diff --git a/.azure-pipelines/cached.yml b/.azure-pipelines/cached.yml
deleted file mode 100644
index 82a4ec92b0..0000000000
--- a/.azure-pipelines/cached.yml
+++ /dev/null
@@ -1,103 +0,0 @@
-parameters:
-- name: arch
-  type: string
-  default: ""
-- name: version
-  type: string
-  default: $(cacheKeyVersion)
-- name: cacheName
-  type: string
-  default:
-
-- name: keyDocker
-  type: string
-  default: $(cacheKeyDocker)
-- name: keyBazel
-  type: string
-  default: $(cacheKeyBazel)
-
-- name: pathTemp
-  type: string
-  default: $(pathCacheTemp)
-
-- name: tmpfsDisabled
-  type: string
-  default:
-- name: tmpfsDockerDisabled
-  type: string
-  default:
-
-- name: pathDockerBind
-  type: string
-  default: $(pathDockerBind)
-
-- name: cacheTimeoutWorkaround
-  type: number
-  default: 5
-- name: prime
-  type: boolean
-  default: false
-
-
-steps:
-- script: sudo .azure-pipelines/docker/prepare_cache.sh "${{ parameters.pathTemp }}" "${{ parameters.tmpfsDisabled }}"
-  displayName: "Cache/prepare"
-
-- task: Cache@2
-  condition: and(not(canceled()), ne('${{ parameters.cacheName }}', ''))
-  env:
-    VSO_DEDUP_REDIRECT_TIMEOUT_IN_SEC: "${{ parameters.cacheTimeoutWorkaround }}"
-  displayName: "Cache (${{ parameters.cacheName }})"
-  inputs:
-    key: >-
-      ${{ parameters.cacheName }}
-      | "${{ parameters.version }}"
-      | "${{ parameters.arch }}"
-      | ${{ parameters.keyDocker }}
-      | ${{ parameters.keyBazel }}
-    path: "${{ parameters.pathTemp }}/all"
-    cacheHitVar: CACHE_RESTORED
-
-- task: Cache@2
-  condition: and(not(canceled()), not(failed()), or(ne(variables.CACHE_RESTORED, 'true'), eq('${{ parameters.cacheName }}', '')))
-  env:
-    VSO_DEDUP_REDIRECT_TIMEOUT_IN_SEC: "${{ parameters.cacheTimeoutWorkaround }}"
-  displayName: "Cache (Docker)"
-  inputs:
-    key: '"${{ parameters.version }}" | "${{ parameters.arch }}" | ${{ parameters.keyDocker }} | docker'
-    path: "${{ parameters.pathTemp }}/docker"
-    cacheHitVar: DOCKER_CACHE_RESTORED
-
-- task: Cache@2
-  condition: and(not(canceled()), not(failed()), or(ne(variables.CACHE_RESTORED, 'true'), eq('${{ parameters.cacheName }}', '')))
-  env:
-    VSO_DEDUP_REDIRECT_TIMEOUT_IN_SEC: "${{ parameters.cacheTimeoutWorkaround }}"
-  displayName: "Cache (Bazel)"
-  inputs:
-    key: '"${{ parameters.version }}" | "${{ parameters.arch }}" | ${{ parameters.keyBazel }} | bazel'
-    path: "${{ parameters.pathTemp }}/bazel"
-    cacheHitVar: BAZEL_CACHE_RESTORED
-
-# Prime the caches for all jobs
-- script: .azure-pipelines/docker/prime_cache.sh "$(Build.StagingDirectory)" "${{ parameters.pathTemp }}" "${{ parameters.arch }}"
-  env:
-    DOCKER_RESTORED: $(DOCKER_CACHE_RESTORED)
-    BAZEL_RESTORED: $(BAZEL_CACHE_RESTORED)
-  displayName: "Cache/prime (Docker/Bazel)"
-  # TODO(phlax): figure if there is a way to test cache without downloading it
-  condition: >-
-    and(not(canceled()),
-        eq(${{ parameters.prime }}, true),
-        eq('${{ parameters.cacheName }}', ''),
-        or(ne(variables.DOCKER_CACHE_RESTORED, 'true'),
-           ne(variables.BAZEL_CACHE_RESTORED, 'true')))
-
-# Load the caches for a job
-- script: >-
-    sudo .azure-pipelines/docker/load_caches.sh
-    "$(Build.StagingDirectory)"
-    "${{ parameters.pathTemp }}"
-    "${{ parameters.pathDockerBind }}"
-    "${{ parameters.tmpfsDockerDisabled }}"
-  displayName: "Cache/restore"
-  condition: and(not(canceled()), eq(${{ parameters.prime }}, false))
diff --git a/.azure-pipelines/ci.yml b/.azure-pipelines/ci.yml
deleted file mode 100644
index 8f80098026..0000000000
--- a/.azure-pipelines/ci.yml
+++ /dev/null
@@ -1,345 +0,0 @@
-parameters:
-- name: ciTarget
-  displayName: "CI target"
-  type: string
-  default: release
-- name: artifactName
-  displayName: "Artifact name"
-  type: string
-  default: ""
-- name: artifactSuffix
-  displayName: "Suffix of artifact"
-  type: string
-  default: ""
-
-# caching
-- name: cacheKeyDocker
-  type: string
-  default: ".bazelrc"
-- name: cacheKeyVersion
-  type: string
-  default: $(cacheKeyVersion)
-- name: pathCacheTemp
-  type: string
-  default: $(pathCacheTemp)
-- name: cacheName
-  type: string
-  default:
-
-- name: tmpfsCacheDisabled
-  type: string
-  default: ''
-- name: tmpfsDockerDisabled
-  type: string
-  default: ''
-
-- name: bazelConfigRBE
-  type: string
-  default: --config=remote-ci --config=rbe-google --jobs=$(RbeJobs)
-- name: cacheKeyBazel
-  type: string
-  default: $(cacheKeyBazel)
-- name: cacheVersion
-  type: string
-  default: $(cacheKeyVersion)
-
-- name: pathDockerBind
-  type: string
-  default: $(pathDockerBind)
-
-- name: rbe
-  displayName: "Enable RBE"
-  type: boolean
-  default: true
-- name: managedAgent
-  type: boolean
-  default: true
-- name: bazelBuildExtraOptions
-  type: string
-  default: ""
-- name: bazelStartupExtraOptions
-  type: string
-  default: ""
-- name: bazelUseBES
-  displayName: "Upload bazel run data to BES"
-  type: boolean
-  default: true
-- name: cacheTestResults
-  displayName: "Cache test results"
-  type: boolean
-  default: true
-# Unfortunately, AZP is an unmittigated and undocumented disaster.
-# The definition of primitive types is close to pointless, as depending
-# on where things are set, azp just turns them into strings anyway.
-- name: repoFetchDepth
-  type: string
-  default: 1
-- name: repoFetchTags
-  type: string
-  default: false
-# Auth
-- name: authGithub
-  type: string
-  default: ""
-# Publishing
-- name: publishEnvoy
-  type: string
-  default: true
-- name: publishTestResults
-  type: string
-  default: true
-
-- name: diskspaceHack
-  type: boolean
-  default: false
-
-- name: stepsPre
-  type: stepList
-  default: []
-- name: stepsPost
-  type: stepList
-  default: []
-
-- name: env
-  type: object
-  default: {}
-
-steps:
-- checkout: self
-  fetchDepth: ${{ parameters.repoFetchDepth }}
-  fetchTags: ${{ parameters.repoFetchTags }}
-
-- bash: ./.azure-pipelines/cleanup.sh
-  displayName: "Free disk space"
-  condition: and(succeeded(), eq('${{ parameters.diskspaceHack }}', true))
-
-# Set up tmpfs directories for self-hosted agents which have a surplus of mem.
-#
-# NB: Do not add any directory that grow larger than spare memory capacity!
-- bash: |
-    TMPDIRS=(
-        # This is used as the final delivery directory for the binaries
-        "$(Build.StagingDirectory)/envoy"
-        # Bazel repository_cache which is cached by AZP (this speeds up cache load/save)
-        "$(Build.StagingDirectory)/repository_cache"
-        "$(Build.StagingDirectory)/bazel"
-        "$(Build.StagingDirectory)/.cache"
-        "$(Build.StagingDirectory)/bazel_root/install"
-        "$(Build.StagingDirectory)/tmp"
-        "$(Build.StagingDirectory)/bazel_root/base/external")
-    if [[ "${{ parameters.artifactSuffix }}" == ".arm64" ]]; then
-        TMPDIRS+=(
-            "$(Build.StagingDirectory)/bazel_root/base/execroot/envoy/bazel-out/aarch64-fastbuild/testlogs"
-            "$(Build.StagingDirectory)/bazel_root/base/execroot/envoy/bazel-out/aarch64-opt/testlogs")
-    else
-        TMPDIRS+=(
-            "$(Build.StagingDirectory)/bazel_root/base/execroot/envoy/bazel-out/k8-fastbuild/testlogs"
-            "$(Build.StagingDirectory)/bazel_root/base/execroot/envoy/bazel-out/k8-opt/testlogs")
-    fi
-    for tmpdir in "${TMPDIRS[@]}"; do
-        echo "Mount(tmpfs): ${tmpdir}"
-        sudo mkdir -p "$tmpdir"
-        sudo mount -t tmpfs none "$tmpdir"
-        sudo chown azure-pipelines "$tmpdir"
-    done
-    sudo chown -R azure-pipelines:azure-pipelines $(Build.StagingDirectory)/bazel_root/
-  displayName: "Mount/tmpfs bazel directories"
-  condition: and(succeeded(), eq('${{ parameters.managedAgent }}', false), ne('${{ parameters.tmpfsDockerDisabled }}', true))
-
-- bash: |
-    set -e
-    CACHE_DIRS=(
-        "$(Build.StagingDirectory)/envoy"
-        "$(Build.StagingDirectory)/.cache/"
-        "$(Build.StagingDirectory)/bazel_root/install/"
-        "$(Build.StagingDirectory)/repository_cache/"
-        "$(Build.StagingDirectory)/bazel_root/base/external")
-    sudo mkdir -p "${CACHE_DIRS[@]}"
-    if id -u vsts &> /dev/null; then
-        sudo chown -R vsts:vsts "${CACHE_DIRS[@]}" $(Build.StagingDirectory)/bazel_root/
-    else
-        sudo chown -R azure-pipelines:azure-pipelines "${CACHE_DIRS[@]}" $(Build.StagingDirectory)/bazel_root/
-    fi
-    echo "Created bazel directories: "${CACHE_DIRS[*]}""
-  displayName: "Create bazel directories"
-  condition: and(succeeded(), eq('${{ parameters.tmpfsDockerDisabled }}', true))
-
-# Caching
-- template: cached.yml
-  parameters:
-    cacheName: "${{ parameters.cacheName }}"
-    keyBazel: "${{ parameters.cacheKeyBazel }}"
-    keyDocker: "${{ parameters.cacheKeyDocker }}"
-    pathDockerBind: "${{ parameters.pathDockerBind }}"
-    arch: "${{ parameters.artifactSuffix }}"
-    pathTemp: "${{ parameters.pathCacheTemp }}"
-    tmpfsDisabled: "${{ parameters.tmpfsCacheDisabled }}"
-    tmpfsDockerDisabled: "${{ parameters.tmpfsDockerDisabled }}"
-
-- script: |
-    ENVOY_SHARED_TMP_DIR=/tmp/bazel-shared
-    mkdir -p "$ENVOY_SHARED_TMP_DIR"
-    BAZEL_BUILD_EXTRA_OPTIONS="${{ parameters.bazelBuildExtraOptions }}"
-    if [[ "${{ parameters.rbe }}" == "True" ]]; then
-        # mktemp will create a tempfile with u+rw permission minus umask, it will not be readable by all
-        # users by default.
-        GCP_SERVICE_ACCOUNT_KEY_PATH=$(mktemp -p "${ENVOY_SHARED_TMP_DIR}" -t gcp_service_account.XXXXXX.json)
-        bash -c 'echo "$(GcpServiceAccountKey)"' | base64 --decode > "${GCP_SERVICE_ACCOUNT_KEY_PATH}"
-        BAZEL_BUILD_EXTRA_OPTIONS+=" ${{ parameters.bazelConfigRBE }} --google_credentials=${GCP_SERVICE_ACCOUNT_KEY_PATH}"
-        ENVOY_RBE=1
-        if [[ "${{ parameters.bazelUseBES }}" == "True" && -n "${GOOGLE_BES_PROJECT_ID}" ]]; then
-            BAZEL_BUILD_EXTRA_OPTIONS+=" --config=rbe-google-bes --bes_instance_name=${GOOGLE_BES_PROJECT_ID}"
-        fi
-    else
-        echo "using local build cache."
-        # Normalize branches - `release/vX.xx`, `vX.xx`, `vX.xx.x` -> `vX.xx`
-        TARGET_BRANCH=$(echo "${CI_TARGET_BRANCH}" | cut -d/ -f2-)
-        BRANCH_NAME="$(echo "${TARGET_BRANCH}" | cut -d/ -f2 | cut -d. -f-2)"
-        if [[ "$BRANCH_NAME" == "merge" ]]; then
-            # Manually run PR commit - there is no easy way of telling which branch
-            # it is, so just set it to `main` - otherwise it tries to cache as `branch/merge`
-            BRANCH_NAME=main
-        fi
-        BAZEL_REMOTE_INSTANCE="branch/${BRANCH_NAME}"
-        echo "instance_name: ${BAZEL_REMOTE_INSTANCE}."
-        BAZEL_BUILD_EXTRA_OPTIONS+=" --config=ci --config=cache-local --remote_instance_name=${BAZEL_REMOTE_INSTANCE} --remote_timeout=600"
-    fi
-    if [[ "${{ parameters.cacheTestResults }}" != "True" ]]; then
-        VERSION_DEV="$(cut -d- -f2 "VERSION.txt")"
-        # Use uncached test results for non-release scheduledruns.
-        if [[ $VERSION_DEV == "dev" ]]; then
-            BAZEL_EXTRA_TEST_OPTIONS+=" --nocache_test_results"
-        fi
-    fi
-    # Any PR or CI run in envoy-presubmit uses the fake SCM hash
-    if [[ "${{ variables['Build.Reason'] }}" == "PullRequest" || "${{ variables['Build.DefinitionName'] }}" == 'envoy-presubmit' ]]; then
-        # sha1sum of `ENVOY_PULL_REQUEST`
-        BAZEL_FAKE_SCM_REVISION=e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9
-    fi
-    echo "##vso[task.setvariable variable=BAZEL_BUILD_EXTRA_OPTIONS]${BAZEL_BUILD_EXTRA_OPTIONS}"
-    echo "##vso[task.setvariable variable=BAZEL_EXTRA_TEST_OPTIONS]${BAZEL_EXTRA_TEST_OPTIONS}"
-    echo "##vso[task.setvariable variable=BAZEL_FAKE_SCM_REVISION]${BAZEL_FAKE_SCM_REVISION}"
-    echo "##vso[task.setvariable variable=BAZEL_STARTUP_EXTRA_OPTIONS]${{ parameters.bazelStartupExtraOptions }}"
-    echo "##vso[task.setvariable variable=CI_TARGET_BRANCH]${CI_TARGET_BRANCH}"
-    echo "##vso[task.setvariable variable=ENVOY_DOCKER_BUILD_DIR]$(Build.StagingDirectory)"
-    echo "##vso[task.setvariable variable=ENVOY_RBE]${ENVOY_RBE}"
-    echo "##vso[task.setvariable variable=ENVOY_SHARED_TMP_DIR]${ENVOY_SHARED_TMP_DIR}"
-    echo "##vso[task.setvariable variable=GCP_SERVICE_ACCOUNT_KEY_PATH]${GCP_SERVICE_ACCOUNT_KEY_PATH}"
-    echo "##vso[task.setvariable variable=GITHUB_TOKEN]${{ parameters.authGithub }}"
-  workingDirectory: $(Build.SourcesDirectory)
-  env:
-    ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
-      CI_TARGET_BRANCH: "origin/$(System.PullRequest.TargetBranch)"
-    ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
-      CI_TARGET_BRANCH: "origin/$(Build.SourceBranchName)"
-  displayName: "CI env ${{ parameters.ciTarget }}"
-
-- script: ci/run_envoy_docker.sh 'ci/do_ci.sh fetch-${{ parameters.ciTarget }}'
-  condition: and(not(canceled()), not(failed()), ne('${{ parameters.cacheName }}', ''), ne(variables.CACHE_RESTORED, 'true'))
-  workingDirectory: $(Build.SourcesDirectory)
-  env:
-    ${{ each var in parameters.env }}:
-      ${{ var.key }}: ${{ var.value }}
-  displayName: "Fetch assets (${{ parameters.ciTarget }})"
-
-- ${{ each step in parameters.stepsPre }}:
-  - ${{ each pair in step }}:
-      ${{ pair.key }}: ${{ pair.value }}
-
-- bash: |
-    echo "disk space at beginning of build:"
-    df -h
-    if [[ -e "$(Build.StagingDirectory)/bazel_root/base/external" ]]; then
-        du -sh "$(Build.StagingDirectory)/bazel_root/base/external"
-    fi
-    if [[ -e "$(Build.StagingDirectory)/repository_cache" ]]; then
-        du -sh "$(Build.StagingDirectory)/repository_cache"
-    fi
-
-  displayName: "Check disk space at beginning"
-
-- bash: |
-    sudo mkdir -p /etc/docker
-    echo '{
-      "ipv6": true,
-      "fixed-cidr-v6": "2001:db8:1::/64"
-    }' | sudo tee /etc/docker/daemon.json
-    sudo service docker restart
-  displayName: "Enable IPv6"
-  condition: ${{ parameters.managedAgent }}
-
-- script: ci/run_envoy_docker.sh 'ci/do_ci.sh ${{ parameters.ciTarget }}'
-  workingDirectory: $(Build.SourcesDirectory)
-  env:
-    ${{ each var in parameters.env }}:
-      ${{ var.key }}: ${{ var.value }}
-  displayName: "Run CI script ${{ parameters.ciTarget }}"
-
-- bash: |
-    echo "disk space at end of build:"
-    df -h
-
-    for hprof in $(find "$(Build.StagingDirectory)" -name "*heapdump.hprof"); do
-        echo
-        mkdir -p $(Build.StagingDirectory)/envoy/hprof
-        echo "Copying ${hprof}"
-        cp -a $hprof $(Build.StagingDirectory)/envoy/hprof
-    done
-
-    du -sh "$(Build.StagingDirectory)"/bazel_root/base/external
-    du -sh "$(Build.StagingDirectory)"/repository_cache
-
-    cp -a "$(Build.StagingDirectory)/bazel_root/base/server/jvm.out" $(Build.StagingDirectory)/envoy
-
-    if [[ "${{ parameters.artifactSuffix }}" == ".arm64" ]]; then
-        # Dump bazel-remote logging (only required for arm/self-hosted).
-        sudo systemctl status --no-pager bazel-remote > $(Build.StagingDirectory)/envoy/br.status
-        sudo journalctl --no-pager -xu bazel-remote > $(Build.StagingDirectory)/envoy/br.journal
-    fi
-    echo
-    du -ch "$(Build.StagingDirectory)" | grep -E "[0-9]{2,}M|[0-9]G"
-
-    # Cleanup offending files with unicode names
-    rm -rf $(Build.StagingDirectory)/bazel_root/base/external/go_sdk/test/fixedbugs
-  displayName: "Check disk space at end"
-  condition: not(canceled())
-
-- ${{ each step in parameters.stepsPost }}:
-  - ${{ each pair in step }}:
-      ${{ pair.key }}: ${{ pair.value }}
-
-- bash: |
-    if [[ -n "$GCP_SERVICE_ACCOUNT_KEY_PATH" && -e "$GCP_SERVICE_ACCOUNT_KEY_PATH" ]]; then
-        echo "Removed key: ${GCP_SERVICE_ACCOUNT_KEY_PATH}"
-        rm -rf "$GCP_SERVICE_ACCOUNT_KEY_PATH"
-    fi
-  condition: not(canceled())
-
-- script: |
-    set -e
-    sudo .azure-pipelines/docker/save_cache.sh "$(Build.StagingDirectory)" ${{ parameters.pathCacheTemp }}/all true true
-    if id -u vsts &> /dev/null; then
-        sudo chown -R vsts:vsts ${{ parameters.pathCacheTemp }}/all
-    else
-        sudo chown -R azure-pipelines:azure-pipelines ${{ parameters.pathCacheTemp }}/all
-    fi
-  displayName: "Cache/save (${{ parameters.cacheName}})"
-  condition: and(succeeded(), ne('${{ parameters.cacheName }}', ''), ne(variables.CACHE_RESTORED, 'true'))
-
-- task: PublishTestResults@2
-  inputs:
-    publishRunAttachments: false
-    testResultsFiles: "**/bazel-out/**/testlogs/**/test.xml"
-    testRunTitle: "${{ parameters.ciTarget }}"
-    searchFolder: $(Build.StagingDirectory)/bazel_root
-  timeoutInMinutes: 10
-  condition: eq(${{ parameters.publishTestResults }}, 'true')
-- task: PublishBuildArtifacts@1
-  inputs:
-    pathtoPublish: "$(Build.StagingDirectory)/envoy"
-    ${{ if eq(parameters.artifactName, '') }}:
-      artifactName: ${{ parameters.ciTarget }}
-    ${{ if ne(parameters.artifactName, '') }}:
-      artifactName: ${{ parameters.artifactName }}
-  timeoutInMinutes: 10
-  condition: eq(${{ parameters.publishEnvoy }}, 'true')
diff --git a/.azure-pipelines/cleanup.sh b/.azure-pipelines/cleanup.sh
deleted file mode 100755
index 479ee83d15..0000000000
--- a/.azure-pipelines/cleanup.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/bin/bash
-
-set -e
-
-echo "Disk space before cruft removal"
-df -h
-
-TO_REMOVE=(
-    /opt/hostedtoolcache
-    /usr/local/lib/android
-    /usr/local/.ghcup)
-
-for removal in "${TO_REMOVE[@]}"; do
-    echo "Removing: ${removal} ..."
-    sudo rm -rf "$removal"
-done
-
-echo "Disk space after cruft removal"
-df -h
diff --git a/.azure-pipelines/docker/clean_docker.sh b/.azure-pipelines/docker/clean_docker.sh
deleted file mode 100755
index cbad33a4ad..0000000000
--- a/.azure-pipelines/docker/clean_docker.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/bash -e
-
-set -o pipefail
-
-echo "Stopping Docker ..."
-systemctl stop docker
-
-echo "Restarting Docker with empty /var/lib/docker ..."
-mv /var/lib/docker/ /var/lib/docker.old
-mkdir /var/lib/docker
-systemctl start docker
diff --git a/.azure-pipelines/docker/create_cache.sh b/.azure-pipelines/docker/create_cache.sh
deleted file mode 100755
index e9d9f55b07..0000000000
--- a/.azure-pipelines/docker/create_cache.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/bin/bash -e
-
-set -o pipefail
-
-CACHE_TARBALL="${1}"
-ROOT_DIR="${2}"
-shift 2
-
-echo "Exporting ${*} -> ${CACHE_TARBALL}"
-
-CACHE_PATH="$(dirname "$CACHE_TARBALL")"
-mkdir -p "$CACHE_PATH"
-
-CACHE_ARGS=()
-for path in "$@"; do
-    if [[ "$ROOT_DIR" == "." ]]; then
-        total="$(du -sh "$path" | cut -f1)"
-        echo "Adding cache dir (${path}): ${total}"
-        CACHE_ARGS+=(-C "$path" .)
-    else
-        total="$(du -sh "${ROOT_DIR}/$path" | cut -f1)"
-        echo "Adding cache dir (${ROOT_DIR}/${path}): ${total}"
-        CACHE_ARGS+=(-C "$ROOT_DIR" "$path")
-    fi
-done
-
-tar cf - "${CACHE_ARGS[@]}" | zstd - -q -T0 -o "$CACHE_TARBALL"
-echo "Cache tarball created: ${CACHE_TARBALL}"
-ls -lh "$CACHE_TARBALL"
diff --git a/.azure-pipelines/docker/load_caches.sh b/.azure-pipelines/docker/load_caches.sh
deleted file mode 100755
index 73c03425cf..0000000000
--- a/.azure-pipelines/docker/load_caches.sh
+++ /dev/null
@@ -1,100 +0,0 @@
-#!/bin/bash -e
-
-ENVOY_DOCKER_BUILD_DIR="$1"
-CACHE_PATH="$2"
-DOCKER_BIND_PATH="$3"
-DOCKER_NO_TMPFS="$4"
-
-
-if [[ -z "$CACHE_PATH" ]]; then
-    echo "load_caches called without path arg" >&2
-    exit 1
-fi
-
-if [[ -e "${CACHE_PATH}/all" ]]; then
-    DOCKER_CACHE_PATH="${CACHE_PATH}/all"
-    BAZEL_CACHE_PATH="${CACHE_PATH}/all"
-else
-    DOCKER_CACHE_PATH="${CACHE_PATH}/docker"
-    BAZEL_CACHE_PATH="${CACHE_PATH}/bazel"
-fi
-
-DOCKER_CACHE_TARBALL="${DOCKER_CACHE_PATH}/docker.tar.zst"
-BAZEL_CACHE_TARBALL="${BAZEL_CACHE_PATH}/bazel.tar.zst"
-
-
-remount_docker () {
-    echo "Stopping Docker daemon ..."
-    systemctl stop docker docker.socket
-    mv /var/lib/docker/ /var/lib/docker.old
-    mkdir -p /var/lib/docker
-    if id -u vsts &> /dev/null && [[ -n "$DOCKER_BIND_PATH" ]]; then
-        # use separate disk on windows hosted
-        echo "Binding docker directory ${DOCKER_BIND_PATH} -> /var/lib/docker ..."
-        mkdir -p "$DOCKER_BIND_PATH"
-        mount -o bind "$DOCKER_BIND_PATH" /var/lib/docker
-    elif ! id -u vsts &> /dev/null && [[ -z "$DOCKER_NO_TMPFS" ]]; then
-        echo "Mounting tmpfs directory -> /var/lib/docker ..."
-        # Use a ramdisk to load docker (avoids Docker slow start on big disk)
-        mount -t tmpfs none /var/lib/docker
-    else
-        # If we are on a managed/resource-constrained host but the bind path is not set then we need to remove
-        # the old /var/lib/docker to free some space (maybe)
-        DOCKER_REMOVE_EXISTING=1
-    fi
-}
-
-extract_docker () {
-    if [[ -e "${DOCKER_CACHE_TARBALL}" ]]; then
-        echo "Extracting docker cache ${DOCKER_CACHE_TARBALL} -> /var/lib/docker ..."
