettings_backendutilization_test.go
index 502c857f65..6ce3b4005b 100644
--- a/internal/gatewayapi/clustersettings_backendutilization_test.go
+++ b/internal/gatewayapi/backendsettings_backendutilization_test.go
@@ -25,10 +25,12 @@ func TestBuildLoadBalancer_BackendUtilization(t *testing.T) {
 		MetricNamesForComputingUtilization: []string{"named_metrics.foo", "cpu_utilization"},
 	}
 
-	policy := &egv1a1.ClusterSettings{
-		LoadBalancer: &egv1a1.LoadBalancer{
-			Type:               egv1a1.BackendUtilizationLoadBalancerType,
-			BackendUtilization: backendUtilization,
+	policy := &egv1a1.BackendSettings{
+		ClusterSettings: egv1a1.ClusterSettings{
+			LoadBalancer: &egv1a1.LoadBalancer{
+				Type:               egv1a1.BackendUtilizationLoadBalancerType,
+				BackendUtilization: backendUtilization,
+			},
 		},
 	}
 
diff --git a/internal/gatewayapi/backendtrafficpolicy.go b/internal/gatewayapi/backendtrafficpolicy.go
index 4f2378c5ce..a7d4a5fa83 100644
--- a/internal/gatewayapi/backendtrafficpolicy.go
+++ b/internal/gatewayapi/backendtrafficpolicy.go
@@ -1432,7 +1432,7 @@ func (t *Translator) applyTrafficFeatureToRoute(route RouteContext,
 					}
 				}
 
-				if localTo, err := buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err == nil {
+				if localTo, err := buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err == nil {
 					r.Traffic.Timeout = localTo
 				}
 
@@ -1505,13 +1505,13 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o
 			errs = errors.Join(errs, err)
 		}
 	}
-	if lb, err = buildLoadBalancer(&policy.Spec.ClusterSettings); err != nil {
+	if lb, err = buildLoadBalancer(&policy.Spec.BackendSettings); err != nil {
 		err = perr.WithMessage(err, "LoadBalancer")
 		errs = errors.Join(errs, err)
 	}
-	pp = buildProxyProtocol(&policy.Spec.ClusterSettings)
-	hc = buildHealthCheck(&policy.Spec.ClusterSettings)
-	if cb, err = buildCircuitBreaker(&policy.Spec.ClusterSettings); err != nil {
+	pp = buildProxyProtocol(&policy.Spec.BackendSettings)
+	hc = buildHealthCheck(&policy.Spec.BackendSettings)
+	if cb, err = buildCircuitBreaker(&policy.Spec.BackendSettings); err != nil {
 		err = perr.WithMessage(err, "CircuitBreaker")
 		errs = errors.Join(errs, err)
 	}
@@ -1521,7 +1521,7 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o
 	if policy.Spec.AdmissionControl != nil {
 		ac = t.buildAdmissionControl(policy)
 	}
-	if ka, err = buildTCPKeepAlive(&policy.Spec.ClusterSettings); err != nil {
+	if ka, err = buildTCPKeepAlive(&policy.Spec.BackendSettings); err != nil {
 		err = perr.WithMessage(err, "TCPKeepalive")
 		errs = errors.Join(errs, err)
 	}
@@ -1531,12 +1531,12 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o
 		errs = errors.Join(errs, err)
 	}
 
-	if to, err = buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err != nil {
+	if to, err = buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err != nil {
 		err = perr.WithMessage(err, "Timeout")
 		errs = errors.Join(errs, err)
 	}
 
-	if bc, err = buildBackendConnection(&policy.Spec.ClusterSettings); err != nil {
+	if bc, err = buildBackendConnection(&policy.Spec.BackendSettings); err != nil {
 		err = perr.WithMessage(err, "BackendConnection")
 		errs = errors.Join(errs, err)
 	}
@@ -1569,7 +1569,7 @@ func (t *Translator) buildTrafficFeatures(policy *egv1a1.BackendTrafficPolicy, o
 		errs = errors.Join(errs, err)
 	}
 
-	ds = translateDNS(&policy.Spec.ClusterSettings, utils.NamespacedName(policy).String())
+	ds = translateDNS(&policy.Spec.BackendSettings, utils.NamespacedName(policy).String())
 
 	return &ir.TrafficFeatures{
 		RateLimit:         rl,
@@ -1748,7 +1748,7 @@ func (t *Translator) translateBackendTrafficPolicyForListeners(
 			}
 
 			r.Traffic = tf.DeepCopy()
-			if localTo, err := buildClusterSettingsTimeout(&policy.Spec.ClusterSettings); err == nil {
+			if localTo, err := buildBackendSettingsTimeout(&policy.Spec.BackendSettings); err == nil {
 				r.Traffic.Timeout = localTo
 			}
 