-        zstd --stdout -d "$DOCKER_CACHE_TARBALL" | tar --warning=no-timestamp -xf - -C /var/lib/docker
-    else
-        echo "No Docker cache to restore, starting Docker with no data"
-    fi
-}
-
-extract_bazel () {
-    if [[ -e "${BAZEL_CACHE_TARBALL}" ]]; then
-        echo "Extracting bazel cache ${BAZEL_CACHE_TARBALL} -> ${ENVOY_DOCKER_BUILD_DIR} ..."
-        zstd --stdout -d "$BAZEL_CACHE_TARBALL" | tar --warning=no-timestamp -xf - -C "${ENVOY_DOCKER_BUILD_DIR}"
-        if id -u vsts &> /dev/null; then
-            sudo chown -R vsts:vsts "${ENVOY_DOCKER_BUILD_DIR}"
-        else
-            sudo chown -R azure-pipelines:azure-pipelines "${ENVOY_DOCKER_BUILD_DIR}"
-        fi
-    else
-        echo "No bazel cache to restore, starting bazel with no data"
-    fi
-}
-
-cleanup_cache () {
-    if mountpoint -q "${CACHE_PATH}"; then
-        echo "Unmount cache tmp ${CACHE_PATH} ..."
-        umount "${CACHE_PATH}"
-    else
-        echo "Remove cache tmp ${CACHE_PATH} ..."
-        rm -rf "${CACHE_PATH}"
-    fi
-
-    # this takes time but may be desirable in some situations
-    if [[ -n "$DOCKER_REMOVE_EXISTING" ]]; then
-        rm -rf /var/lib/docker.old
-    fi
-}
-
-restart_docker () {
-    echo "Starting Docker daemon ..."
-    systemctl start docker
-    docker images
-    mkdir -p "${ENVOY_DOCKER_BUILD_DIR}"
-}
-
-df -h
-
-remount_docker
-extract_bazel
-extract_docker
-restart_docker
-cleanup_cache
-
-df -h
diff --git a/.azure-pipelines/docker/prepare_cache.sh b/.azure-pipelines/docker/prepare_cache.sh
deleted file mode 100755
index ff3a07ffbc..0000000000
--- a/.azure-pipelines/docker/prepare_cache.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash -e
-
-DOCKER_CACHE_PATH="$1"
-NO_MOUNT_TMPFS="${2:-}"
-DOCKER_CACHE_OWNERSHIP="vsts:vsts"
-
-if [[ -z "$DOCKER_CACHE_PATH" ]]; then
-    echo "prepare_docker_cache called without path arg" >&2
-    exit 1
-fi
-
-if ! id -u vsts &> /dev/null; then
-    DOCKER_CACHE_OWNERSHIP=azure-pipelines
-fi
-
-tmpfs_size () {
-    # Make this 2/3 of total memory
-    total_mem="$(grep MemTotal /proc/meminfo  | cut -d' ' -f2- | xargs | cut -d' ' -f1)"
-    bc <<< "$total_mem"*2/3*1024
-}
-
-TMPFS_SIZE="$(tmpfs_size)"
-
-echo "Creating cache directory (${DOCKER_CACHE_PATH}) ..."
-mkdir -p "${DOCKER_CACHE_PATH}"
-if [[ -z "$NO_MOUNT_TMPFS" ]]; then
-    echo "Mount tmpfs directory: ${DOCKER_CACHE_PATH}"
-    mount -o size="$TMPFS_SIZE" -t tmpfs none "$DOCKER_CACHE_PATH"
-fi
-mkdir -p "${DOCKER_CACHE_PATH}/docker"
-mkdir -p "${DOCKER_CACHE_PATH}/bazel"
-chown -R "$DOCKER_CACHE_OWNERSHIP" "${DOCKER_CACHE_PATH}"
diff --git a/.azure-pipelines/docker/prime_cache.sh b/.azure-pipelines/docker/prime_cache.sh
deleted file mode 100755
index 368c9a8aa3..0000000000
--- a/.azure-pipelines/docker/prime_cache.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/bin/bash -e
-
-ENVOY_DOCKER_BUILD_DIR="$1"
-CACHE_PATH="$2"
-CACHE_ARCH="$3"
-
-echo "Docker restored: $DOCKER_RESTORED"
-echo "Bazel restored: $BAZEL_RESTORED"
-
-if [[ -z "$CACHE_PATH" ]]; then
-    echo "prime_docker_cache called without path arg" >&2
-    exit 1
-fi
-
-if [[ "$CACHE_ARCH" == ".arm64" ]]; then
-    CACHE_ARCH=linux/arm64
-else
-    CACHE_ARCH=linux/amd64
-fi
-
-DOCKER_CACHE_TARBALL="${CACHE_PATH}/docker/docker.tar.zst"
-BAZEL_CACHE_TARBALL="${CACHE_PATH}/bazel/bazel.tar.zst"
-BAZEL_PATH=/tmp/envoy-docker-build
-
-echo
-echo "================ Load caches ==================="
-if [[ "$DOCKER_RESTORED" == "true" ]] || [[ "$BAZEL_RESTORED" == "true" ]]; then
-    sudo ./.azure-pipelines/docker/load_caches.sh "$ENVOY_DOCKER_BUILD_DIR" "$CACHE_PATH" "" true
-else
-    sudo ./.azure-pipelines/docker/clean_docker.sh
-    echo "No caches to restore"
-fi
-echo "==================================================="
-echo
-
-echo
-echo "================ Docker fetch ======================"
-if [[ "$DOCKER_RESTORED" != "true" ]]; then
-    echo "Fetching Docker"
-    ./ci/run_envoy_docker.sh uname -a
-    docker images
-else
-    echo "Not fetching Docker as it was restored"
-fi
-echo "==================================================="
-echo
-
-echo
-echo "================ Bazel fetch ======================"
-# Fetch bazel dependencies
-if [[ "$BAZEL_RESTORED" != "true" ]]; then
-    echo "Fetching bazel"
-    ./ci/run_envoy_docker.sh './ci/do_ci.sh fetch'
-else
-    echo "Not fetching bazel as it was restored"
-fi
-echo "==================================================="
-echo
-
-df -h
-
-echo
-echo "================ Save caches ======================"
-# Save the caches -> tarballs
-if [[ "$DOCKER_RESTORED" != "true" ]]; then
-    echo "Stopping docker"
-    sudo systemctl stop docker docker.socket
-    sudo ./.azure-pipelines/docker/create_cache.sh "${DOCKER_CACHE_TARBALL}" . /var/lib/docker
-fi
-
-if [[ "$BAZEL_RESTORED" != "true" ]]; then
-    sudo ./.azure-pipelines/docker/create_cache.sh "${BAZEL_CACHE_TARBALL}" . "${BAZEL_PATH}"
-fi
-sudo chmod o+r -R "${CACHE_PATH}"
-echo "==================================================="
-echo
diff --git a/.azure-pipelines/docker/save_cache.sh b/.azure-pipelines/docker/save_cache.sh
deleted file mode 100755
index f80f28d9f5..0000000000
--- a/.azure-pipelines/docker/save_cache.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/bash -e
-
-set -o pipefail
-ENVOY_DOCKER_BUILD_DIR="$1"
-CACHE_PATH="$2"
-NO_MOUNT_TMPFS="${3:-}"
-CACHE_BAZEL="${4:-}"
-
-if [[ -z "$CACHE_PATH" ]]; then
-    echo "prime_docker_cache called without path arg" >&2
-    exit 1
-fi
-
-DOCKER_CACHE_TARBALL="${CACHE_PATH}/docker.tar.zst"
-BAZEL_CACHE_TARBALL="${CACHE_PATH}/bazel.tar.zst"
-
-docker images
-
-echo "Stopping Docker ..."
-systemctl stop docker docker.socket
-
-echo "Creating directory to save tarball: ${CACHE_PATH}"
-mkdir -p "$CACHE_PATH"
-
-if [[ -z "$NO_MOUNT_TMPFS" ]]; then
-    echo "Mount tmpfs directory: ${CACHE_PATH}"
-    mount -t tmpfs none "$CACHE_PATH"
-fi
-
-./.azure-pipelines/docker/create_cache.sh \
-    "${DOCKER_CACHE_TARBALL}" \
-    . \
-    /var/lib/docker
-
-if [[ "$CACHE_BAZEL" == "true" ]]; then
-    ./.azure-pipelines/docker/create_cache.sh \
-        "${BAZEL_CACHE_TARBALL}" \
-        "${ENVOY_DOCKER_BUILD_DIR}" \
-        .cache \
-        bazel_root/install \
-        bazel_root/base/external \
-        repository_cache
-fi
diff --git a/.azure-pipelines/env.yml b/.azure-pipelines/env.yml
deleted file mode 100644
index 76f58e6b75..0000000000
--- a/.azure-pipelines/env.yml
+++ /dev/null
@@ -1,129 +0,0 @@
-#
-# Note to use the outputs created here - this `stage` must be set as a dependency in the relevant stage
-# eg:
-#
-# stage: mystage
-# dependsOn: ["env"]
-#
-# To use a variable as a condition for a `stage` you can specify it as follows:
-#
-# condition: and(not(canceled()), succeeded(), ne(dependencies.env.outputs['repo.changed.mobileOnly'], 'true'))
-#
-# To use a variable as a condition for a `job` you can specify it as follows:
-#
-# job:
-#   condition: and(not(canceled()), succeeded(), ne(stageDependencies.env.repo.outputs['changed.mobileOnly'], 'true'))
-#
-# NB: Avoid using _inclusive_ lists to trigger CI - eg _dont_ only trigger mobile CI if `mobile/` changed.
-#  Instead use _exclusive_ bools - eg _do_ suppress other CI if only `mobile/` changed
-#
-# Note the difference in name resolution when used in stages and jobs.
-#
-# Note also, other conditions such as `not(canceled())` are not assumed and so need to be added to
-# any conditions explicitly.
-#
-# To use a variable in a `step` you can specify it as follows:
-#
-# stage: my_next_stage
-#   jobs:
-#     job: another_job
-#     variables:
-#       mobileOnly: $[stageDependencies.env.repo.outputs['changed.mobileOnly']]
-#     steps:
-#     - bash: echo $(mobileOnly)
-#
-
-jobs:
-# Warm build image caches
-- job: cache
-  displayName: Cache
-  pool:
-    vmImage: $(agentUbuntu)
-  steps:
-  - template: cached.yml
-    parameters:
-      prime: true
-- job: cache_arm
-  dependsOn: []
-  displayName: Cache (arm64)
-  pool: envoy-arm-small
-  steps:
-  - template: cached.yml
-    parameters:
-      prime: true
-      arch: .arm64
-
-- job: repo
-  dependsOn: []
-  displayName: Repository
-  pool:
-    vmImage: $(agentUbuntu)
-  steps:
-  - checkout: self
-    fetchDepth: 0
-    fetchTags: true
-  - script: ./.azure-pipelines/env/detect-repo-changes.sh
-    displayName: "Detect repo changes"
-    workingDirectory: $(Build.SourcesDirectory)
-    name: changed
-    env:
-      BUILD_REASON: $(Build.Reason)
-      TARGET_BRANCH: $(System.PullRequest.TargetBranch)
-
-  - script: ./.azure-pipelines/env/set-dev-release-envs.sh
-    displayName: Set development/release env
-    workingDirectory: $(Build.SourcesDirectory)
-    name: state
-    env:
-      BUILD_REASON: $(Build.Reason)
-      TARGET_BRANCH: $(System.PullRequest.TargetBranch)
-
-  - script: ./.azure-pipelines/env/decide-what-to-run.sh
-    displayName: "Decide what to run"
-    workingDirectory: $(Build.SourcesDirectory)
-    name: run
-    env:
-      BUILD_REASON: $(Build.Reason)
-
-  - script: ./.azure-pipelines/env/decide-what-to-publish.sh
-    displayName: "Decide what to publish"
-    workingDirectory: $(Build.SourcesDirectory)
-    name: publish
-    env:
-      BUILD_REASON: $(Build.Reason)
-
-  - bash: |
-      set -e
-
-      echo "env.outputs['changed.mobileOnly']: $(changed.mobileOnly)"
-      echo "env.outputs['changed.docsOnly']: $(changed.docsOnly)"
-      echo "env.outputs['changed.examplesOnly']: $(changed.examplesOnly)"
-      echo
-      echo "env.outputs['state.isDev']: $(state.isDev)"
-      echo "env.outputs['state.versionPatch']: $(state.versionPatch)"
-      echo
-      echo "env.outputs['run.build']: $(run.build)"
-      echo "env.outputs['run.checks']: $(run.checks)"
-      echo "env.outputs['run.packaging']: $(run.packaging)"
-      echo "env.outputs['run.releaseTests']: $(run.releaseTests)"
-      echo
-      echo "env.outputs['publish.githubRelease']: $(publish.githubRelease)"
-      echo "env.outputs['publish.dockerhub]: $(publish.dockerhub)"
-
-    displayName: "Print build environment"
-
-- job: test_artifacts
-  dependsOn: []
-  displayName: Test artifacts
-  condition: ne(variables['Build.DefinitionName'], 'envoy-postsubmit')
-  pool:
-    vmImage: $(agentUbuntu)
-  steps:
-  - script: $(Build.SourcesDirectory)/.azure-pipelines/gpg/generate-test-key.sh
-    displayName: "Generate snakeoil GPG key for testing"
-    workingDirectory: $(Build.StagingDirectory)
-  - task: PublishBuildArtifacts@1
-    inputs:
-      pathtoPublish: "$(Build.StagingDirectory)/envoy"
-      artifactName: test.env
-    timeoutInMinutes: 10
diff --git a/.azure-pipelines/env/decide-what-to-publish.sh b/.azure-pipelines/env/decide-what-to-publish.sh
deleted file mode 100755
index ec7bcf1959..0000000000
--- a/.azure-pipelines/env/decide-what-to-publish.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/bin/bash -e
-
-PUBLISH_GITHUB_RELEASE=$RUN_PACKAGING
-PUBLISH_DOCKERHUB=false
-
-if [[ "$ISSTABLEBRANCH" == True && -n "$POSTSUBMIT" && "$NOSYNC" != true ]]; then
-    # main
-    if [[ "$ISMAIN" == True ]]; then
-        # Update the Dockerhub README
-        PUBLISH_DOCKERHUB=true
-    # Not main, and not -dev
-    elif [[ $STATE_ISDEV == false ]]; then
-        if [[ $STATE_VERSIONPATCH -eq 0 ]]; then
-            # A just-forked branch
-            PUBLISH_GITHUB_RELEASE=false
-        fi
-    fi
-fi
-
-# Only run Envoy release CI if explictly set
-if { [[ "$PRESUBMIT" != 'true' ]] && [[ "$POSTSUBMIT" != 'true' ]]; } || [[ $BUILD_REASON == "Schedule" ]]; then
-    PUBLISH_GITHUB_RELEASE=false
-fi
-
-echo "##vso[task.setvariable variable=githubRelease;isoutput=true]${PUBLISH_GITHUB_RELEASE}"
-echo "##vso[task.setvariable variable=dockerhub;isoutput=true]${PUBLISH_DOCKERHUB}"
diff --git a/.azure-pipelines/env/decide-what-to-run.sh b/.azure-pipelines/env/decide-what-to-run.sh
deleted file mode 100755
index c6dee68420..0000000000
--- a/.azure-pipelines/env/decide-what-to-run.sh
+++ /dev/null
@@ -1,36 +0,0 @@
-#!/bin/bash -e
-
-RUN_BUILD=true
-RUN_CHECKS=true
-RUN_DOCKER=true
-RUN_PACKAGING=true
-RUN_RELEASE_TESTS=true
-
-if [[ $CHANGED_MOBILEONLY == true || $CHANGED_DOCSONLY == true ]]; then
-    RUN_BUILD=false
-    RUN_CHECKS=false
-    RUN_DOCKER=false
-    RUN_PACKAGING=false
-fi
-if [[ $CHANGED_EXAMPLESONLY == true ]]; then
-    RUN_CHECKS=false
-fi
-if [[ "$ISSTABLEBRANCH" == True && -n "$POSTSUBMIT" && $STATE_ISDEV == false ]]; then
-    RUN_RELEASE_TESTS=false
-fi
-
-# Run ~everything in postsubmit
-if [[ $BUILD_REASON != "PullRequest" ]]; then
-    echo "##vso[task.setvariable variable=build;isoutput=true]true"
-    echo "##vso[task.setvariable variable=checks;isoutput=true]true"
-    echo "##vso[task.setvariable variable=docker;isoutput=true]true"
-    echo "##vso[task.setvariable variable=packaging;isoutput=true]true"
-    echo "##vso[task.setvariable variable=releaseTests;isoutput=true]${RUN_RELEASE_TESTS}"
-    exit 0
-fi
-
-echo "##vso[task.setvariable variable=build;isoutput=true]${RUN_BUILD}"
-echo "##vso[task.setvariable variable=checks;isoutput=true]${RUN_CHECKS}"
-echo "##vso[task.setvariable variable=docker;isoutput=true]${RUN_DOCKER}"
-echo "##vso[task.setvariable variable=packaging;isoutput=true]${RUN_PACKAGING}"
-echo "##vso[task.setvariable variable=releaseTests;isoutput=true]${RUN_RELEASE_TESTS}"
diff --git a/.azure-pipelines/env/detect-repo-changes.sh b/.azure-pipelines/env/detect-repo-changes.sh
deleted file mode 100755
index b163593ea9..0000000000
--- a/.azure-pipelines/env/detect-repo-changes.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash -e
-
-# Only exclude checks in pull requests.
-if [[ $BUILD_REASON != "PullRequest" ]]; then
-    echo "##vso[task.setvariable variable=mobileOnly;isoutput=true]false"
-    echo "##vso[task.setvariable variable=docsOnly;isoutput=true]false"
-    echo "##vso[task.setvariable variable=examplesOnly;isoutput=true]false"
-    echo "##vso[task.setvariable variable=requirements;isoutput=true]true"
-    exit 0
-fi
-
-CHANGE_TARGET="origin/$TARGET_BRANCH"
-
-echo "Comparing changes ${CHANGE_TARGET}...HEAD"
-CHANGED_PATHS=$(git diff --name-only "${CHANGE_TARGET}"...HEAD | cut -d/ -f1 | sort -u | jq -sR 'rtrimstr("\n") | split("\n")')
-echo "$CHANGED_PATHS" | jq '.'
-CHANGED_PATH_COUNT=$(echo "$CHANGED_PATHS" | jq '. | length')
-CHANGED_MOBILE_ONLY=false
-CHANGED_DOCS_ONLY=false
-CHANGED_EXAMPLES_ONLY=false
-
-CHANGED_MOBILE=$(echo "$CHANGED_PATHS" | jq '. as $A | "mobile" | IN($A[])')
-if [[ $CHANGED_MOBILE == true && $CHANGED_PATH_COUNT -eq 1 ]]; then
-    CHANGED_MOBILE_ONLY=true
-fi
-CHANGED_DOCS=$(echo "$CHANGED_PATHS" | jq '. as $A | "docs" | IN($A[])')
-if [[ $CHANGED_DOCS == true && $CHANGED_PATH_COUNT -eq 1 ]]; then
-    CHANGED_DOCS_ONLY=true
-fi
-CHANGED_EXAMPLES=$(echo "$CHANGED_PATHS" | jq '. as $A | "examples" | IN($A[])')
-if [[ $CHANGED_EXAMPLES == true && $CHANGED_PATH_COUNT -eq 1 ]]; then
-    CHANGED_EXAMPLES_ONLY=true
-fi
-
-echo "##vso[task.setvariable variable=mobileOnly;isoutput=true]${CHANGED_MOBILE_ONLY}"
-echo "##vso[task.setvariable variable=docsOnly;isoutput=true]${CHANGED_DOCS_ONLY}"
-echo "##vso[task.setvariable variable=examplesOnly;isoutput=true]${CHANGED_EXAMPLES_ONLY}"
diff --git a/.azure-pipelines/env/set-dev-release-envs.sh b/.azure-pipelines/env/set-dev-release-envs.sh
deleted file mode 100755
index 56f8324d45..0000000000
--- a/.azure-pipelines/env/set-dev-release-envs.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/bin/bash -e
-
-VERSION_DEV=$(cut -d- -f2 VERSION.txt)
-VERSION_PATCH=$(cut -d- -f1 VERSION.txt | rev | cut -d. -f1 | rev)
-echo "##vso[task.setvariable variable=versionPatch;isoutput=true]$VERSION_PATCH"
-if [[ $VERSION_DEV == "dev" ]]; then
-    echo "##vso[task.setvariable variable=isDev;isoutput=true]true"
-else
-    if [[ $BUILD_REASON == "PullRequest" ]]; then
-        # Check to make sure that it was this PR that changed the version, otherwise fail
-        # as the branch needs to be reopened first.
-        # NB: this will not stop a PR that has already passed checks from being landed.
-        DIFF_TARGET_BRANCH="origin/$TARGET_BRANCH"
-        DIFF_REF=$(git merge-base HEAD "${DIFF_TARGET_BRANCH}")
-        CHANGES=$(git diff "$DIFF_REF" HEAD VERSION.txt)
-        if [[ -z "$CHANGES" ]]; then
-            echo "VERSION.txt is not a development version. Please re-open the branch before making further changes" >&2
-            exit 1
-        fi
-    fi
-    echo "##vso[task.setvariable variable=isDev;isoutput=true]false"
-fi
diff --git a/.azure-pipelines/gpg.yml b/.azure-pipelines/gpg.yml
deleted file mode 100644
index fd2f6465bc..0000000000
--- a/.azure-pipelines/gpg.yml
+++ /dev/null
@@ -1,79 +0,0 @@
-parameters:
-- name: nameDownloadTask
-  type: string
-  default: MaintainerGPGKey
-- name: downloadKey
-  type: boolean
-  default: true
-
-# Auth
-- name: authGPGPassphrase
-  type: string
-  default: ""
-- name: authGPGPath
-  type: string
-  default: ""
-- name: authGPGKey
-  type: string
-  default: ""
-
-## Paths
-# The configured GNUPGHOME.
-# This is used to set the path to the password file
-# and should point to the GPG homedir at the point of use,
-# ie inside the Docker container (/build/.gnupg)
-- name: pathGPGConfiguredHome
-  type: string
-  default: ""
-# The created GNUPGHOME
-# This is where the GPG homedir will actually be created, and should point to
-# the path on the host (ie /tmp/envoy-docker-build/.gnupg)
-- name: pathGPGHome
-  type: string
-  default: ""
-
-# All steps should include this condition
-- name: condition
-  type: string
-  default: eq('true', 'true')
-
-
-steps:
-# Secure key - postsubmit
-- task: DownloadSecureFile@1
-  name: ${{ parameters.nameDownloadTask }}
-  displayName: 'Download maintainer GPG key'
-  condition: |
-    and(succeeded(),
-        ${{ parameters.condition }},
-        eq(${{ parameters.downloadKey }}, true),
-        eq(variables['Build.DefinitionName'], 'envoy-postsubmit'))
-  inputs:
-    # NB: This is the path to the key and **must** be set on a per-pipeline basis
-    secureFile: '${{ parameters.authGPGKey }}'
-
-# Snakeoil key - non-postsubmit
-- task: DownloadBuildArtifacts@0
-  displayName: 'Download snakeoil GPG key'
-  inputs:
-    buildType: current
-    artifactName: "test.env"
-    itemPattern: "test.env/ci.snakeoil.gpg.key"
-    targetPath: $(Build.StagingDirectory)
-  condition: |
-    and(succeeded(),
-        ${{ parameters.condition }},
-        eq(${{ parameters.downloadKey }}, true),
-        ne(variables['Build.DefinitionName'], 'envoy-postsubmit'))
-
-- script: $(Build.SourcesDirectory)/.azure-pipelines/gpg/activate-key.sh
-  displayName: "Import and activate GPG key"
-  condition: |
-    and(succeeded(),
-        ${{ parameters.condition }})
-  env:
-    GPG_PASSPHRASE: ${{ parameters.authGPGPassphrase }}
-    GPG_KEYFILE: ${{ parameters.authGPGPath }}
-    GNUPGHOME_CONFIGURED: ${{ parameters.pathGPGConfiguredHome }}
-    GNUPGHOME: ${{ parameters.pathGPGHome }}
-  workingDirectory: $(Build.StagingDirectory)
diff --git a/.azure-pipelines/gpg/activate-key.sh b/.azure-pipelines/gpg/activate-key.sh
deleted file mode 100755
index 4f48ce6e54..0000000000
--- a/.azure-pipelines/gpg/activate-key.sh
+++ /dev/null
@@ -1,64 +0,0 @@
-#!/bin/bash -eu
-
-set -o pipefail
-
-# The key configured here can either be the snakeoil key created
-# in CI, or in PostSubmit its the actual maintainer key downloaded
-# from an azp SecureFile
-
-# If the intended destination of the `.gnupg` file is not the same
-# as where it is configured (ie configuring on the host for use in a
-# container), GNUPGHOME_CONFIGURED can be set pointing to where `.gnupg`
-# will be.
-
-GNUPGHOME="${GNUPGHOME:-${HOME}/.gnupg}"
-GPG_PASSPHRASE="${GPG_PASSPHRASE:-HACKME}"
-GPG_KEYFILE="${GPG_KEYFILE:-test.env/ci.snakeoil.gpg.key}"
-
-# In the case of non-PostSubmit AZP leaves the `secureFilePath` variable
-# uniterpolated, so matching here is matching that its not set.
-#
-# shellcheck disable=SC2016
-if [[ "$GPG_KEYFILE" == '$(MaintainerGPGKey.secureFilePath)' ]]; then
-    GPG_PASSPHRASE=HACKME
-    GPG_KEYFILE="test.env/ci.snakeoil.gpg.key"
-fi
-
-# The configured home, may be different if the configuration
-# is to be used inside a container or different env to the one
-# in which the configuration is created.
-if [[ -z "$GNUPGHOME_CONFIGURED" ]]; then
-    GNUPGHOME_CONFIGURED="$GNUPGHOME"
-fi
-
-if [[ ! -e "$GNUPGHOME" ]]; then
-    mkdir -p "$GNUPGHOME"
-    chmod 700 "${GNUPGHOME}"
-fi
-
-# Reload the gpg-agent
-eval "$(gpg-agent --daemon --allow-loopback-pinentry)"
-
-# Load the key
-echo "$GPG_PASSPHRASE" | gpg --batch --yes --passphrase-fd 0 --import "$GPG_KEYFILE"
-
-# Set the passphrase in a file
-echo "$GPG_PASSPHRASE"  > "${GNUPGHOME}/gpg-passphrase"
-chmod 600 "${GNUPGHOME}/gpg-passphrase"
-