diff --git a/internal/gatewayapi/backendtrafficpolicy_test.go b/internal/gatewayapi/backendtrafficpolicy_test.go
index e6242aa5b4..a110008ddd 100644
--- a/internal/gatewayapi/backendtrafficpolicy_test.go
+++ b/internal/gatewayapi/backendtrafficpolicy_test.go
@@ -1647,7 +1647,9 @@ func TestBTPRoutingTypeIndex(t *testing.T) {
 								SectionName: new(gwapiv1.SectionName("http")),
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 				{
@@ -2341,8 +2343,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+							},
 						},
 					},
 				},
@@ -2367,8 +2371,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType},
+							},
 						},
 					},
 				},
@@ -2394,8 +2400,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+							},
 						},
 					},
 				},
@@ -2418,8 +2426,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+							},
 						},
 					},
 				},
@@ -2462,8 +2472,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: roundRobinType},
+							},
 						},
 					},
 				},
@@ -2481,8 +2493,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+							},
 						},
 					},
 				},
@@ -2523,8 +2537,10 @@ func TestBTPLoadBalancerIndexIsConsistentHash(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{
-							LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{
+								LoadBalancer: &egv1a1.LoadBalancer{Type: consistentHashType},
+							},
 						},
 					},
 				},
@@ -2571,7 +2587,7 @@ func TestBtpSpecHasClusterScopedFields(t *testing.T) {
 		},
 		{
 			name: "ClusterSettings field set",
-			spec: &egv1a1.BackendTrafficPolicySpec{ClusterSettings: *circuitBreakerSet},
+			spec: &egv1a1.BackendTrafficPolicySpec{BackendSettings: egv1a1.BackendSettings{ClusterSettings: *circuitBreakerSet}},
 			want: true,
 		},
 		{
@@ -2608,7 +2624,9 @@ func TestBuildBTPClusterSettingsIndexCrossNamespace(t *testing.T) {
 						},
 					},
 				},
-				ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: circuitBreaker},
+				BackendSettings: egv1a1.BackendSettings{
+					ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: circuitBreaker},
+				},
 			},
 		},
 	}
@@ -2807,7 +2825,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 				{
@@ -2848,7 +2868,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 				{
@@ -2906,7 +2928,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) {
 								SectionName: &ruleName,
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 			},
@@ -2946,7 +2970,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) {
 								},
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 			},
@@ -2986,7 +3012,9 @@ func TestBTPClusterSettingsIndex(t *testing.T) {
 								SectionName: new(gwapiv1.SectionName("http")),
 							},
 						},
-						ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						BackendSettings: egv1a1.BackendSettings{
+							ClusterSettings: egv1a1.ClusterSettings{CircuitBreaker: &egv1a1.CircuitBreaker{}},
+						},
 					},
 				},
 			},
diff --git a/internal/gatewayapi/securitypolicy.go b/internal/gatewayapi/securitypolicy.go
index 2bf4f0fc59..597214f791 100644
--- a/internal/gatewayapi/securitypolicy.go
+++ b/internal/gatewayapi/securitypolicy.go
@@ -2668,7 +2668,7 @@ func (t *Translator) buildExtAuth(
 		http              = policy.Spec.ExtAuth.HTTP
 		grpc              = policy.Spec.ExtAuth.GRPC
 		backendRefs       []egv1a1.BackendRef
-		backendSettings   *egv1a1.ClusterSettings
+		backendSettings   *egv1a1.BackendSettings
 		protocol          ir.AppProtocol
 		rd                *ir.RouteDestination
 		authority         string
diff --git a/site/content/en/latest/api/extension_types.md b/site/content/en/latest/api/extension_types.md
index 20d3157df6..16085f41fa 100644
--- a/site/content/en/latest/api/extension_types.md
+++ b/site/content/en/latest/api/extension_types.md
@@ -63,7 +63,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `logName` | _string_ |  false  |  | LogName defines the friendly name of the access log to be returned in<br />StreamAccessLogsMessage.Identifier. This allows the access log server<br />to differentiate between different access logs coming from the same Envoy. |
 | `type` | _[ALSEnvoyProxyAccessLogType](#alsenvoyproxyaccesslogtype)_ |  true  |  | Type defines the type of accesslog. Supported types are "HTTP" and "TCP". |
 | `http` | _[ALSEnvoyProxyHTTPAccessLogConfig](#alsenvoyproxyhttpaccesslogconfig)_ |  false  |  | HTTP defines additional configuration specific to HTTP access logs. |
@@ -368,7 +368,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
 
 
@@ -382,6 +382,7 @@ _Appears in:_
 BackendConnection allows users to configure connection-level settings of backend
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -454,6 +455,41 @@ _Appears in:_
 | `fallback` | _boolean_ |  false  |  | Fallback indicates whether the backend is designated as a fallback.<br />Multiple fallback backends can be configured.<br />It is highly recommended to configure active or passive health checks to ensure that failover can be detected<br />when the active backends become unhealthy and to automatically readjust once the primary backends are healthy again.<br />The overprovisioning factor is set to 1.4, meaning the fallback backends will only start receiving traffic when<br />the health of the active backends falls below 72%. |
 
 
+#### BackendSettings
+
+
+
+BackendSettings provides the various knobs that can be set to control how traffic to a given
+backend will be configured. It embeds ClusterSettings (CDS-only fields) and adds
+route-level fields like Retry.
+
+_Appears in:_
+- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
+- [BackendCluster](#backendcluster)
+- [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
+- [ExtProc](#extproc)
+- [GRPCExtAuthService](#grpcextauthservice)
+- [HTTPExtAuthService](#httpextauthservice)
+- [OIDCProvider](#oidcprovider)
+- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
+- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
+- [RemoteJWKS](#remotejwks)
+- [TracingProvider](#tracingprovider)
+
+| Field | Type | Required | Default | Description |
+| ---   | ---  | ---      | ---     | ---         |
+| `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  |  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
+| `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  |  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
+| `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  |  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
+| `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  |  | HealthCheck allows gateway to perform active health checking on backends. |
+| `circuitBreaker` | _[CircuitBreaker](#circuitbreaker)_ |  false  |  | Circuit Breaker settings for the upstream connections and requests.<br />If not set, circuit breakers will be enabled with the default thresholds |
+| `timeout` | _[Timeout](#timeout)_ |  false  |  | Timeout settings for the backend connections. |
+| `connection` | _[BackendConnection](#backendconnection)_ |  false  |  | Connection includes backend connection settings. |
+| `dns` | _[DNS](#dns)_ |  false  |  | DNS includes dns resolution settings. |
+| `http2` | _[HTTP2Settings](#http2settings)_ |  false  |  | HTTP2 provides HTTP/2 configuration for backend connections. |
+| `retry` | _[Retry](#retry)_ |  false  |  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
+
+
 #### BackendSpec
 