-# Configure gpg to use the file - not the configured path may be different
-{
-    echo "use-agent"
-    echo "pinentry-mode loopback"
-    echo "passphrase-file ${GNUPGHOME_CONFIGURED}/gpg-passphrase"
-} >> "$GNUPGHOME/gpg.conf"
-
-# Configure gpg-agent
-echo "allow-loopback-pinentry" >> "$GNUPGHOME/gpg-agent.conf"
-echo RELOADAGENT | gpg-connect-agent
-
-if [[ "$GNUPGHOME" != "$GNUPGHOME_CONFIGURED" ]]; then
-    echo "GPG configured in ${GNUPGHOME} for ${GNUPGHOME_CONFIGURED}"
-else
-    echo "GPG configured in ${GNUPGHOME}"
-fi
diff --git a/.azure-pipelines/gpg/generate-test-key.sh b/.azure-pipelines/gpg/generate-test-key.sh
deleted file mode 100755
index f473e5fc13..0000000000
--- a/.azure-pipelines/gpg/generate-test-key.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/bin/bash -e
-
-gpg --batch --gen-key <<EOF
-%echo Generating a basic OpenPGP key
-Key-Type: 1
-Key-Length: 4096
-Subkey-Type: 1
-Subkey-Length: 4096
-Name-Real: Envoy CI
-Name-Email: envoy-ci@for.testing.only
-Expire-Date: 0
-Passphrase: HACKME
-%commit
-%echo done
-EOF
-mkdir -p envoy/
-echo "HACKME" \
-    | gpg --pinentry-mode loopback \
-          --passphrase-fd 0 \
-          --export-secret-key -a "Envoy CI" \
-          > envoy/ci.snakeoil.gpg.key
diff --git a/.azure-pipelines/pipelines.yml b/.azure-pipelines/pipelines.yml
deleted file mode 100644
index c3b706ff1c..0000000000
--- a/.azure-pipelines/pipelines.yml
+++ /dev/null
@@ -1,97 +0,0 @@
-trigger:
-  branches:
-    include:
-    - "main"
-    - "release/v*"
-
-
-# PR build config is manually overridden in Azure pipelines UI with different secrets
-pr: none
-
-
-variables:
-- name: agentUbuntu
-  value: ubuntu-22.04
-
-- name: isDev
-  # This must be checked/set in a `step` from the VERSION.txt file, in order to be useful
-  value: true
-- name: isMain
-  value: $[eq(variables['Build.SourceBranch'], 'refs/heads/main')]
-- name: isReleaseBranch
-  value: $[startsWith(variables['Build.SourceBranch'], 'refs/heads/release/v')]
-- name: isTaggedRelease
-  value: $[startsWith(variables['Build.SourceBranch'], 'refs/tags/v')]
-- name: isStableBranch
-  # A release branch can be either `main` or a `release/v1.x` stable branch
-  value: $[or(eq(variables['isMain'], 'true'), eq(variables['isReleaseBranch'], 'true'))]
-
-## CI runs
-# Any scheduled run
-- name: pipelineScheduled
-  value: ${{ eq(variables['Build.Reason'], 'Schedule') }}
-# Non-scheduled postsubmit run
-- name: pipelinePostsubmit
-  value: ${{ and(eq(variables['Build.DefinitionName'], 'envoy-postsubmit'), ne(variables.pipelineScheduled, true)) }}
-- name: pipelineCacheWarm
-  value: ${{ and(eq(variables['Build.DefinitionName'], 'envoy-presubmit'), ne(variables['Build.Reason'], 'PullRequest')) }}
-# Any other run (ie PRs)
-- name: pipelineDefault
-  value: ${{ and(ne(variables.pipelineScheduled, true), ne(variables.pipelinePostsubmit, true), ne(variables.pipelineCacheWarm, true)) }}
-
-## Variable settings
-# Caches (tip: append a version suffix while testing caches)
-- name: cacheKeyVersion
-  value: v3
-- name: cacheKeyBazel
-  value: '.bazelversion | ./WORKSPACE | **/*.bzl, !mobile/**, !envoy-docs/**'
-- name: cacheKeyDocker
-  value: ".bazelrc"
-
-- name: pathCacheTemp
-  value: /mnt/cache
-- name: pathDockerBind
-  value: /mnt/docker
-
-- name: authGithubSSHKeyPublic
-  value: >-
-    github.com ssh-rsa
-    AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/
-    C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY
-    7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B
-    381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1v
-    N1/wsjk="
-
-
-stages:
-
-# Presubmit/default
-- ${{ if eq(variables.pipelineDefault, true) }}:
-  - template: stages.yml
-
-# Scheduled run anywhere
-- ${{ if eq(variables.pipelineScheduled, true) }}:
-  - template: stages.yml
-    parameters:
-      cacheTestResults: false
-
-# Cache warming in presubmit
-- ${{ if eq(variables.pipelineCacheWarm, true) }}:
-  - template: stages.yml
-    parameters:
-      buildStageDeps:
-      - env
-      checkStageDeps:
-      - env
-
-# Postsubmit main/release branches
-- ${{ if eq(variables.pipelinePostsubmit, true) }}:
-  - template: stages.yml
-    parameters:
-      # Build/publish can take longer in postsubmit, esp during release
-      timeoutDockerBuild: 720
-      timeoutDockerPublish: 30
-      buildStageDeps:
-      - env
-      checkStageDeps:
-      - env
diff --git a/.azure-pipelines/stage/checks.yml b/.azure-pipelines/stage/checks.yml
deleted file mode 100644
index c5d7e22f58..0000000000
--- a/.azure-pipelines/stage/checks.yml
+++ /dev/null
@@ -1,120 +0,0 @@
-parameters:
-- name: bucketGCP
-  type: string
-  default: ""
-- name: cacheTestResults
-  displayName: "Cache test results"
-  type: boolean
-  default: true
-- name: concurrencyChecks
-  displayName: "Checks concurrency"
-  type: number
-  default: 10
-
-# Auth
-- name: authGithub
-  type: string
-  default: ""
-- name: authGCP
-  type: string
-  default: ""
-
-- name: runChecks
-  displayName: "Run checks"
-  type: string
-  default: true
-
-
-jobs:
-- job: bazel
-  displayName: "Linux x64"
-  dependsOn: []
-  condition: |
-    and(not(canceled()),
-        eq(${{ parameters.runChecks }}, 'true'))
-  variables:
-    REPO_FETCH_DEPTH: 1
-    REPO_FETCH_TAGS: false
-    PUBLISH_TEST_RESULTS: true
-    PUBLISH_ENVOY: true
-  strategy:
-    maxParallel: ${{ parameters.concurrencyChecks }}
-    matrix:
-      # These are ordered by most time-consuming first.
-      coverage:
-        CI_TARGET: "coverage"
-      fuzz_coverage:
-        CI_TARGET: "fuzz_coverage"
-      compile_time_options:
-        CI_TARGET: "compile_time_options"
-      tsan:
-        CI_TARGET: "tsan"
-      asan:
-        CI_TARGET: "asan"
-      # Disabled due to https://github.com/envoyproxy/envoy/pull/18218
-      # api_compat:
-      #  CI_TARGET: "api_compat"
-      gcc:
-        CI_TARGET: "gcc"
-      msan:
-        CI_TARGET: "msan"
-      #
-      # Temporarily disabled to facilitate release CI, should be resolved
-      #    as part of https://github.com/envoyproxy/envoy/issues/28566
-      #
-      # clang_tidy:
-      #   CI_TARGET: "clang_tidy"
-      #   REPO_FETCH_DEPTH: 0
-      #   REPO_FETCH_TAGS: true
-      #   PUBLISH_TEST_RESULTS: false
-      #   PUBLISH_ENVOY: false
-      api:
-        CI_TARGET: "api"
-  timeoutInMinutes: 180
-  pool:
-    vmImage: $(agentUbuntu)
-  steps:
-  - template: ../ci.yml
-    parameters:
-      ciTarget: $(CI_TARGET)
-      cacheName: $(CI_TARGET)
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      diskspaceHack: true
-      managedAgent: false
-      repoFetchDepth: $(REPO_FETCH_DEPTH)
-      repoFetchTags: $(REPO_FETCH_TAGS)
-      pathCacheTemp: /tmp/cache
-      publishTestResults: variables.PUBLISH_TEST_RESULTS
-      publishEnvoy: variables.PUBLISH_ENVOY
-      tmpfsDockerDisabled: true
-      stepsPost:
-      # TODO(phlax): consolidate "fix" paths/jobs
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/tmp/lint-fixes"
-          artifactName: "$(CI_TARGET).fixes"
-        timeoutInMinutes: 10
-        condition: and(failed(), eq(variables['CI_TARGET'], 'clang_tidy'))
-      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh $(CI_TARGET)-upload'
-        displayName: "Upload $(CI_TARGET) Report to GCS"
-        condition: and(not(canceled()), or(eq(variables['CI_TARGET'], 'coverage'), eq(variables['CI_TARGET'], 'fuzz_coverage')))
-        env:
-          GCS_ARTIFACT_BUCKET: ${{ parameters.bucketGCP }}
-
-- job: complete
-  displayName: "Checks complete"
-  dependsOn: ["bazel"]
-  pool:
-    vmImage: $(agentUbuntu)
-  # This condition ensures that this (required) check passes if all of
-  # the preceding checks either pass or are skipped
-  # adapted from:
-  #  https://learn.microsoft.com/en-us/azure/devops/pipelines/process/expressions?view=azure-devops#job-to-job-dependencies-within-one-stage
-  condition: |
-    and(
-      eq(variables['Build.Reason'], 'PullRequest'),
-      in(dependencies.bazel.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'))
-  steps:
-  - checkout: none
-  - bash: |
-      echo "checks complete"
diff --git a/.azure-pipelines/stage/prechecks.yml b/.azure-pipelines/stage/prechecks.yml
deleted file mode 100644
index 04bb832c8f..0000000000
--- a/.azure-pipelines/stage/prechecks.yml
+++ /dev/null
@@ -1,283 +0,0 @@
-parameters:
-- name: bucketGCP
-  type: string
-  default: ""
-- name: concurrencyPrechecks
-  displayName: "Prechecks concurrency"
-  type: number
-  default: 10
-- name: cacheTestResults
-  displayName: "Cache test results"
-  type: boolean
-  default: true
-
-# Auth
-- name: authGCP
-  type: string
-  default: ""
-- name: authGithubWorkflow
-  type: string
-  default: ""
-- name: authGithubWorkflowAppId
-  type: string
-  default: ""
-- name: authGithubWorkflowInstallId
-  type: string
-  default: ""
-- name: authGPGPassphrase
-  type: string
-  default: ""
-- name: authGPGPath
-  type: string
-  default: ""
-- name: authGPGKey
-  type: string
-  default: ""
-
-- name: runBuild
-  displayName: "Run build"
-  type: string
-  default: true
-- name: runPrechecks
-  displayName: "Run prechecks"
-  type: string
-  default: true
-
-- name: publishGithubRelease
-  displayName: "Publish Github release"
-  type: string
-  default: false
-
-# Timeout/s
-- name: timeoutPrechecks
-  type: number
-  # Building the rst from protos can take a while even with RBE if there is
-  # a lot of change - eg protobuf changed, or a primitve proto changed.
-  default: 40
-
-- name: bazelConfigRBE
-  type: string
-  default: --config=remote-ci --config=rbe-google --jobs=$(RbeJobs)
-
-
-jobs:
-- job: prechecks
-  displayName: Precheck
-  timeoutInMinutes: ${{ parameters.timeoutPrechecks }}
-  condition: |
-    and(not(canceled()),
-        eq(${{ parameters.runPrechecks }}, 'true'))
-  pool:
-    vmImage: $(agentUbuntu)
-  variables:
-    CI_TARGET: ""
-  strategy:
-    maxParallel: ${{ parameters.concurrencyPrechecks }}
-    matrix:
-      format:
-        CI_TARGET: "format"
-        CI_CACHE: format
-      protobuf:
-        CI_TARGET: "check_and_fix_proto_format"
-        CI_CACHE: check_and_fix_proto_format
-      ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
-        publishing:
-          CI_TARGET: docs
-          CI_CACHE: docs
-
-  steps:
-  - template: ../ci.yml
-    parameters:
-      bazelBuildExtraOptions: --config=docs-ci
-      ciTarget: $(CI_TARGET)
-      cacheName: $(CI_CACHE)
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      cacheVersion: $(cacheKeyBazel)
-      publishEnvoy: false
-      publishTestResults: false
-      stepsPre:
-      ## Ensure we can sign things
-      # Signing on the host
-      - template: ../gpg.yml
-        parameters:
-          condition: and(not(canceled()), eq(variables['CI_TARGET'], 'docs'))
-          authGPGPassphrase: ${{ parameters.authGPGPassphrase }}
-          authGPGPath: ${{ parameters.authGPGPath }}
-          authGPGKey: ${{ parameters.authGPGKey }}
-      - bash: |
-          set -e
-          echo AUTHORITY > /tmp/authority
-          gpg --clearsign /tmp/authority
-          cat /tmp/authority.asc
-          gpg --verify /tmp/authority.asc
-          rm -rf ~/.gnupg
-        displayName: "Ensure host CI can sign with GPG"
-        condition: and(not(canceled()), eq(variables['CI_TARGET'], 'docs'))
-
-      # Signing in the Docker container
-      - template: ../gpg.yml
-        parameters:
-          condition: and(not(canceled()), eq(variables['CI_TARGET'], 'docs'))
-          # Reuse key downloaded above
-          downloadKey: false
-          nameDownloadTask: MaintainerGPGKey2
-          authGPGPassphrase: ${{ parameters.authGPGPassphrase }}
-          authGPGPath: ${{ parameters.authGPGPath }}
-          authGPGKey: ${{ parameters.authGPGKey }}
-          # GNUPGHOME inside the container
-          pathGPGConfiguredHome: /build/.gnupg
-          pathGPGHome: $(Build.StagingDirectory)/.gnupg
-      - bash: |
-          set -e
-          ci/run_envoy_docker.sh "
-              echo AUTHORITY > /tmp/authority \
-              && gpg --clearsign /tmp/authority \
-              && cat /tmp/authority.asc \
-              && gpg --verify /tmp/authority.asc"
-          rm -rf $(Build.StagingDirectory)/.gnupg
-        displayName: "Ensure container CI can sign with GPG"
-        condition: and(not(canceled()), eq(variables['CI_TARGET'], 'docs'))
-
-      # Docker regression tests
-      - script: |
-          DOCKER_CI_FIX_DIFF=$(Build.StagingDirectory)/fix_docker.diff DOCKER_CI_FIX=1 ci/test_docker_ci.sh
-        workingDirectory: $(Build.SourcesDirectory)
-        displayName: Docker build regression test
-        condition: eq(variables['CI_TARGET'], 'docs')
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/fix_docker.diff"
-          artifactName: "docker_ci"
-        timeoutInMinutes: 10
-        condition: and(failed(), eq(variables['CI_TARGET'], 'docs'))
-
-      # Dockerhub readme publishing
-      - script: |
-          ci/run_envoy_docker.sh 'ci/do_ci.sh dockerhub-readme'
-        displayName: "Dockerhub publishing test"
-        env:
-          GCS_ARTIFACT_BUCKET: ${{ parameters.bucketGCP }}
-        condition: eq(variables['CI_TARGET'], 'docs')
-
-      stepsPost:
-
-      # Format fixes
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/fix_format.diff"
-          artifactName: format
-        timeoutInMinutes: 10
-        # not all have fixes so improve condition/handling
-        condition: and(failed(), eq(variables['CI_TARGET'], 'format'))
-      # Protobuf fixes
-      - task: PublishBuildArtifacts@1
-        inputs:
-          pathtoPublish: "$(Build.StagingDirectory)/fix_proto_format.diff"
-          artifactName: format
-        timeoutInMinutes: 10
-        condition: and(failed(), eq(variables['CI_TARGET'], 'check_and_fix_proto_format'))
-
-      # Publish docs
-      - script: ci/run_envoy_docker.sh 'ci/do_ci.sh docs-upload'
-        displayName: "Upload Docs to GCS"
-        env:
-          GCS_ARTIFACT_BUCKET: ${{ parameters.bucketGCP }}
-        condition: eq(variables['CI_TARGET'], 'docs')
-
-- job: precheck_release_x64
-  displayName: Precheck release (x64)
-  condition: |
-    and(not(canceled()),
-        eq(${{ parameters.runBuild }}, 'true'))
-  timeoutInMinutes: 180
-  pool: envoy-x64-large
-  steps:
-  - template: ../ci.yml
-    parameters:
-      artifactName: release
-      ciTarget: release.test_only
-      cacheName: release-test-only
-      bazelConfigRBE: ${{ parameters.bazelConfigRBE }}
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      cacheVersion: $(cacheKeyBazel)
-      rbe: true
-
-- job: precheck_release_arm64
-  displayName: Precheck release (arm64)
-  condition: |
-    and(not(canceled()),
-        eq(${{ parameters.runBuild }}, 'true'))
-  timeoutInMinutes: 180
-  pool: envoy-arm-large
-  steps:
-  - template: ../ci.yml
-    parameters:
-      artifactName: release
-      ciTarget: release.test_only
-      cacheName: release-test-only
-      bazelConfigRBE: ${{ parameters.bazelConfigRBE }}
-      bazelBuildExtraOptions: "--sandbox_base=/tmp/sandbox_base"
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      cacheVersion: $(cacheKeyBazel)
-      artifactSuffix: .arm64
-      rbe: false
-
-- job: prechecked
-  displayName: Prechecked
-  dependsOn: ["prechecks", "precheck_release_arm64", "precheck_release_x64"]
-  pool:
-    vmImage: $(agentUbuntu)
-  # This condition ensures that this (required) job passes if all of
-  # the preceeding jobs either pass or are skipped
-  # adapted from:
-  #  https://learn.microsoft.com/en-us/azure/devops/pipelines/process/expressions?view=azure-devops#job-to-job-dependencies-within-one-stage
-  condition: |
-    and(
-      in(dependencies.prechecks.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.precheck_release_x64.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.precheck_release_arm64.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'))
-  steps:
-  - task: DownloadSecureFile@1
-    name: WorkflowTriggerKey
-    displayName: 'Download workflow trigger key'
-    inputs:
-      secureFile: '${{ parameters.authGithubWorkflow }}'
-  - bash: |
-      set -e
-      KEY="$(cat $(WorkflowTriggerKey.secureFilePath) | base64 -w0)"
-      echo "##vso[task.setvariable variable=value;isoutput=true]$KEY"
-    name: key
-  - template: ../ci.yml
-    parameters:
-      ciTarget: verify.trigger
-      cacheName: verify-trigger
-      authGithub: "$(key.value)"
-      cacheVersion: $(cacheKeyBazel)
-      publishEnvoy: false
-      publishTestResults: false
-      env:
-        ENVOY_REPO: $(Build.Repository.Name)
-        ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
-          ENVOY_HEAD_REF: "$(Build.SourceBranch)"
-          ENVOY_BRANCH: "$(System.PullRequest.TargetBranch)"
-          ENVOY_COMMIT: "$(System.PullRequest.SourceCommitId)"
-        ${{ if ne(variables['Build.Reason'], 'PullRequest') }}:
-          ENVOY_HEAD_REF: "$(Build.SourceBranchName)"
-          ENVOY_BRANCH: "$(Build.SourceBranch)"
-        # github auth
-        GITHUB_APP_ID: ${{ parameters.authGithubWorkflowAppId }}
-        GITHUB_INSTALL_ID: ${{ parameters.authGithubWorkflowInstallId }}
-        # rbe env
-        GCS_ARTIFACT_BUCKET: ${{ parameters.bucketGCP }}
-      stepsPre:
-      - bash: |
-          set -e
-          if [[ "$BUILD_REASON" == "PullRequest" ]]; then
-              DOWNLOAD_PATH="$(git rev-parse HEAD | head -c7)"
-          else
-              DOWNLOAD_PATH="${SYSTEM_PULLREQUEST_PULLREQUESTNUMBER:-${BUILD_SOURCEBRANCHNAME}}"
-          fi
-          curl -sLO "https://storage.googleapis.com/${{ parameters.bucketGCP }}/${DOWNLOAD_PATH}/release/release.signed.tar.zst"
-          mkdir -p $(Build.StagingDirectory)/release.signed
-          mv release.signed.tar.zst $(Build.StagingDirectory)/release.signed
-        displayName: Fetch signed release
diff --git a/.azure-pipelines/stages.yml b/.azure-pipelines/stages.yml
deleted file mode 100644
index 9a97067cc7..0000000000
--- a/.azure-pipelines/stages.yml
+++ /dev/null
@@ -1,82 +0,0 @@
-parameters:
-## Build stages
-# NB: all stages _must_ depend on `env`
-- name: buildStageDeps
-  displayName: "Build stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
-- name: checkStageDeps
-  displayName: "Check stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
-- name: concurrencyChecks
-  displayName: "Check concurrency"
-  type: number
-  default: 10
-- name: concurrencyPrechecks
-  displayName: "Prechecks concurrency"
-  type: number
-  default: 10
-
-## Timeouts
-- name: timeoutDockerPublish
-  displayName: "Timout Docker publish"
-  type: number
-  default: 10
-- name: timeoutDockerBuild
-  displayName: "Timout Docker build"
-  type: number
-  default: 400
-
-## Build settings
-- name: cacheTestResults
-  displayName: "Cache test results"
-  type: boolean
-  default: true
-
-stages:
-- stage: env
-  displayName: Environment
-  jobs:
-  - template: env.yml
-
-- stage: prechecks
-  displayName: Prechecks
-  dependsOn: ["env"]
-  variables:
-    PUBLISH_GITHUB_RELEASE: $[stageDependencies.env.repo.outputs['publish.githubRelease']]
-  jobs:
-  - template: stage/prechecks.yml
-    parameters:
-      concurrencyPrechecks: ${{ parameters.concurrencyPrechecks }}
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      authGCP: $(GcpServiceAccountKey)
-      authGithubWorkflow: $(GitHubPublicRepoWorkflowKey)
-      authGithubWorkflowAppId: $(GitHubPublicRepoWorkflowAppId)
-      authGithubWorkflowInstallId: $(GitHubPublicRepoWorkflowInstallId)
-      authGPGPassphrase: $(MaintainerGPGKeyPassphrase)
-      authGPGKey: $(MaintainerGPGKeySecureFileDownloadPath)
-      authGPGPath: $(MaintainerGPGKey.secureFilePath)
-      bucketGCP: $(GcsArtifactBucket)
-      publishGithubRelease: variables['PUBLISH_GITHUB_RELEASE']
-      runBuild: stageDependencies.env.repo.outputs['run.releaseTests']
-      runPrechecks: stageDependencies.env.repo.outputs['run.releaseTests']
-
-- stage: check
-  displayName: Checks (Linux x64)
-  dependsOn: ${{ parameters.checkStageDeps }}
-  variables:
-    # Skip checks if only mobile/ or docs/ have changed.
-    RUN_CHECKS: $[stageDependencies.env.repo.outputs['run.checks']]
-  jobs:
-  - template: stage/checks.yml
-    parameters:
-      cacheTestResults: ${{ parameters.cacheTestResults }}
-      concurrencyChecks: ${{ parameters.concurrencyChecks }}
-      authGCP: $(GcpServiceAccountKey)
-      bucketGCP: $(GcsArtifactBucket)
-      runChecks: variables['RUN_CHECKS']
diff --git a/.bazelrc b/.bazelrc
index 014610e8c7..c01fb9a246 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -43,9 +43,6 @@ build:windows --action_env=PATH --host_action_env=PATH
 # Requires setting `BAZEL_VOLATILE_DIRTY` in the env.
 build --action_env=BAZEL_VOLATILE_DIRTY --host_action_env=BAZEL_VOLATILE_DIRTY
 