 
@@ -574,7 +610,6 @@ _Appears in:_
 | `targetRefs` | _LocalPolicyTargetReferenceWithSectionName array_ |  true  |  | TargetRefs are the names of the Gateway resources this policy<br />is being attached to. |
 | `targetSelectors` | _[TargetSelector](#targetselector) array_ |  true  |  | TargetSelectors allow targeting resources for this policy based on labels |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  |  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
-| `retry` | _[Retry](#retry)_ |  false  |  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  |  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  |  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  |  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -583,6 +618,7 @@ _Appears in:_
 | `connection` | _[BackendConnection](#backendconnection)_ |  false  |  | Connection includes backend connection settings. |
 | `dns` | _[DNS](#dns)_ |  false  |  | DNS includes dns resolution settings. |
 | `http2` | _[HTTP2Settings](#http2settings)_ |  false  |  | HTTP2 provides HTTP/2 configuration for backend connections. |
+| `retry` | _[Retry](#retry)_ |  false  |  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `mergeType` | _[MergeType](#mergetype)_ |  false  |  | MergeType determines how this configuration is merged with existing BackendTrafficPolicy<br />configurations targeting a parent resource. When set, this configuration will be merged<br />into the closest parent BackendTrafficPolicy in the route's attachment hierarchy (for<br />example, one targeting a Gateway, Gateway listener, ListenerSet, or ListenerSet listener).<br />Currently, this field can only be set when targeting xRoute resources.<br />If unset, no merging occurs, and only the most specific configuration takes effect. |
 | `rateLimit` | _[RateLimitSpec](#ratelimitspec)_ |  false  |  | RateLimit allows the user to limit the number of incoming requests<br />to a predefined value based on attributes within the traffic flow. |
 | `bandwidthLimit` | _[BandwidthLimitSpec](#bandwidthlimitspec)_ |  false  |  | BandwidthLimit allows the user to limit the bandwidth of traffic<br />sent to and received from the backend. |
@@ -863,6 +899,7 @@ _Appears in:_
 CircuitBreaker defines the Circuit Breaker configuration.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -1075,26 +1112,15 @@ _Appears in:_
 
 
 
-ClusterSettings provides the various knobs that can be set to control how traffic to a given
-backend will be configured.
+ClusterSettings contains CDS-only fields that configure the upstream Envoy Cluster.
 
 _Appears in:_
-- [ALSEnvoyProxyAccessLog](#alsenvoyproxyaccesslog)
-- [BackendCluster](#backendcluster)
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ExtProc](#extproc)
-- [GRPCExtAuthService](#grpcextauthservice)
-- [HTTPExtAuthService](#httpextauthservice)
-- [OIDCProvider](#oidcprovider)
-- [OpenTelemetryEnvoyProxyAccessLog](#opentelemetryenvoyproxyaccesslog)
-- [ProxyOpenTelemetrySink](#proxyopentelemetrysink)
-- [RemoteJWKS](#remotejwks)
-- [TracingProvider](#tracingprovider)
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
 | `loadBalancer` | _[LoadBalancer](#loadbalancer)_ |  false  |  | LoadBalancer policy to apply when routing traffic from the gateway to<br />the backend endpoints. Defaults to `LeastRequest`. |
-| `retry` | _[Retry](#retry)_ |  false  |  | Retry provides more advanced usage, allowing users to customize the number of retries, retry fallback strategy, and retry triggering conditions.<br />If not set, retry will be disabled. |
 | `proxyProtocol` | _[ProxyProtocol](#proxyprotocol)_ |  false  |  | ProxyProtocol enables the Proxy Protocol when communicating with the backend. |
 | `tcpKeepalive` | _[TCPKeepalive](#tcpkeepalive)_ |  false  |  | TcpKeepalive settings associated with the upstream client connection.<br />Disabled by default. |
 | `healthCheck` | _[HealthCheck](#healthcheck)_ |  false  |  | HealthCheck allows gateway to perform active health checking on backends. |
@@ -1434,6 +1460,7 @@ _Appears in:_
 
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -2419,7 +2446,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `messageTimeout` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  |  | MessageTimeout is the timeout for a response to be returned from the external processor<br />Default: 200ms |
 | `failOpen` | _boolean_ |  false  | false | FailOpen is a switch used to control the behavior when failing to call the external processor.<br />If FailOpen is set to true, the system bypasses the ExtProc extension and<br />allows the traffic to pass through. If it is set to false or<br />not set (defaulting to false), the system blocks the traffic and returns<br />an HTTP 5xx error.<br />If set to true, the ExtProc extension will also be bypassed if the configuration is invalid. |
 | `processingMode` | _[ExtProcProcessingMode](#extprocprocessingmode)_ |  false  |  | ProcessingMode defines how request and response body is processed<br />Default: header and body are not sent to the external processor |
@@ -2745,7 +2772,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 
 
 #### GRPCSettings
@@ -3033,6 +3060,7 @@ _Appears in:_
 HTTP2Settings provides HTTP/2 configuration for listeners and backends.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
@@ -3158,7 +3186,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `path` | _string_ |  false  |  | Path is the path of the HTTP External Authorization service.<br />If path is specified, the authorization request will be sent to that path,<br />or else the authorization request will use the path of the original request.<br />Please note that the original request path will be appended to the path specified here.<br />For example, if the original request path is "/hello", and the path specified here is "/auth",<br />then the path of the authorization request will be "/auth/hello". If the path is not specified,<br />the path of the authorization request will be "/hello".<br />Only one of Path or PathOverride can be set. |
 | `pathOverride` | _string_ |  false  |  | PathOverride replaces the original request path in the authorization request.<br />If set, the path will be overridden to this value during authorization.<br />For example, if the original request path is "/hello", and PathOverride is set to "/auth",<br />then the path of the authorization request will be "/auth".<br />Only one of Path or PathOverride can be set. |
 | `headersToBackend` | _string array_ |  false  |  | HeadersToBackend are the authorization response headers that will be added<br />to the original client request before sending it to the backend server.<br />Note that coexisting headers will be overridden.<br />If not specified, no authorization response headers will be added to the<br />original client request. |
@@ -3453,6 +3481,7 @@ HealthCheck configuration to decide which endpoints
 are healthy and can be used for routing.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -4121,6 +4150,7 @@ _Appears in:_
 LoadBalancer defines the load balancer policy to be applied.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -4488,7 +4518,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `issuer` | _string_ |  true  |  | The OIDC Provider's [issuer identifier](https://openid.net/specs/openid-connect-discovery-1_0.html#IssuerDiscovery).<br />Issuer MUST be a URI RFC 3986 [RFC3986] with a scheme component that MUST<br />be https, a host component, and optionally, port and path components and<br />no query or fragment components. |
 | `authorizationEndpoint` | _string_ |  false  |  | The OIDC Provider's [authorization endpoint](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
 | `tokenEndpoint` | _string_ |  false  |  | The OIDC Provider's [token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).<br />If not provided, EG will try to discover it from the provider's [Well-Known Configuration Endpoint](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfigurationResponse). |
@@ -4558,7 +4588,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  |  | Host define the extension service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | 4317 | Port defines the port the extension service is exposed on.<br />Deprecated: Use BackendRefs instead. |
 | `resources` | _object (keys:string, values:string)_ |  false  |  | Resources is a set of labels that describe the source of a log entry, including envoy node info.<br />It's recommended to follow [semantic conventions](https://opentelemetry.io/docs/reference/specification/resource/semantic_conventions/).<br />Deprecated: Use ResourceAttributes instead. |
@@ -5091,7 +5121,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `host` | _string_ |  false  |  | Host define the service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | 4317 | Port defines the port the service is exposed on.<br />Deprecated: Use BackendRefs instead. |
 | `reportCountersAsDeltas` | _boolean_ |  false  |  | ReportCountersAsDeltas configures the OpenTelemetry sink to report<br />counters as delta temporality instead of cumulative. |
@@ -5123,6 +5153,7 @@ ProxyProtocol defines the configuration related to the proxy protocol
 when communicating with the backend.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -5649,7 +5680,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `uri` | _string_ |  true  |  | URI is the HTTPS URI to fetch the JWKS. Envoy's system trust bundle is used to validate the server certificate.<br />If a custom trust bundle is needed, it can be specified in a BackendTLSConfig resource and target the BackendRefs. |
 | `cacheDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  | 300s |  |
 | `failedRefetchDuration` | _[Duration](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#duration)_ |  false  |  | FailedRefetchDuration is the duration Envoy waits before re-fetching the JWKS<br />after a failed fetch.<br />This does not control retries within a single fetch attempt (see BackendSettings.Retry),<br />only the interval between fetch attempts after a failure.<br />If not specified, Envoy's default of 1 second is used. |
@@ -5820,8 +5851,8 @@ _Appears in:_
 Retry defines the retry strategy to be applied.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
-- [ClusterSettings](#clustersettings)
 
 | Field | Type | Required | Default | Description |
 | ---   | ---  | ---      | ---     | ---         |
@@ -6330,6 +6361,7 @@ _Appears in:_
 TCPKeepalive define the TCP Keepalive configuration.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClientTrafficPolicySpec](#clienttrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
@@ -6473,6 +6505,7 @@ _Appears in:_
 Timeout defines configuration for timeouts related to connections.
 
 _Appears in:_
+- [BackendSettings](#backendsettings)
 - [BackendTrafficPolicySpec](#backendtrafficpolicyspec)
 - [ClusterSettings](#clustersettings)
 