-# Prevent stamped caches from busting (eg in PRs)
-# Requires setting `BAZEL_FAKE_SCM_REVISION` in the env.
-build --action_env=BAZEL_FAKE_SCM_REVISION --host_action_env=BAZEL_FAKE_SCM_REVISION
 build --test_summary=terse
 
 build:docs-ci --action_env=DOCS_RST_CHECK=1 --host_action_env=DOCS_RST_CHECK=1
diff --git a/.github/config.yml b/.github/config.yml
index 24f45f1b1d..1cd315d7eb 100644
--- a/.github/config.yml
+++ b/.github/config.yml
@@ -23,6 +23,13 @@ checks:
   #
   # For example if macos is marked as `required: true` but then has a path
   # selection that means its doesnt run the check will be `skipped` and pass
+  checks:
+    name: Envoy/Checks
+    on-run:
+    - check-build
+    - check-coverage
+    - check-san
+    required: true
   macos:
     name: Envoy/macOS
     required: true
@@ -92,6 +99,8 @@ checks:
     name: Envoy/Prechecks
     on-run:
     - precheck-deps
+    - precheck-format
+    - precheck-publish
     required: true
     # yamllint disable rule:line-length
     advice:
@@ -155,6 +164,15 @@ run:
     - envoy/**/*
     - source/**/*
     - test/**/*
+  check-build:
+    paths:
+    - "**/*"
+  check-coverage:
+    paths:
+    - "**/*"
+  check-san:
+    paths:
+    - "**/*"
   mobile-android:
     paths:
     - .bazelrc
@@ -305,6 +323,13 @@ run:
     - "**/requirements.txt"
     - "**/go.mod"
     - "**/Dockerfile*"
+    push: paths
+  precheck-format:
+    paths:
+    - "**/*"
+  precheck-publish:
+    paths:
+    - "**/*"
   publish:
     paths:
     - .bazelrc
diff --git a/.github/workflows/_check_build.yml b/.github/workflows/_check_build.yml
new file mode 100644
index 0000000000..f3417b58ee
--- /dev/null
+++ b/.github/workflows/_check_build.yml
@@ -0,0 +1,55 @@
+name: Check/build
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    secrets:
+      gcp-key:
+        required: true
+    inputs:
+      request:
+        type: string
+        required: true
+      trusted:
+        type: boolean
+        required: true
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-build
+  cancel-in-progress: true
+
+
+jobs:
+  build:
+    secrets:
+      gcp-key: ${{ secrets.gcp-key }}
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/_run.yml
+    name: ${{ matrix.name ||matrix.target }}
+    with:
+      # bazel-extra: '--config=remote-envoy-engflow'
+      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      concurrency-suffix: -${{ matrix.target }}
+      error-match: |
+        ERROR
+        error:
+        Error:
+      rbe: true
+      request: ${{ inputs.request }}
+      target: ${{ matrix.target }}
+      timeout-minutes: 180
+      trusted: ${{ inputs.trusted }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: api
+          name: API
+        - target: compile_time_options
+          name: Compile time options
+        - target: gcc
+          name: GCC
diff --git a/.github/workflows/_check_coverage.yml b/.github/workflows/_check_coverage.yml
new file mode 100644
index 0000000000..561c7759db
--- /dev/null
+++ b/.github/workflows/_check_coverage.yml
@@ -0,0 +1,54 @@
+name: Check/coverage
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    secrets:
+      gcp-key:
+        required: true
+    inputs:
+      request:
+        type: string
+        required: true
+      trusted:
+        type: boolean
+        required: true
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-coverage
+  cancel-in-progress: true
+
+
+jobs:
+  coverage:
+    secrets:
+      gcp-key: ${{ secrets.gcp-key }}
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/_run.yml
+    name: ${{ matrix.name ||matrix.target }}
+    with:
+      # bazel-extra: '--config=remote-envoy-engflow'
+      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      concurrency-suffix: -${{ matrix.target }}
+      error-match: |
+        ERROR
+        error:
+        Error:
+        lower than limit
+      rbe: true
+      request: ${{ inputs.request }}
+      target: ${{ matrix.target }}
+      timeout-minutes: 180
+      trusted: ${{ inputs.trusted }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: coverage
+          name: Coverage
+        - target: fuzz_coverage
+          name: Fuzz coverage
diff --git a/.github/workflows/_check_san.yml b/.github/workflows/_check_san.yml
new file mode 100644
index 0000000000..c4119b0b24
--- /dev/null
+++ b/.github/workflows/_check_san.yml
@@ -0,0 +1,55 @@
+name: Check/san
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    secrets:
+      gcp-key:
+        required: true
+    inputs:
+      request:
+        type: string
+        required: true
+      trusted:
+        type: boolean
+        required: true
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-asan
+  cancel-in-progress: true
+
+
+jobs:
+  san:
+    secrets:
+      gcp-key: ${{ secrets.gcp-key }}
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/_run.yml
+    name: ${{ matrix.target }}
+    with:
+      # bazel-extra: '--config=remote-envoy-engflow'
+      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      concurrency-suffix: -${{ matrix.target }}
+      request: ${{ inputs.request }}
+      error-match: |
+        ERROR
+        error:
+        Error:
+      rbe: ${{ matrix.rbe }}
+      target: ${{ matrix.target }}
+      timeout-minutes: 180
+      trusted: ${{ inputs.trusted }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: asan
+          rbe: true
+        - target: msan
+          rbe: true
+        - target: tsan
+          rbe: true
diff --git a/.github/workflows/_load.yml b/.github/workflows/_load.yml
index 85991ba4ba..5c06e9c99c 100644
--- a/.github/workflows/_load.yml
+++ b/.github/workflows/_load.yml
@@ -34,6 +34,9 @@ on:
       run-id:
         type: string
         default: ${{ github.event.workflow_run.id }}
+      runs-after:
+        type: boolean
+        default: false
       template-request-summary:
         type: string
         default: |
@@ -87,6 +90,19 @@ jobs:
       trusted: ${{ fromJSON(steps.request-output.outputs.value).request.trusted }}
       skip: ${{ fromJSON(steps.request-output.outputs.value).check.action != 'RUN' }}
     steps:
+    - run: |
+        gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            /repos/${{ github.repository }}/actions/runs/${{ inputs.run-id }} \
+          | jq '.'
+        RUNID=$(gh run view ${{ inputs.run-id }} --repo ${{ github.repository }} --json databaseId | jq -r '.databaseId')
+        echo "value=${RUNID}" >> "$GITHUB_OUTPUT"
+      id: run-id
+      if: ${{ inputs.runs-after == true }}
+      env:
+        GH_TOKEN: ${{ github.token }}
+
     # Load env data
     # Handle any failure in triggering job
     # Remove any `checks` we dont care about
@@ -95,7 +111,7 @@ jobs:
       name: Load env
       id: data
       with:
-        run-id: ${{ inputs.run-id }}
+        run-id: ${{ steps.run-id.outputs.value || inputs.run-id }}
         check-name: ${{ inputs.check-name }}
         head-sha: ${{ inputs.head-sha }}
       env:
diff --git a/.github/workflows/_mobile_container_ci.yml b/.github/workflows/_mobile_container_ci.yml
index ca11052e83..11a92e2eeb 100644
--- a/.github/workflows/_mobile_container_ci.yml
+++ b/.github/workflows/_mobile_container_ci.yml
@@ -22,6 +22,9 @@ on:
       command:
         type: string
         default: ./bazelw
+      concurrency-suffix:
+        type: string
+        default: -mobile
       container:
         type: string
       container-output:
@@ -137,6 +140,8 @@ jobs:
       container-command: ${{ inputs.container-command }} ${{ inputs.container || fromJSON(inputs.request).request.build-image.default }}
       container-output: ${{ inputs.container-output }}
       command: ${{ inputs.command }}
+      concurrency-suffix: ${{ inputs.concurrency-suffix }}
+      docker-ipv6: false
       entrypoint: ${{ inputs.entrypoint || inputs.entrypoint-DEFAULT }}
       downloads: ${{ inputs.downloads }}
       error-match: ${{ inputs.error-match }}
diff --git a/.github/workflows/_precheck_deps.yml b/.github/workflows/_precheck_deps.yml
index 6479772d3d..5254d1633a 100644
--- a/.github/workflows/_precheck_deps.yml
+++ b/.github/workflows/_precheck_deps.yml
@@ -17,12 +17,12 @@ on:
         required: true
 