@@ -6529,7 +6562,7 @@ _Appears in:_
 | ---   | ---  | ---      | ---     | ---         |
 | `backendRef` | _[BackendObjectReference](https://gateway-api.sigs.k8s.io/reference/api-spec/1.5/spec/#backendobjectreference)_ |  false  |  | BackendRef references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent.<br />Deprecated: Use BackendRefs instead. |
 | `backendRefs` | _[BackendRef](#backendref) array_ |  false  |  | BackendRefs references a Kubernetes object that represents the<br />backend server to which the authorization request will be sent. |
-| `backendSettings` | _[ClusterSettings](#clustersettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
+| `backendSettings` | _[BackendSettings](#backendsettings)_ |  false  |  | BackendSettings holds configuration for managing the connection<br />to the backend. |
 | `type` | _[TracingProviderType](#tracingprovidertype)_ |  true  | OpenTelemetry | Type defines the tracing provider type. |
 | `host` | _string_ |  false  |  | Host define the provider service hostname.<br />Deprecated: Use BackendRefs instead. |
 | `port` | _integer_ |  false  | 4317 | Port defines the port the provider service is exposed on.<br />Deprecated: Use BackendRefs instead. |
diff --git a/test/cel-validation/backendtrafficpolicy_test.go b/test/cel-validation/backendtrafficpolicy_test.go
index 422396efff..cd734185d6 100644
--- a/test/cel-validation/backendtrafficpolicy_test.go
+++ b/test/cel-validation/backendtrafficpolicy_test.go
@@ -507,11 +507,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "SourceIP",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "SourceIP",
+								},
 							},
 						},
 					},
@@ -532,9 +534,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+							},
 						},
 					},
 				}
@@ -557,13 +561,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "Header",
-								Header: &egv1a1.Header{
-									Name: "name",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "Header",
+									Header: &egv1a1.Header{
+										Name: "name",
+									},
 								},
 							},
 						},
@@ -585,11 +591,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "Header",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "Header",
+								},
 							},
 						},
 					},
@@ -613,13 +621,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "Cookie",
-								Cookie: &egv1a1.Cookie{
-									Name: "name",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "Cookie",
+									Cookie: &egv1a1.Cookie{
+										Name: "name",
+									},
 								},
 							},
 						},
@@ -641,11 +651,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "Cookie",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "Cookie",
+								},
 							},
 						},
 					},
@@ -669,13 +681,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "SourceIP",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "SourceIP",
+								},
+								ZoneAware: &egv1a1.ZoneAware{},
 							},
-							ZoneAware: &egv1a1.ZoneAware{},
 						},
 					},
 				}
@@ -695,14 +709,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "SourceIP",
-							},
-							ZoneAware: &egv1a1.ZoneAware{
-								PreferLocal: &egv1a1.PreferLocalZone{},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "SourceIP",
+								},
+								ZoneAware: &egv1a1.ZoneAware{
+									PreferLocal: &egv1a1.PreferLocalZone{},
+								},
 							},
 						},
 					},
@@ -726,17 +742,19 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							ConsistentHash: &egv1a1.ConsistentHash{
-								Type: "SourceIP",
-							},
-							ZoneAware: &egv1a1.ZoneAware{
-								WeightedZones: []egv1a1.WeightedZoneConfig{{
-									Zone:   "us-east-1a",
-									Weight: uint32(70),
-								}},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								ConsistentHash: &egv1a1.ConsistentHash{
+									Type: "SourceIP",
+								},
+								ZoneAware: &egv1a1.ZoneAware{
+									WeightedZones: []egv1a1.WeightedZoneConfig{{
+										Zone:   "us-east-1a",
+										Weight: uint32(70),
+									}},
+								},
 							},
 						},
 					},
@@ -757,9 +775,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.LeastRequestLoadBalancerType,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.LeastRequestLoadBalancerType,
+							},
 						},
 					},
 				}
@@ -779,10 +799,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type:      egv1a1.LeastRequestLoadBalancerType,
-							ZoneAware: &egv1a1.ZoneAware{},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type:      egv1a1.LeastRequestLoadBalancerType,
+								ZoneAware: &egv1a1.ZoneAware{},
+							},
 						},
 					},
 				}
@@ -802,15 +824,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.LeastRequestLoadBalancerType,
-							ZoneAware: &egv1a1.ZoneAware{
-								PreferLocal: &egv1a1.PreferLocalZone{},
-								WeightedZones: []egv1a1.WeightedZoneConfig{{
-									Zone:   "zone1",
-									Weight: uint32(10),
-								}},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.LeastRequestLoadBalancerType,
+								ZoneAware: &egv1a1.ZoneAware{
+									PreferLocal: &egv1a1.PreferLocalZone{},
+									WeightedZones: []egv1a1.WeightedZoneConfig{{
+										Zone:   "zone1",
+										Weight: uint32(10),
+									}},
+								},
 							},
 						},
 					},
@@ -834,13 +858,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
-							ZoneAware: &egv1a1.ZoneAware{
-								WeightedZones: []egv1a1.WeightedZoneConfig{
-									{Zone: "us-east-1a", Weight: 70},
-									{Zone: "us-east-1a", Weight: 30},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
+								ZoneAware: &egv1a1.ZoneAware{
+									WeightedZones: []egv1a1.WeightedZoneConfig{
+										{Zone: "us-east-1a", Weight: 70},
+										{Zone: "us-east-1a", Weight: 30},
+									},
 								},
 							},
 						},
@@ -864,11 +890,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.LeastRequestLoadBalancerType,
-							SlowStart: &egv1a1.SlowStart{
-								Window: new(gwapiv1.Duration("10ms")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.LeastRequestLoadBalancerType,
+								SlowStart: &egv1a1.SlowStart{
+									Window: new(gwapiv1.Duration("10ms")),
+								},
 							},
 						},
 					},
@@ -889,11 +917,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
-							SlowStart: &egv1a1.SlowStart{
-								Window: new(gwapiv1.Duration("10ms")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
+								SlowStart: &egv1a1.SlowStart{
+									Window: new(gwapiv1.Duration("10ms")),
+								},
 							},
 						},
 					},
@@ -914,11 +944,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RandomLoadBalancerType,
-							SlowStart: &egv1a1.SlowStart{
-								Window: new(gwapiv1.Duration("10ms")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RandomLoadBalancerType,
+								SlowStart: &egv1a1.SlowStart{
+									Window: new(gwapiv1.Duration("10ms")),
+								},
 							},
 						},
 					},
@@ -942,11 +974,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.ConsistentHashLoadBalancerType,
-							SlowStart: &egv1a1.SlowStart{
-								Window: new(gwapiv1.Duration("10ms")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.ConsistentHashLoadBalancerType,
+								SlowStart: &egv1a1.SlowStart{
+									Window: new(gwapiv1.Duration("10ms")),
+								},
 							},
 						},
 					},
@@ -970,15 +1004,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								BlackoutPeriod:                     new(gwapiv1.Duration("10s")),
-								WeightUpdatePeriod:                 new(gwapiv1.Duration("10s")),
-								WeightExpirationPeriod:             new(gwapiv1.Duration("10s")),
-								ErrorUtilizationPenaltyPercent:     new(uint32(50)),
-								MetricNamesForComputingUtilization: []string{"metric1", "metric2"},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									BlackoutPeriod:                     new(gwapiv1.Duration("10s")),
+									WeightUpdatePeriod:                 new(gwapiv1.Duration("10s")),
+									WeightExpirationPeriod:             new(gwapiv1.Duration("10s")),
+									ErrorUtilizationPenaltyPercent:     new(uint32(50)),
+									MetricNamesForComputingUtilization: []string{"metric1", "metric2"},
+								},
 							},
 						},
 					},
@@ -999,14 +1035,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{
-									ReportingPeriod: new(gwapiv1.Duration("5s")),
-									Port:            new(int32(9001)),
-									Authority:       new("orca.local"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{
+										ReportingPeriod: new(gwapiv1.Duration("5s")),
+										Port:            new(int32(9001)),
+										Authority:       new("orca.local"),
+									},
 								},
 							},
 						},
@@ -1028,11 +1066,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(0))},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(0))},
+								},
 							},
 						},
 					},
@@ -1056,11 +1096,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(70000))},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{Port: new(int32(70000))},
+								},
 							},
 						},
 					},
@@ -1084,11 +1126,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{ReportingPeriod: new(gwapiv1.Duration("0s"))},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{ReportingPeriod: new(gwapiv1.Duration("0s"))},
+								},
 							},
 						},
 					},
@@ -1112,11 +1156,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("")},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("")},
+								},
 							},
 						},
 					},
@@ -1140,11 +1186,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{
-								OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("foo\nbar")},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{
+									OutOfBand: &egv1a1.OutOfBandReporting{Authority: new("foo\nbar")},
+								},
 							},
 						},
 					},
@@ -1168,9 +1216,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.BackendUtilizationLoadBalancerType,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.BackendUtilizationLoadBalancerType,
+							},
 						},
 					},
 				}
@@ -1193,11 +1243,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type:               egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{},
-							SlowStart:          &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type:               egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{},
+								SlowStart:          &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))},
+							},
 						},
 					},
 				}
@@ -1217,11 +1269,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type:               egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{},
-							ZoneAware:          &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type:               egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{},
+								ZoneAware:          &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}},
+							},
 						},
 					},
 				}
@@ -1244,14 +1298,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type:               egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{},
-							ZoneAware: &egv1a1.ZoneAware{
-								WeightedZones: []egv1a1.WeightedZoneConfig{
-									{Zone: "us-east-1a", Weight: 80},
-									{Zone: "us-east-1b", Weight: 20},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type:               egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{},
+								ZoneAware: &egv1a1.ZoneAware{
+									WeightedZones: []egv1a1.WeightedZoneConfig{
+										{Zone: "us-east-1a", Weight: 80},
+										{Zone: "us-east-1b", Weight: 20},
+									},
 								},
 							},
 						},
@@ -1273,10 +1329,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type:               egv1a1.BackendUtilizationLoadBalancerType,
-							BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type:               egv1a1.BackendUtilizationLoadBalancerType,
+								BackendUtilization: &egv1a1.BackendUtilization{ErrorUtilizationPenaltyPercent: new(uint32(0))},
+							},
 						},
 					},
 				}
@@ -1296,13 +1354,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
-								Config:       &apiextensionsv1.JSON{Raw: []byte(`{"key":"value"}`)},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+									Config:       &apiextensionsv1.JSON{Raw: []byte(`{"key":"value"}`)},
+								},
 							},
 						},
 					},
@@ -1323,12 +1383,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+								},
 							},
 						},
 					},
@@ -1349,9 +1411,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+							},
 						},
 					},
 				}
@@ -1374,12 +1438,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+								},
 							},
 						},
 					},
@@ -1403,14 +1469,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+								},
+								SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))},
 							},
-							SlowStart: &egv1a1.SlowStart{Window: new(gwapiv1.Duration("10ms"))},
 						},
 					},
 				}
@@ -1433,14 +1501,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+								},
+								ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}},
 							},
-							ZoneAware: &egv1a1.ZoneAware{PreferLocal: &egv1a1.PreferLocalZone{}},
 						},
 					},
 				}
@@ -1463,17 +1533,19 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.DynamicModuleLoadBalancerType,
-							DynamicModule: &egv1a1.DynamicModuleLBPolicy{
-								Name:         "my-module",
-								LBPolicyName: "round-robin-v2",
-							},
-							EndpointOverride: &egv1a1.EndpointOverride{
-								ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
-									{
-										Header: new("x-custom-host"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.DynamicModuleLoadBalancerType,
+								DynamicModule: &egv1a1.DynamicModuleLBPolicy{
+									Name:         "my-module",
+									LBPolicyName: "round-robin-v2",
+								},
+								EndpointOverride: &egv1a1.EndpointOverride{
+									ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
+										{
+											Header: new("x-custom-host"),
+										},
 									},
 								},
 							},
@@ -1690,12 +1762,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						CircuitBreaker: &egv1a1.CircuitBreaker{
-							MaxConnections:      valMax,
-							MaxPendingRequests:  valMin,
-							MaxParallelRequests: nil,
-							MaxParallelRetries:  nil,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							CircuitBreaker: &egv1a1.CircuitBreaker{
+								MaxConnections:      valMax,
+								MaxPendingRequests:  valMin,
+								MaxParallelRequests: nil,
+								MaxParallelRetries:  nil,
+							},
 						},
 					},
 				}
@@ -1717,13 +1791,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						CircuitBreaker: &egv1a1.CircuitBreaker{
-							MaxConnections:           valOverMax,
-							MaxPendingRequests:       valUnderMin,
-							MaxParallelRequests:      valOverMax,