 concurrency:
-  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-publish
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-deps
   cancel-in-progress: true
 
 
 jobs:
-  prechecks:
+  deps:
     permissions:
       contents: read
       packages: read
@@ -31,6 +31,7 @@ jobs:
     with:
       bazel-extra: '--config=remote-envoy-engflow'
       cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      concurrency-suffix: -${{ matrix.target }}
       request: ${{ inputs.request }}
       error-match: |
         ERROR
@@ -50,7 +51,7 @@ jobs:
     if: ${{ inputs.dependency-review }}
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
       with:
         ref: ${{ fromJSON(inputs.request).request.sha }}
         persist-credentials: false
diff --git a/.github/workflows/_precheck_format.yml b/.github/workflows/_precheck_format.yml
new file mode 100644
index 0000000000..474f2bdb80
--- /dev/null
+++ b/.github/workflows/_precheck_format.yml
@@ -0,0 +1,51 @@
+name: Precheck/format
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      request:
+        type: string
+        required: true
+      trusted:
+        type: boolean
+        required: true
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-format
+  cancel-in-progress: true
+
+
+jobs:
+  format:
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/_run.yml
+    name: ${{ matrix.name || matrix.target }}
+    with:
+      bazel-extra: '--config=remote-envoy-engflow'
+      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      concurrency-suffix: -${{ matrix.target }}
+      request: ${{ inputs.request }}
+      error-match: |
+        ERROR
+        error:
+        Error:
+      rbe: true
+      target: ${{ matrix.target }}
+      trusted: ${{ inputs.trusted }}
+      upload-name: ${{ matrix.upload-name }}
+      upload-path: ${{ matrix.upload-path }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: format
+          upload-name: fix_format.diff
+          upload-path: /home/runner/work/_temp/fix_format.diff
+        - target: format-api
+          upload-name: fix_proto_format.diff
+          upload-path: /home/runner/work/_temp/fix_proto_format.diff
diff --git a/.github/workflows/_precheck_publish.yml b/.github/workflows/_precheck_publish.yml
new file mode 100644
index 0000000000..86181a7bc3
--- /dev/null
+++ b/.github/workflows/_precheck_publish.yml
@@ -0,0 +1,66 @@
+name: Precheck/publish
+
+permissions:
+  contents: read
+
+on:
+  workflow_call:
+    inputs:
+      request:
+        type: string
+        required: true
+      trusted:
+        type: boolean
+        required: true
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}-publish
+  cancel-in-progress: true
+
+
+jobs:
+  publish:
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/_run.yml
+    name: ${{ matrix.name || matrix.target }}
+    with:
+      bazel-extra: ${{ matrix.bazel-extra || '--config=remote-envoy-engflow' }}
+      cache-build-image: ${{ fromJSON(inputs.request).request.build-image.default }}
+      cache-build-image-key-suffix: ${{ matrix.arch == 'arm64' && '-arm64' || '' }}
+      concurrency-suffix: -${{ matrix.target }}${{ matrix.arch && format('-{0}', matrix.arch) || '' }}
+      rbe: ${{ matrix.rbe }}
+      request: ${{ inputs.request }}
+      runs-on: ${{ matrix.runs-on || 'ubuntu-24.04' }}
+      timeout-minutes: ${{ matrix.timeout-minutes || 120 }}
+      error-match: |
+        ERROR
+        error:
+        Error:
+      target: ${{ matrix.target }}
+      trusted: ${{ inputs.trusted }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - target: release.test_only
+          name: Release (x64)
+          arch: x64
+          rbe: true
+        - target: release.test_only
+          name: Release (arm64)
+          arch: arm64
+          bazel-extra: >-
+            --config=common-envoy-engflow
+            --config=cache-envoy-engflow
+            --config=bes-envoy-engflow
+          rbe: false
+          runs-on: envoy-arm64-large
+          timeout-minutes: 180
+        - target: docs
+          name: Docs
+          bazel-extra: >-
+            --config=remote-envoy-engflow
+            --config=docs-ci
+          rbe: true
diff --git a/.github/workflows/_publish_build.yml b/.github/workflows/_publish_build.yml
index 3ce77d4dc6..e89c92c650 100644
--- a/.github/workflows/_publish_build.yml
+++ b/.github/workflows/_publish_build.yml
@@ -67,6 +67,7 @@ jobs:
           arch: arm64
           bazel-extra: >-
             --config=cache-envoy-engflow
+            --config=common-envoy-engflow
             --config=bes-envoy-engflow
           rbe: false
           runs-on: envoy-arm64-medium
@@ -85,6 +86,7 @@ jobs:
     with:
       bazel-extra: >-
         --config=cache-envoy-engflow
+        --config=common-envoy-engflow
         --config=bes-envoy-engflow
       downloads: |
         release.${{ matrix.arch }}: release/${{ matrix.arch }}/bin/
diff --git a/.github/workflows/_publish_verify.yml b/.github/workflows/_publish_verify.yml
index 80e93d0a2b..d4838c3442 100644
--- a/.github/workflows/_publish_verify.yml
+++ b/.github/workflows/_publish_verify.yml
@@ -131,5 +131,6 @@ jobs:
           arch: arm64
           bazel-extra: >-
             --config=cache-envoy-engflow
+            --config=common-envoy-engflow
             --config=bes-envoy-engflow
           runs-on: envoy-arm64-small
diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml
index 2dc2b72850..3a907421cd 100644
--- a/.github/workflows/_run.yml
+++ b/.github/workflows/_run.yml
@@ -10,6 +10,7 @@ on:
       app-key:
       dockerhub-username:
       dockerhub-password:
+      gcp-key:
       gpg-key:
       gpg-key-password:
       rbe-key:
@@ -18,11 +19,13 @@ on:
     inputs:
       args:
         type: string
+      arch:
+        type: string
       bazel-extra:
         type: string
       bazel-rbe-jobs:
         type: number
-        default: 75
+        default: 200
       cache-build-image:
         type: string
       cache-build-image-key-suffix:
@@ -50,6 +53,9 @@ on:
       diskspace-hack-paths:
         type: string
         default:
+      docker-ipv6:
+        default: true
+        type: boolean
       downloads:
         type: string
       entrypoint:
@@ -240,7 +246,6 @@ jobs:
         config: ${{ inputs.checkout-extra }}
         ssh-key: ${{ inputs.trusted && inputs.ssh-key-extra || '' }}
 