-							MaxRequestsPerConnection: valUnderMin,
-							MaxParallelRetries:       valOverMax,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							CircuitBreaker: &egv1a1.CircuitBreaker{
+								MaxConnections:           valOverMax,
+								MaxPendingRequests:       valUnderMin,
+								MaxParallelRequests:      valOverMax,
+								MaxRequestsPerConnection: valUnderMin,
+								MaxParallelRetries:       valOverMax,
+							},
 						},
 					},
 				}
@@ -1749,12 +1825,14 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "",
+									},
 								},
 							},
 						},
@@ -1778,13 +1856,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								UnhealthyThreshold: new(uint32(0)),
-								Type:               egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									UnhealthyThreshold: new(uint32(0)),
+									Type:               egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+									},
 								},
 							},
 						},
@@ -1808,13 +1888,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								HealthyThreshold: new(uint32(0)),
-								Type:             egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									HealthyThreshold: new(uint32(0)),
+									Type:             egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+									},
 								},
 							},
 						},
@@ -1838,11 +1920,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								TCP:  &egv1a1.TCPActiveHealthChecker{},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									TCP:  &egv1a1.TCPActiveHealthChecker{},
+								},
 							},
 						},
 					},
@@ -1868,11 +1952,13 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								GRPC: &egv1a1.GRPCActiveHealthChecker{},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									GRPC: &egv1a1.GRPCActiveHealthChecker{},
+								},
 							},
 						},
 					},
@@ -1897,13 +1983,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:             "/healthz",
-									ExpectedStatuses: []egv1a1.HTTPStatus{99, 200},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:             "/healthz",
+										ExpectedStatuses: []egv1a1.HTTPStatus{99, 200},
+									},
 								},
 							},
 						},
@@ -1927,13 +2015,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:             "/healthz",
-									ExpectedStatuses: []egv1a1.HTTPStatus{100, 200, 201},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:             "/healthz",
+										ExpectedStatuses: []egv1a1.HTTPStatus{100, 200, 201},
+									},
 								},
 							},
 						},
@@ -1955,13 +2045,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:             "/healthz",
-									ExpectedStatuses: []egv1a1.HTTPStatus{200, 300, 601},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:             "/healthz",
+										ExpectedStatuses: []egv1a1.HTTPStatus{200, 300, 601},
+									},
 								},
 							},
 						},
@@ -1985,15 +2077,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
-									ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
-										Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
-										Binary: []byte{'f', 'o', 'o'},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+										ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
+											Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
+											Binary: []byte{'f', 'o', 'o'},
+										},
 									},
 								},
 							},
@@ -2021,15 +2115,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
-									ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeBinary,
-										Text: new("foo"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+										ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeBinary,
+											Text: new("foo"),
+										},
 									},
 								},
 							},
@@ -2057,18 +2153,20 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeTCP,
-								TCP: &egv1a1.TCPActiveHealthChecker{
-									Send: &egv1a1.ActiveHealthCheckPayload{
-										Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
-										Binary: []byte{'f', 'o', 'o'},
-									},
-									Receive: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("foo"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeTCP,
+									TCP: &egv1a1.TCPActiveHealthChecker{
+										Send: &egv1a1.ActiveHealthCheckPayload{
+											Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
+											Binary: []byte{'f', 'o', 'o'},
+										},
+										Receive: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("foo"),
+										},
 									},
 								},
 							},
@@ -2096,18 +2194,20 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeTCP,
-								TCP: &egv1a1.TCPActiveHealthChecker{
-									Send: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("foo"),
-									},
-									Receive: &egv1a1.ActiveHealthCheckPayload{
-										Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
-										Binary: []byte{'f', 'o', 'o'},
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeTCP,
+									TCP: &egv1a1.TCPActiveHealthChecker{
+										Send: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("foo"),
+										},
+										Receive: &egv1a1.ActiveHealthCheckPayload{
+											Type:   egv1a1.ActiveHealthCheckPayloadTypeText,
+											Binary: []byte{'f', 'o', 'o'},
+										},
 									},
 								},
 							},
@@ -2136,14 +2236,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Timeout: &egv1a1.Timeout{
-							TCP: &egv1a1.TCPTimeout{
-								ConnectTimeout: &d,
-							},
-							HTTP: &egv1a1.HTTPTimeout{
-								ConnectionIdleTimeout: &d,
-								MaxConnectionDuration: &d,
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Timeout: &egv1a1.Timeout{
+								TCP: &egv1a1.TCPTimeout{
+									ConnectTimeout: &d,
+								},
+								HTTP: &egv1a1.HTTPTimeout{
+									ConnectionIdleTimeout: &d,
+									MaxConnectionDuration: &d,
+								},
 							},
 						},
 					},
@@ -2408,9 +2510,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							BufferLimit: new(resource.MustParse("1Mi")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								BufferLimit: new(resource.MustParse("1Mi")),
+							},
 						},
 					},
 				}
@@ -2429,9 +2533,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							BufferLimit: new(resource.MustParse("12345678")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								BufferLimit: new(resource.MustParse("12345678")),
+							},
 						},
 					},
 				}
@@ -2451,9 +2557,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							BufferLimit: new(resource.MustParse("1m")),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								BufferLimit: new(resource.MustParse("1m")),
+							},
 						},
 					},
 				}
@@ -2475,14 +2583,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							Preconnect: &egv1a1.PreconnectPolicy{
-								PerEndpointPercent: new(uint32(100)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								Preconnect: &egv1a1.PreconnectPolicy{
+									PerEndpointPercent: new(uint32(100)),
+								},
+							},
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.LeastRequestLoadBalancerType,
 							},
-						},
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.LeastRequestLoadBalancerType,
 						},
 					},
 				}
@@ -2502,10 +2612,12 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							Preconnect: &egv1a1.PreconnectPolicy{
-								PerEndpointPercent: new(uint32(100)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								Preconnect: &egv1a1.PreconnectPolicy{
+									PerEndpointPercent: new(uint32(100)),
+								},
 							},
 						},
 					},
@@ -2526,15 +2638,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							Preconnect: &egv1a1.PreconnectPolicy{
-								PredictivePercent:  new(uint32(110)),
-								PerEndpointPercent: new(uint32(133)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								Preconnect: &egv1a1.PreconnectPolicy{
+									PredictivePercent:  new(uint32(110)),
+									PerEndpointPercent: new(uint32(133)),
+								},
+							},
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
 							},
-						},
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
 						},
 					},
 				}
@@ -2554,15 +2668,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							Preconnect: &egv1a1.PreconnectPolicy{
-								PredictivePercent:  new(uint32(133)),
-								PerEndpointPercent: new(uint32(150)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								Preconnect: &egv1a1.PreconnectPolicy{
+									PredictivePercent:  new(uint32(133)),
+									PerEndpointPercent: new(uint32(150)),
+								},
+							},
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.LeastRequestLoadBalancerType,
 							},
-						},
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.LeastRequestLoadBalancerType,
 						},
 					},
 				}
@@ -2585,14 +2701,16 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						Connection: &egv1a1.BackendConnection{
-							Preconnect: &egv1a1.PreconnectPolicy{
-								PerEndpointPercent: new(uint32(305)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							Connection: &egv1a1.BackendConnection{
+								Preconnect: &egv1a1.PreconnectPolicy{
+									PerEndpointPercent: new(uint32(305)),
+								},
+							},
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RandomLoadBalancerType,
 							},
-						},
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RandomLoadBalancerType,
 						},
 					},
 				}
@@ -3300,9 +3418,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							PanicThreshold: new(uint32(80)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								PanicThreshold: new(uint32(80)),
+							},
 						},
 					},
 				}
@@ -3322,9 +3442,11 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							PanicThreshold: new(uint32(200)),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								PanicThreshold: new(uint32(200)),
+							},
 						},
 					},
 				}
@@ -3518,13 +3640,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
-							EndpointOverride: &egv1a1.EndpointOverride{
-								ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
-									{
-										Header: new("x-custom-host"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
+								EndpointOverride: &egv1a1.EndpointOverride{
+									ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
+										{
+											Header: new("x-custom-host"),
+										},
 									},
 								},
 							},
@@ -3626,13 +3750,15 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						LoadBalancer: &egv1a1.LoadBalancer{
-							Type: egv1a1.RoundRobinLoadBalancerType,
-							EndpointOverride: &egv1a1.EndpointOverride{
-								ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
-									{
-										Header: new("x-custom-host"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							LoadBalancer: &egv1a1.LoadBalancer{
+								Type: egv1a1.RoundRobinLoadBalancerType,
+								EndpointOverride: &egv1a1.EndpointOverride{
+									ExtractFrom: []egv1a1.EndpointOverrideExtractFrom{
+										{
+											Header: new("x-custom-host"),
+										},
 									},
 								},
 							},
@@ -3948,16 +4074,18 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:   "/healthz",
-									Method: new("post"),
-									RequestBody: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("ping"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:   "/healthz",
+										Method: new("post"),
+										RequestBody: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("ping"),
+										},
 									},
 								},
 							},
@@ -3980,15 +4108,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
-									RequestBody: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("ping"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+										RequestBody: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("ping"),
+										},
 									},
 								},
 							},
@@ -4011,16 +4141,18 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:   "/healthz",
-									Method: new("get"),
-									RequestBody: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("ping"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:   "/healthz",
+										Method: new("get"),
+										RequestBody: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("ping"),
+										},
 									},
 								},
 							},
@@ -4043,16 +4175,18 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path:   "/healthz",
-									Method: new(""),
-									RequestBody: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("ping"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path:   "/healthz",
+										Method: new(""),
+										RequestBody: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("ping"),
+										},
 									},
 								},
 							},
@@ -4075,15 +4209,17 @@ func TestBackendTrafficPolicyTarget(t *testing.T) {
 							},
 						},
 					},
-					ClusterSettings: egv1a1.ClusterSettings{
-						HealthCheck: &egv1a1.HealthCheck{
-							Active: &egv1a1.ActiveHealthCheck{
-								Type: egv1a1.ActiveHealthCheckerTypeHTTP,
-								HTTP: &egv1a1.HTTPActiveHealthChecker{
-									Path: "/healthz",
-									ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
-										Type: egv1a1.ActiveHealthCheckPayloadTypeText,
-										Text: new("ok"),
+					BackendSettings: egv1a1.BackendSettings{
+						ClusterSettings: egv1a1.ClusterSettings{
+							HealthCheck: &egv1a1.HealthCheck{
+								Active: &egv1a1.ActiveHealthCheck{
+									Type: egv1a1.ActiveHealthCheckerTypeHTTP,
+									HTTP: &egv1a1.HTTPActiveHealthChecker{
+										Path: "/healthz",
+										ExpectedResponse: &egv1a1.ActiveHealthCheckPayload{
+											Type: egv1a1.ActiveHealthCheckPayloadTypeText,
+											Text: new("ok"),
+										},
 									},
 								},
 							},
diff --git a/test/cel-validation/securitypolicy_test.go b/test/cel-validation/securitypolicy_test.go
index c6117a8c15..d4921e0155 100644
--- a/test/cel-validation/securitypolicy_test.go
+++ b/test/cel-validation/securitypolicy_test.go
@@ -1779,7 +1779,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 					OIDC: &egv1a1.OIDC{
 						Provider: egv1a1.OIDCProvider{
 							BackendCluster: egv1a1.BackendCluster{
-								BackendSettings: &egv1a1.ClusterSettings{
+								BackendSettings: &egv1a1.BackendSettings{
 									Retry: &egv1a1.Retry{
 										NumRetries: new(int32(3)),
 										PerRetry: &egv1a1.PerRetryPolicy{
@@ -1827,7 +1827,7 @@ func TestSecurityPolicyTarget(t *testing.T) {
 					OIDC: &egv1a1.OIDC{
 						Provider: egv1a1.OIDCProvider{
 							BackendCluster: egv1a1.BackendCluster{
-								BackendSettings: &egv1a1.ClusterSettings{
+								BackendSettings: &egv1a1.BackendSettings{
 									Retry: &egv1a1.Retry{
 										NumRetries: new(int32(3)),
 										PerRetry: &egv1a1.PerRetryPolicy{