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.35
     - name: Import GPG key
       uses: envoyproxy/toolshed/gh-actions/gpg/import@actions-v0.2.35
       if: ${{ inputs.import-gpg }}
@@ -250,6 +255,31 @@ jobs:
         passphrase-path: "${{ runner.temp }}/gpg-passphrase"
         configured-passphrase-path: /build/gpg-passphrase
 
+    - run: |
+        sudo mkdir -p /etc/docker
+        echo '{
+          "ipv6": true,
+          "fixed-cidr-v6": "2001:db8:1::/64"
+          }' | sudo tee /etc/docker/daemon.json
+        sudo service docker restart
+      if: ${{ inputs.docker-ipv6 }}
+
+    - run: |
+        echo "e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9" > .BAZEL_FAKE_SCM_REVISION
+      if: >-
+        ${{ fromJSON(inputs.request).request.pr == '' }}
+
+    - run: |
+        if [[ "${{ secrets.gcp-key }}" == "" ]]; then
+            exit 0
+        fi
+        GCP_SERVICE_ACCOUNT_KEY_PATH=$(mktemp -p "${{ runner.temp }}" -t gcp_service_account.XXXXXX.json)
+        echo "${{ secrets.gcp-key }}" | base64 --decode > "${GCP_SERVICE_ACCOUNT_KEY_PATH}"
+        GCP_SERVICE_ACCOUNT_KEY_FILE="$(basename "${GCP_SERVICE_ACCOUNT_KEY_PATH}")"
+        BAZEL_BUILD_EXTRA_OPTIONS="--google_credentials=/build/${GCP_SERVICE_ACCOUNT_KEY_FILE} --config=remote-ci --config=rbe-google"
+        echo "BAZEL_BUILD_EXTRA_OPTIONS=${BAZEL_BUILD_EXTRA_OPTIONS}" >> "$GITHUB_ENV"
+        echo "GCP_SERVICE_ACCOUNT_KEY_PATH=${GCP_SERVICE_ACCOUNT_KEY_PATH}" >> "$GITHUB_ENV"
+
     - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.35
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
@@ -287,10 +317,11 @@ jobs:
         ENVOY_RBE: ${{ inputs.rbe == true && 1 || '' }}
         RBE_KEY: ${{ secrets.rbe-key }}
         BAZEL_BUILD_EXTRA_OPTIONS: >-
+          ${{ env.BAZEL_BUILD_EXTRA_OPTIONS }}
           --config=remote-ci
           ${{ inputs.bazel-extra }}
           ${{ inputs.rbe == true && format('--jobs={0}', inputs.bazel-rbe-jobs) || '' }}
-        BAZEL_FAKE_SCM_REVISION: ${{ github.event_name == 'pull_request' && 'e3b4a6e9570da15ac1caffdded17a8bebdc7dfc9' || '' }}
+          ${{ github.event_name == 'schedule' && '--nocache_test_results' || '' }}
         CI_BRANCH: >-
           ${{ inputs.trusted
               && format('refs/heads/{0}', fromJSON(inputs.request).request.target-branch)
@@ -298,3 +329,4 @@ jobs:
         CI_SHA1: ${{ github.sha }}
         CI_TARGET_BRANCH: ${{ fromJSON(inputs.request).request.target-branch }}
         MOUNT_GPG_HOME: ${{ inputs.import-gpg && 1 || '' }}
+        ENVOY_DOCKER_OPTIONS: --network=host --security-opt seccomp=unconfined -v /dev/shm:/tmp/sandbox_base
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
index d8640ef866..15562a0199 100644
--- a/.github/workflows/codeql-daily.yml
+++ b/.github/workflows/codeql-daily.yml
@@ -27,14 +27,14 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
 
     - name: Free disk space
       uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.35
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@294a9d92911152fe08befb9ec03e240add280cb3  # codeql-bundle-v3.26.8
+      uses: github/codeql-action/init@461ef6c76dfe95d5c364de2f431ddbd31a417628  # codeql-bundle-v3.26.9
       # Override language selection by uncommenting this and choosing your languages
       with:
         languages: cpp
@@ -73,4 +73,4 @@ jobs:
         git clean -xdf
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@294a9d92911152fe08befb9ec03e240add280cb3  # codeql-bundle-v3.26.8
+      uses: github/codeql-action/analyze@461ef6c76dfe95d5c364de2f431ddbd31a417628  # codeql-bundle-v3.26.9
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 9fd8db2781..10e4eb95e3 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -32,7 +32,7 @@ jobs:
     if: github.repository == 'envoyproxy/envoy'
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
       with:
         fetch-depth: 2
 
@@ -65,7 +65,7 @@ jobs:
 
     - name: Initialize CodeQL
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/init@294a9d92911152fe08befb9ec03e240add280cb3  # codeql-bundle-v3.26.8
+      uses: github/codeql-action/init@461ef6c76dfe95d5c364de2f431ddbd31a417628  # codeql-bundle-v3.26.9
       with:
         languages: cpp
 
@@ -108,4 +108,4 @@ jobs:
 
     - name: Perform CodeQL Analysis
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: github/codeql-action/analyze@294a9d92911152fe08befb9ec03e240add280cb3  # codeql-bundle-v3.26.8
+      uses: github/codeql-action/analyze@461ef6c76dfe95d5c364de2f431ddbd31a417628  # codeql-bundle-v3.26.9
diff --git a/.github/workflows/envoy-checks.yml b/.github/workflows/envoy-checks.yml
new file mode 100644
index 0000000000..ee6f9d94d5
--- /dev/null
+++ b/.github/workflows/envoy-checks.yml
@@ -0,0 +1,115 @@
+name: Envoy/Checks
+
+permissions:
+  contents: read
+
+on:
+  workflow_run:
+    workflows:
+    # Workaround issue with PRs not triggering tertiary workflows
+    - Request
+    # - Envoy/Prechecks
+    types:
+    - completed
+
+concurrency:
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+env:
+  CI_DEBUG: ${{ vars.CI_DEBUG }}
+
+
+jobs:
+  load:
+    secrets:
+      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
+      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
+      lock-app-key: ${{ secrets.ENVOY_CI_MUTEX_APP_KEY }}
+      lock-app-id: ${{ secrets.ENVOY_CI_MUTEX_APP_ID }}
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success'
+       && (github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI) }}
+    uses: ./.github/workflows/_load.yml
+    with:
+      check-name: checks
+      # head-sha: ${{ github.sha }}
+
+  build:
+    secrets:
+      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    name: Check (${{ fromJSON(needs.load.outputs.request).summary.title }})
+    uses: ./.github/workflows/_check_build.yml
+    if: ${{ fromJSON(needs.load.outputs.request).run.check-build }}
+    needs:
+    - load
+    with:
+      request: ${{ needs.load.outputs.request }}
+      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
+
+  coverage:
+    secrets:
+      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    name: Check (${{ fromJSON(needs.load.outputs.request).summary.title }})
+    uses: ./.github/workflows/_check_coverage.yml
+    if: ${{ fromJSON(needs.load.outputs.request).run.check-coverage }}
+    needs:
+    - load
+    with:
+      request: ${{ needs.load.outputs.request }}
+      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
+
+  san:
+    secrets:
+      gcp-key: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    name: Check (${{ fromJSON(needs.load.outputs.request).summary.title }})
+    uses: ./.github/workflows/_check_san.yml
+    if: ${{ fromJSON(needs.load.outputs.request).run.check-san }}
+    needs:
+    - load
+    with:
+      request: ${{ needs.load.outputs.request }}
+      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
+
+  request:
+    secrets:
+      app-id: ${{ secrets.ENVOY_CI_APP_ID }}
+      app-key: ${{ secrets.ENVOY_CI_APP_KEY }}
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    if: >-
+      ${{ always()
+          && github.event.workflow_run.conclusion == 'success'
+          && (fromJSON(needs.load.outputs.request).run.check-build
+              || fromJSON(needs.load.outputs.request).run.check-coverage
+              || fromJSON(needs.load.outputs.request).run.check-san) }}
+    needs:
+    - load
+    - build
+    - coverage
+    - san
+    uses: ./.github/workflows/_finish.yml
+    with:
+      needs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
index 0bab604492..916894ac4c 100644
--- a/.github/workflows/envoy-dependency.yml
+++ b/.github/workflows/envoy-dependency.yml
@@ -146,7 +146,7 @@ jobs:
           path: envoy
           fetch-depth: 0
         token: ${{ steps.appauth.outputs.token }}
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
       name: Checkout Envoy build tools repository
       with:
         repository: envoyproxy/envoy-build-tools
@@ -238,7 +238,7 @@ jobs:
       issues: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
     - name: Run dependency checker
       run: |
         TODAY_DATE=$(date -u -I"date")
diff --git a/.github/workflows/envoy-macos.yml b/.github/workflows/envoy-macos.yml
index 4c5da31f4e..9182073581 100644
--- a/.github/workflows/envoy-macos.yml
+++ b/.github/workflows/envoy-macos.yml
@@ -45,6 +45,7 @@ jobs:
     with:
       command:
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-14-xlarge
       source: ${{ matrix.source }}
diff --git a/.github/workflows/envoy-prechecks.yml b/.github/workflows/envoy-prechecks.yml
index bd8400a1a4..8608560813 100644
--- a/.github/workflows/envoy-prechecks.yml
+++ b/.github/workflows/envoy-prechecks.yml
@@ -35,6 +35,21 @@ jobs:
     with:
       check-name: prechecks
 
+  format:
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }})
+    uses: ./.github/workflows/_precheck_format.yml
+    if: ${{ fromJSON(needs.load.outputs.request).run.precheck-format }}
+    needs:
+    - load
+    with:
+      request: ${{ needs.load.outputs.request }}
+      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
+
   deps:
     permissions:
       actions: read
@@ -51,6 +66,21 @@ jobs:
       request: ${{ needs.load.outputs.request }}
       trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
 
+  publish:
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      pull-requests: read
+    name: Precheck (${{ fromJSON(needs.load.outputs.request).summary.title }})
+    uses: ./.github/workflows/_precheck_publish.yml
+    if: ${{ fromJSON(needs.load.outputs.request).run.precheck-publish }}
+    needs:
+    - load
+    with:
+      request: ${{ needs.load.outputs.request }}
+      trusted: ${{ fromJSON(needs.load.outputs.trusted) }}
+
   request:
     secrets:
       app-id: ${{ secrets.ENVOY_CI_APP_ID }}
@@ -62,10 +92,14 @@ jobs:
     if: >-
       ${{ always()
           && github.event.workflow_run.conclusion == 'success'
-          && fromJSON(needs.load.outputs.request).run.precheck-deps }}
+          && (fromJSON(needs.load.outputs.request).run.precheck-format
+              || fromJSON(needs.load.outputs.request).run.precheck-deps
+              || fromJSON(needs.load.outputs.request).run.precheck-publish) }}
     needs:
     - load
+    - format
     - deps
+    - publish
     uses: ./.github/workflows/_finish.yml
     with:
       needs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/envoy-publish.yml b/.github/workflows/envoy-publish.yml
index 5d4b5fa1af..2c1e6629ab 100644
--- a/.github/workflows/envoy-publish.yml
+++ b/.github/workflows/envoy-publish.yml
@@ -7,24 +7,22 @@ permissions:
   contents: read
 
 on:
-  # This runs untrusted code, do not expose secrets in the verify job
-  workflow_dispatch:
-    inputs:
-      ref:
-        description: "Git SHA ref to checkout"
-      sha:
-        description: "Git SHA of commit HEAD (ie last commit of PR)"
-      head_ref:
-        description: "Ref for grouping PRs"
+  workflow_run:
+    workflows:
+    # Workaround issue with PRs not triggering tertiary workflows
+    - Request
+    # - Envoy/Prechecks
+    types:
+    - completed
 
 concurrency:
-  group: >-
-    ${{ github.actor != 'trigger-release-envoy[bot]'
-        && github.event.inputs.head_ref
-        || github.run_id
-    }}-${{ github.event.workflow.id }}
+  group: ${{ github.head_ref || github.run_id }}-${{ github.workflow }}
   cancel-in-progress: true
 
+env:
+  CI_DEBUG: ${{ vars.CI_DEBUG }}
+
+
 jobs:
   load:
     secrets:
@@ -38,17 +36,12 @@ jobs:
       packages: read
       pull-requests: read
     if: >-
-      ${{
-          (github.repository == 'envoyproxy/envoy'
-           || vars.ENVOY_CI)
-          && (!contains(github.actor, '[bot]')
-              || github.actor == 'trigger-workflow-envoy[bot]'
-              || github.actor == 'trigger-release-envoy[bot]')
-      }}
+      ${{ github.event.workflow_run.conclusion == 'success'
+       && (github.repository == 'envoyproxy/envoy' || vars.ENVOY_CI) }}
     uses: ./.github/workflows/_load.yml
     with:
       check-name: publish
-      head-sha: ${{ inputs.sha }}
+      # head-sha: ${{ github.sha }}
 
   build:
     permissions:
diff --git a/.github/workflows/mobile-android_build.yml b/.github/workflows/mobile-android_build.yml
index d262a6f19c..bbaf3b8091 100644
--- a/.github/workflows/mobile-android_build.yml
+++ b/.github/workflows/mobile-android_build.yml
@@ -64,6 +64,7 @@ jobs:
     with:
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       # Return to using:
       #   ./bazelw mobile-install --fat_apk_cpu=x86_64 --start_app //examples/kotlin/hello_world:hello_envoy_kt
       # When https://github.com/envoyproxy/envoy-mobile/issues/853 is fixed.
diff --git a/.github/workflows/mobile-docs.yml b/.github/workflows/mobile-docs.yml
index 0c3268de6b..7bf39cd100 100644
--- a/.github/workflows/mobile-docs.yml
+++ b/.github/workflows/mobile-docs.yml
@@ -53,6 +53,7 @@ jobs:
         path: mobile-docs
         fetch-depth: 0
         branch: master
+      docker-ipv6: false
       source: |
         echo "ENVOY_DOCKER_SOURCE_DIR=/source/mobile" >> $GITHUB_ENV
         # Path relative to ./mobile directory
diff --git a/.github/workflows/mobile-ios_build.yml b/.github/workflows/mobile-ios_build.yml
index 023eca7320..3fc7ff39e6 100644
--- a/.github/workflows/mobile-ios_build.yml
+++ b/.github/workflows/mobile-ios_build.yml
@@ -41,6 +41,7 @@ jobs:
       args: ${{ matrix.args }}
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-12-large
       source: |
@@ -80,6 +81,7 @@ jobs:
         ${{ matrix.app }}
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-12-large
       source: |
@@ -125,6 +127,7 @@ jobs:
         ${{ matrix.app }}
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-12-large
       source: |
diff --git a/.github/workflows/mobile-ios_tests.yml b/.github/workflows/mobile-ios_tests.yml
index b07e6672e2..8349051005 100644
--- a/.github/workflows/mobile-ios_tests.yml
+++ b/.github/workflows/mobile-ios_tests.yml
@@ -41,6 +41,7 @@ jobs:
       args: ${{ matrix.args }}
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-12
       source: |
diff --git a/.github/workflows/mobile-release.yml b/.github/workflows/mobile-release.yml
index a34c797a4e..35d5f6ba29 100644
--- a/.github/workflows/mobile-release.yml
+++ b/.github/workflows/mobile-release.yml
@@ -86,7 +86,7 @@ jobs:
         include:
         - output: envoy
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
       with:
         fetch-depth: 0
     - name: Add safe directory
diff --git a/.github/workflows/mobile-release_validation.yml b/.github/workflows/mobile-release_validation.yml
index 9fa0847f88..2d9b2bf741 100644
--- a/.github/workflows/mobile-release_validation.yml
+++ b/.github/workflows/mobile-release_validation.yml
@@ -48,6 +48,7 @@ jobs:
         //:ios_xcframework
       command: ./bazelw
       container-command:
+      docker-ipv6: false
       request: ${{ needs.load.outputs.request }}
       runs-on: macos-12
       source: |
diff --git a/.github/workflows/mobile-traffic_director.yml b/.github/workflows/mobile-traffic_director.yml
index c54741e42a..6405c96b78 100644
--- a/.github/workflows/mobile-traffic_director.yml
+++ b/.github/workflows/mobile-traffic_director.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 120
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
     - name: Add safe directory
       run: git config --global --add safe.directory /__w/envoy/envoy
     - name: 'Run GcpTrafficDirectorIntegrationTest'
diff --git a/.github/workflows/pr_notifier.yml b/.github/workflows/pr_notifier.yml
index 2c68e16a1b..9172af147e 100644
--- a/.github/workflows/pr_notifier.yml
+++ b/.github/workflows/pr_notifier.yml
@@ -22,7 +22,7 @@ jobs:
               || !contains(github.actor, '[bot]'))
       }}
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
     - name: Notify about PRs
       run: |
         ARGS=()
diff --git a/.github/workflows/request.yml b/.github/workflows/request.yml
index a245052db1..cc37388e09 100644
--- a/.github/workflows/request.yml
+++ b/.github/workflows/request.yml
@@ -11,6 +11,8 @@ on:
     branches:
     - main
     - release/v*
+  schedule:
+  - cron: '30 6 * * *'
 
 concurrency:
   group: |
@@ -25,11 +27,13 @@ jobs:
     # For branches this can be pinned to a specific version if required
     # NB: `uses` cannot be dynamic so it _must_ be hardcoded anywhere it is read
     uses: envoyproxy/envoy/.github/workflows/_request.yml@main
-    if: ${{ vars.ENVOY_CI || github.repository == 'envoyproxy/envoy' }}
+    if: >-
+      ${{ github.repository == 'envoyproxy/envoy'
+          || (vars.ENVOY_CI && github.event_name != 'schedule')
+          || (vars.ENVOY_SCHEDULED_CI && github.event_name == 'schedule') }}
     permissions:
       actions: read
       contents: read
-      # required for engflow/bazel caching (not yet used)
       packages: read
       # required to fetch merge commit
       pull-requests: read
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 9c574f263d..f3075f3ebd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938  # v4.2.0
       with:
         persist-credentials: false
 
@@ -40,6 +40,6 @@ jobs:
         retention-days: 5
 
     - name: "Upload to code-scanning"
-      uses: github/codeql-action/upload-sarif@294a9d92911152fe08befb9ec03e240add280cb3  # v3.26.8
+      uses: github/codeql-action/upload-sarif@461ef6c76dfe95d5c364de2f431ddbd31a417628  # v3.26.9
       with:
         sarif_file: results.sarif
diff --git a/CODEOWNERS b/CODEOWNERS
index 7e392b3bb5..79a47200bf 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -29,7 +29,7 @@ extensions/filters/common/original_src @klarose @mattklein123
 # cdn_loop extension
 /*/extensions/filters/http/cdn_loop @justin-mp @penguingao @alyssawilk
 # external processing filter
-/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @yanavlasov
+/*/extensions/filters/http/ext_proc @gbrail @stevenzzzz @tyxia @mattklein123 @yanavlasov @yanjunxiang-google
 /*/extensions/filters/common/mutation_rules @gbrail @tyxia @mattklein123 @yanavlasov
 # jwt_authn http filter extension
 /*/extensions/filters/http/jwt_authn @taoxuy @lizan @tyxia @yanavlasov
@@ -329,6 +329,7 @@ extensions/filters/http/oauth2 @derekargueta @mattklein123
 /*/extensions/load_balancing_policies/maglev @wbpcode @nezdolik
 /*/extensions/load_balancing_policies/subset @wbpcode @zuercher @nezdolik
 /*/extensions/load_balancing_policies/cluster_provided @wbpcode @zuercher
+/*/extensions/load_balancing_policies/client_side_weighted_round_robin @wbpcode @adisuissa @efimki
 # Early header mutation
 /*/extensions/http/early_header_mutation/header_mutation @wbpcode @tyxia
 # Network matching extensions
diff --git a/api/BUILD b/api/BUILD
index d31540adcf..096373e79f 100644
--- a/api/BUILD
+++ b/api/BUILD
@@ -276,6 +276,7 @@ proto_library(
         "//envoy/extensions/internal_redirect/previous_routes/v3:pkg",
         "//envoy/extensions/internal_redirect/safe_cross_scheme/v3:pkg",
         "//envoy/extensions/key_value/file_based/v3:pkg",
+        "//envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3:pkg",
         "//envoy/extensions/load_balancing_policies/cluster_provided/v3:pkg",
         "//envoy/extensions/load_balancing_policies/common/v3:pkg",
         "//envoy/extensions/load_balancing_policies/least_request/v3:pkg",
diff --git a/api/envoy/config/core/v3/protocol.proto b/api/envoy/config/core/v3/protocol.proto
index eda87d9408..e566278600 100644
--- a/api/envoy/config/core/v3/protocol.proto
+++ b/api/envoy/config/core/v3/protocol.proto
@@ -209,7 +209,7 @@ message AlternateProtocolsCacheOptions {
   repeated string canonical_suffixes = 5;
 }
 
-// [#next-free-field: 7]
+// [#next-free-field: 8]
 message HttpProtocolOptions {
   option (udpa.annotations.versioning).previous_message_type =
       "envoy.api.v2.core.HttpProtocolOptions";
@@ -259,11 +259,28 @@ message HttpProtocolOptions {
   // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.drain_timeout>`.
   google.protobuf.Duration max_connection_duration = 3;
 
-  // The maximum number of headers. If unconfigured, the default
-  // maximum number of request headers allowed is 100. Requests that exceed this limit will receive
-  // a 431 response for HTTP/1.x and cause a stream reset for HTTP/2.
+  // The maximum number of headers (request headers if configured on HttpConnectionManager,
+  // response headers when configured on a cluster).
+  // If unconfigured, the default maximum number of headers allowed is 100.
+  // Downstream requests that exceed this limit will receive a 431 response for HTTP/1.x and cause a stream
+  // reset for HTTP/2.
+  // Upstream responses that exceed this limit will result in a 503 response.
   google.protobuf.UInt32Value max_headers_count = 2 [(validate.rules).uint32 = {gte: 1}];
 
+  // The maximum size of response headers.
+  // If unconfigured, the default is 60 KiB, except for HTTP/1 response headers which have a default
+  // of 80KiB.
+  // Responses that exceed this limit will result in a 503 response.
+  // In Envoy, this setting is only valid when configured on an upstream cluster, not on the
+  // :ref:`HTTP Connection Manager
+  // <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.common_http_protocol_options>`.
+  //
+  // Note: currently some protocol codecs impose limits on the maximum size of a single header:
+  //   HTTP/2 (when using nghttp2) limits a single header to around 100kb.
+  //   HTTP/3 limits a single header to around 1024kb.
+  google.protobuf.UInt32Value max_response_headers_kb = 7
+      [(validate.rules).uint32 = {lte: 8192 gt: 0}];
+
   // Total duration to keep alive an HTTP request/response stream. If the time limit is reached the stream will be
   // reset independent of any other timeouts. If not specified, this value is not set.
   google.protobuf.Duration max_stream_duration = 4;
diff --git a/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto b/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto
index d1a27657f1..13a24ad9fc 100644
--- a/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto
+++ b/api/envoy/extensions/filters/http/ext_proc/v3/ext_proc.proto
@@ -271,18 +271,20 @@ message ExternalProcessor {
   // The default value is 5000 milliseconds (5 seconds) if not specified.
   google.protobuf.Duration deferred_close_timeout = 19;
 
-  // [#not-implemented-hide:]
   // Send body to the side stream server once it arrives without waiting for the header response from that server.
   // It only works for STREAMED body processing mode. For any other body processing modes, it is ignored.
-  //
   // The server has two options upon receiving a header request:
-  // 1. Instant Response: Send the header response as soon as the header request is received.
-  // 2. Delayed Response: Wait for the body before sending any response.
-  //   If the server chooses the second option, it has two further choices:
-  //   2.1 Separate Responses: Send the header response first, followed by separate body responses.
-  //   2.2 Combined Response: Include both the header response and the first chunk of the body response
-  //       in a single body response message, followed by the remaining body responses.
+  //
+  // 1. Instant Response: send the header response as soon as the header request is received.
+  //
+  // 2. Delayed Response: wait for the body before sending any response.
+  //
   // In all scenarios, the header-body ordering must always be maintained.
+  //
+  // If enabled Envoy will ignore the
+  // :ref:`mode_override <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.mode_override>`
+  // value that the server sends in the header response. This is because Envoy may have already
+  // sent the body to the server, prior to processing the header response.
   bool send_body_without_waiting_for_header_response = 21;
 
   // When :ref:`allow_mode_override
diff --git a/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto b/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
index 4cbbbc20d3..3d438ae878 100644
--- a/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
+++ b/api/envoy/extensions/filters/network/http_connection_manager/v3/http_connection_manager.proto
@@ -494,6 +494,10 @@ message HttpConnectionManager {
   // The maximum request headers size for incoming connections.
   // If unconfigured, the default max request headers allowed is 60 KiB.
   // Requests that exceed this limit will receive a 431 response.
+  //
+  // Note: currently some protocol codecs impose limits on the maximum size of a single header:
+  //   HTTP/2 (when using nghttp2) limits a single header to around 100kb.
+  //   HTTP/3 limits a single header to around 1024kb.
   google.protobuf.UInt32Value max_request_headers_kb = 29
       [(validate.rules).uint32 = {lte: 8192 gt: 0}];
 
diff --git a/api/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto b/api/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto
index 7ad46a56de..9520f6dbd4 100644
--- a/api/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto
+++ b/api/envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.proto
@@ -15,7 +15,7 @@ option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/loa
 option (udpa.annotations.file_status).package_version_status = ACTIVE;
 
 // [#protodoc-title: Client-Side Weighted Round Robin Load Balancing Policy]
-// [#not-implemented-hide:]
+// [#extension: envoy.load_balancing_policies.client_side_weighted_round_robin]
 
 // Configuration for the client_side_weighted_round_robin LB policy.
 //
diff --git a/api/envoy/service/ext_proc/v3/external_processor.proto b/api/envoy/service/ext_proc/v3/external_processor.proto
index 5f0d66e657..6ae58c3c72 100644
--- a/api/envoy/service/ext_proc/v3/external_processor.proto
+++ b/api/envoy/service/ext_proc/v3/external_processor.proto
@@ -180,7 +180,10 @@ message ProcessingResponse {
   // It is also ignored by Envoy when the ext_proc filter config
   // :ref:`allow_mode_override
   // <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.allow_mode_override>`
-  // is set to false.
+  // is set to false, or
+  // :ref:`send_body_without_waiting_for_header_response
+  // <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.send_body_without_waiting_for_header_response>`
+  // is set to true.
   envoy.extensions.filters.http.ext_proc.v3.ProcessingMode mode_override = 9;
 
   // When ext_proc server receives a request message, in case it needs more
@@ -285,9 +288,6 @@ message CommonResponse {
   // Instructions on how to manipulate the headers. When responding to an
   // HttpBody request, header mutations will only take effect if
   // the current processing mode for the body is BUFFERED.
-  // [#comment:TODO(yanjunxiang-google) rephrase last sentence once send_body_without_waiting_for_header_response is not hidden:
-  // the current processing mode for the body is: 1) BUFFERED; 2) or STREAMED and
-  // the :ref:`send_body_without_waiting_for_header_response <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.send_body_without_waiting_for_header_response>` is enabled.]
   HeaderMutation header_mutation = 2;
 
   // Replace the body of the last message sent to the remote server on this
diff --git a/bazel/BUILD b/bazel/BUILD
index 77da1e1fce..011b1c88a3 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -517,6 +517,11 @@ config_setting(
     values = {"define": "perf_annotation=enabled"},
 )
 
+config_setting(
+    name = "enable_execution_context",
+    values = {"define": "execution_context=enabled"},
+)
+
 config_setting(
     name = "enable_perf_tracing",
     values = {"define": "perf_tracing=enabled"},
diff --git a/bazel/com_google_protoconverter.patch b/bazel/com_google_protoconverter.patch
index f17de244d2..cb80e7248c 100644
--- a/bazel/com_google_protoconverter.patch
+++ b/bazel/com_google_protoconverter.patch
@@ -1,11 +1,2220 @@
---- a/src/google/protobuf/util/converter/port_def.inc	2024-01-04 20:39:52.910353189 +0000
-+++ b/src/google/protobuf/util/converter/port_def.inc	2024-01-04 20:39:02.134416756 +0000
-@@ -415,7 +415,7 @@
+diff --git a/src/google/protobuf/stubs/BUILD.bazel b/src/google/protobuf/stubs/BUILD.bazel
+index a7b8c82..4f66827 100644
+--- a/src/google/protobuf/stubs/BUILD.bazel
++++ b/src/google/protobuf/stubs/BUILD.bazel
+@@ -27,13 +27,11 @@ cc_library(
+     name = "lite",
+     srcs = [
+         "bytestream.cc",
+-        "common.cc",
+         "strutil.cc",
+     ],
+     hdrs = [
+         "bytestream.h",
+         "callback.h",
+-        "common.h",
+         "platform_macros.h",
+         "port.h",
+         "status_macros.h",
+@@ -43,7 +41,7 @@ cc_library(
+     include_prefix = "google/protobuf/stubs",
+     linkopts = LINK_OPTS,
+     deps = [
+-        "//src/google/protobuf/util/converter:port_def",
++        "@com_google_absl//absl/base:core_headers",
+         "@com_google_absl//absl/log:absl_check",
+         "@com_google_absl//absl/log:absl_log",
+         "@com_google_absl//absl/status",
+@@ -62,14 +60,12 @@ cc_library(
+     include_prefix = "google/protobuf/stubs",
+     textual_hdrs = [
+         "callback.h",
+-        "common.h",
+         "platform_macros.h",
+         "port.h",
+         "status_macros.h",
+     ],
+     deps = [
+         ":lite",
+-        "//src/google/protobuf/util/converter:port_def",
+         "@com_google_absl//absl/status",
+         "@com_google_absl//absl/status:statusor",
+         "@com_google_absl//absl/strings",
+@@ -80,7 +76,6 @@ cc_test(
+     name = "stubs_test",
+     srcs = [
+         "bytestream_unittest.cc",
+-        "common_unittest.cc",
+         "strutil_unittest.cc",
+     ],
+     copts = COPTS + select({
+diff --git a/src/google/protobuf/stubs/bytestream.h b/src/google/protobuf/stubs/bytestream.h
+index 9d08463..e3372cb 100644
+--- a/src/google/protobuf/stubs/bytestream.h
++++ b/src/google/protobuf/stubs/bytestream.h
+@@ -43,10 +43,6 @@
+ #include "absl/log/absl_check.h"
+ #include "absl/log/absl_log.h"
+ #include "absl/strings/string_view.h"
+-#include "google/protobuf/stubs/common.h"
+-
+-// Must be last.
+-#include "google/protobuf/util/converter/port_def.inc"  // NOLINT
  
- // The minimum library version which works with the current version of the
- // headers.
--#define GOOGLE_PROTOBUF_MIN_LIBRARY_VERSION 4023000
-+#define GOOGLE_PROTOBUF_MIN_LIBRARY_VERSION 4025000
+ class CordByteSink;
  
- #ifdef PROTOBUF_RTTI
- #error PROTOBUF_RTTI was previously defined
+@@ -65,7 +61,7 @@ namespace strings {
+ //   sink->Append(my_data.data(), my_data.size());
+ //   sink->Flush();
+ //
+-class PROTOBUF_EXPORT ByteSink {
++class ByteSink {
+  public:
+   ByteSink() {}
+   ByteSink(const ByteSink&) = delete;
+@@ -93,7 +89,7 @@ class PROTOBUF_EXPORT ByteSink {
+ //     source->Skip(data.length());
+ //   }
+ //
+-class PROTOBUF_EXPORT ByteSource {
++class ByteSource {
+  public:
+   ByteSource() {}
+   ByteSource(const ByteSource&) = delete;
+@@ -149,7 +145,7 @@ class PROTOBUF_EXPORT ByteSource {
+ //   sink.Append("hi", 2);    // OK
+ //   sink.Append(data, 100);  // WOOPS! Overflows buf[10].
+ //
+-class PROTOBUF_EXPORT UncheckedArrayByteSink : public ByteSink {
++class UncheckedArrayByteSink : public ByteSink {
+  public:
+   UncheckedArrayByteSink(const UncheckedArrayByteSink&) = delete;
+   UncheckedArrayByteSink& operator=(const UncheckedArrayByteSink&) = delete;
+@@ -178,7 +174,7 @@ class PROTOBUF_EXPORT UncheckedArrayByteSink : public ByteSink {
+ //   sink.Append("hi", 2);    // OK
+ //   sink.Append(data, 100);  // Will only write 8 more bytes
+ //
+-class PROTOBUF_EXPORT CheckedArrayByteSink : public ByteSink {
++class CheckedArrayByteSink : public ByteSink {
+  public:
+   CheckedArrayByteSink(char* outbuf, size_t capacity);
+   CheckedArrayByteSink(const CheckedArrayByteSink&) = delete;
+@@ -215,7 +211,7 @@ class PROTOBUF_EXPORT CheckedArrayByteSink : public ByteSink {
+ //   const char* buf = sink.GetBuffer();  // Ownership transferred
+ //   delete[] buf;
+ //
+-class PROTOBUF_EXPORT GrowingArrayByteSink : public strings::ByteSink {
++class GrowingArrayByteSink : public strings::ByteSink {
+  public:
+   explicit GrowingArrayByteSink(size_t estimated_size);
+   GrowingArrayByteSink(const GrowingArrayByteSink&) = delete;
+@@ -246,7 +242,7 @@ class PROTOBUF_EXPORT GrowingArrayByteSink : public strings::ByteSink {
+ //   sink.Append("World", 5);
+ //   assert(dest == "Hello World");
+ //
+-class PROTOBUF_EXPORT StringByteSink : public ByteSink {
++class StringByteSink : public ByteSink {
+  public:
+   explicit StringByteSink(std::string* dest) : dest_(dest) {}
+   StringByteSink(const StringByteSink&) = delete;
+@@ -264,7 +260,7 @@ class PROTOBUF_EXPORT StringByteSink : public ByteSink {
+ //   NullByteSink sink;
+ //   sink.Append(data, data.size());  // All data ignored.
+ //
+-class PROTOBUF_EXPORT NullByteSink : public ByteSink {
++class NullByteSink : public ByteSink {
+  public:
+   NullByteSink() {}
+   NullByteSink(const NullByteSink&) = delete;
+@@ -285,7 +281,7 @@ class PROTOBUF_EXPORT NullByteSink : public ByteSink {
+ //   assert(source.Available() == 5);
+ //   assert(source.Peek() == "Hello");
+ //
+-class PROTOBUF_EXPORT ArrayByteSource : public ByteSource {
++class ArrayByteSource : public ByteSource {
+  public:
+   explicit ArrayByteSource(absl::string_view s) : input_(s) {}
+   ArrayByteSource(const ArrayByteSource&) = delete;
+@@ -317,7 +313,7 @@ class PROTOBUF_EXPORT ArrayByteSource : public ByteSource {
+ //   assert(limit.Available() == 5);
+ //   assert(limit.Peek() == "Hello");
+ //
+-class PROTOBUF_EXPORT LimitByteSource : public ByteSource {
++class LimitByteSource : public ByteSource {
+  public:
+   // Returns at most "limit" bytes from "source".
+   LimitByteSource(ByteSource* source, size_t limit);
+@@ -339,6 +335,4 @@ class PROTOBUF_EXPORT LimitByteSource : public ByteSource {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"  // NOLINT
+-
+ #endif  // GOOGLE_PROTOBUF_STUBS_BYTESTREAM_H_
+\ No newline at end of file
+diff --git a/src/google/protobuf/stubs/callback.h b/src/google/protobuf/stubs/callback.h
+index 112dfca..daa6901 100644
+--- a/src/google/protobuf/stubs/callback.h
++++ b/src/google/protobuf/stubs/callback.h
+@@ -19,8 +19,6 @@
+ 
+ #include <type_traits>
+ 
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ // ===================================================================
+ // emulates google3/base/callback.h
+ 
+@@ -84,7 +82,7 @@ namespace protobuf {
+ //   std::string my_str;
+ //   NewCallback(&Foo, my_str);  // WON'T WORK:  Can't use references.
+ // However, correctly-typed pointers will work just fine.
+-class PROTOBUF_EXPORT Closure {
++class Closure {
+  public:
+   Closure() {}
+   Closure(const Closure&) = delete;
+@@ -106,7 +104,7 @@ class ResultCallback {
+ };
+ 
+ template <typename R, typename A1>
+-class PROTOBUF_EXPORT ResultCallback1 {
++class ResultCallback1 {
+  public:
+   ResultCallback1() {}
+   ResultCallback1(const ResultCallback1&) = delete;
+@@ -117,7 +115,7 @@ class PROTOBUF_EXPORT ResultCallback1 {
+ };
+ 
+ template <typename R, typename A1, typename A2>
+-class PROTOBUF_EXPORT ResultCallback2 {
++class ResultCallback2 {
+  public:
+   ResultCallback2() {}
+   ResultCallback2(const ResultCallback2&) = delete;
+@@ -129,7 +127,7 @@ class PROTOBUF_EXPORT ResultCallback2 {
+ 
+ namespace internal {
+ 
+-class PROTOBUF_EXPORT FunctionClosure0 : public Closure {
++class FunctionClosure0 : public Closure {
+  public:
+   typedef void (*FunctionType)();
+ 
+@@ -583,11 +581,9 @@ inline ResultCallback2<R, A1, A2>* NewPermanentCallback(
+ 
+ // A function which does nothing.  Useful for creating no-op callbacks, e.g.:
+ //   Closure* nothing = NewCallback(&DoNothing);
+-void PROTOBUF_EXPORT DoNothing();
++void DoNothing();
+ 
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_STUBS_CALLBACK_H_
+diff --git a/src/google/protobuf/stubs/port.h b/src/google/protobuf/stubs/port.h
+index ad033a1..88690fa 100644
+--- a/src/google/protobuf/stubs/port.h
++++ b/src/google/protobuf/stubs/port.h
+@@ -27,9 +27,6 @@
+ 
+ #include "google/protobuf/stubs/platform_macros.h"
+ 
+-// Must be last.
+-#include "google/protobuf/util/converter/port_def.inc"  // NOLINT
+-
+ #undef PROTOBUF_LITTLE_ENDIAN
+ #ifdef _WIN32
+   // Assuming windows is always little-endian.
+@@ -217,7 +214,7 @@ static inline uint64_t bswap_64(uint64_t x) {
+ 
+ // ===================================================================
+ // from google3/util/endian/endian.h
+-PROTOBUF_EXPORT uint32_t ghtonl(uint32_t x);
++uint32_t ghtonl(uint32_t x);
+ 
+ class BigEndian {
+  public:
+@@ -278,6 +275,4 @@ class BigEndian {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_STUBS_PORT_H_
+diff --git a/src/google/protobuf/stubs/status_macros.h b/src/google/protobuf/stubs/status_macros.h
+index 46e65eb..5faaf5c 100644
+--- a/src/google/protobuf/stubs/status_macros.h
++++ b/src/google/protobuf/stubs/status_macros.h
+@@ -19,12 +19,9 @@
+ #ifndef GOOGLE_PROTOBUF_STUBS_STATUS_MACROS_H_
+ #define GOOGLE_PROTOBUF_STUBS_STATUS_MACROS_H_
+ 
++#include "absl/base/optimization.h"
+ #include "absl/status/status.h"
+ #include "absl/status/statusor.h"
+-#include "google/protobuf/stubs/common.h"
+-
+-// Needs to be last.
+-#include "google/protobuf/util/converter/port_def.inc"  // NOLINT
+ 
+ namespace google {
+ namespace protobuf {
+@@ -39,7 +36,7 @@ namespace util {
+   do {                                                                       \
+     /* Using _status below to avoid capture problems if expr is "status". */ \
+     const absl::Status _status = (expr);                                     \
+-    if (PROTOBUF_PREDICT_FALSE(!_status.ok())) return _status;               \
++    if (ABSL_PREDICT_FALSE(!_status.ok())) return _status;                   \
+   } while (0)
+ 
+ // Internal helper for concatenating macro values.
+@@ -56,7 +53,7 @@ absl::Status DoAssignOrReturn(T& lhs, absl::StatusOr<T> result) {
+ 
+ #define ASSIGN_OR_RETURN_IMPL(status, lhs, rexpr)       \
+   absl::Status status = DoAssignOrReturn(lhs, (rexpr)); \
+-  if (PROTOBUF_PREDICT_FALSE(!status.ok())) return status;
++  if (ABSL_PREDICT_FALSE(!status.ok())) return status;
+ 
+ // Executes an expression that returns a util::StatusOr, extracting its value
+ // into the variable defined by lhs (or returning on error).
+@@ -75,6 +72,4 @@ absl::Status DoAssignOrReturn(T& lhs, absl::StatusOr<T> result) {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"  // NOLINT
+-
+ #endif  // GOOGLE_PROTOBUF_STUBS_STATUS_H_
+diff --git a/src/google/protobuf/stubs/strutil.h b/src/google/protobuf/stubs/strutil.h
+index 82882f4..4d09bad 100644
+--- a/src/google/protobuf/stubs/strutil.h
++++ b/src/google/protobuf/stubs/strutil.h
+@@ -17,15 +17,13 @@
+ #ifndef GOOGLE_PROTOBUF_STUBS_STRUTIL_H__
+ #define GOOGLE_PROTOBUF_STUBS_STRUTIL_H__
+ 
+-#include <google/protobuf/stubs/common.h>
+-#include <stdlib.h>
+-
++#include <cstdlib>
+ #include <cstring>
+-#include <google/protobuf/util/converter/port_def.inc>
+ #include <vector>
+ 
+ #include "absl/strings/str_cat.h"
+ #include "absl/strings/str_join.h"
++#include "google/protobuf/stubs/port.h"
+ 
+ namespace google {
+ namespace protobuf {
+@@ -138,10 +136,9 @@ inline std::string StripSuffixString(const std::string& str,
+ // StripWhitespace
+ //    Removes whitespaces from both ends of the given string.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT void ReplaceCharacters(std::string* s, const char* remove,
+-                                       char replacewith);
++void ReplaceCharacters(std::string* s, const char* remove, char replacewith);
+ 
+-PROTOBUF_EXPORT void StripWhitespace(std::string* s);
++void StripWhitespace(std::string* s);
+ 
+ // ----------------------------------------------------------------------
+ // LowerString()
+@@ -185,10 +182,8 @@ inline std::string ToUpper(const std::string& s) {
+ //    happened or not.
+ // ----------------------------------------------------------------------
+ 
+-PROTOBUF_EXPORT std::string StringReplace(const std::string& s,
+-                                          const std::string& oldsub,
+-                                          const std::string& newsub,
+-                                          bool replace_all);
++std::string StringReplace(const std::string& s, const std::string& oldsub,
++                          const std::string& newsub, bool replace_all);
+ 
+ // ----------------------------------------------------------------------
+ // SplitStringUsing()
+@@ -196,8 +191,8 @@ PROTOBUF_EXPORT std::string StringReplace(const std::string& s,
+ //    to 'result'.  If there are consecutive delimiters, this function skips
+ //    over all of them.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT void SplitStringUsing(absl::string_view full, const char* delim,
+-                                      std::vector<std::string>* res);
++void SplitStringUsing(absl::string_view full, const char* delim,
++                      std::vector<std::string>* res);
+ 
+ // Split a string using one or more byte delimiters, presented
+ // as a nul-terminated c string. Append the components to 'result'.
+@@ -207,9 +202,8 @@ PROTOBUF_EXPORT void SplitStringUsing(absl::string_view full, const char* delim,
+ //
+ // If "full" is the empty string, yields an empty string as the only value.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT void SplitStringAllowEmpty(absl::string_view full,
+-                                           const char* delim,
+-                                           std::vector<std::string>* result);
++void SplitStringAllowEmpty(absl::string_view full, const char* delim,
++                           std::vector<std::string>* result);
+ 
+ // ----------------------------------------------------------------------
+ // Split()
+@@ -234,8 +228,8 @@ inline std::vector<std::string> Split(absl::string_view full, const char* delim,
+ //    another takes a pointer to the target string. In the latter case the
+ //    target string is cleared and overwritten.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT void JoinStrings(const std::vector<std::string>& components,
+-                                 const char* delim, std::string* result);
++void JoinStrings(const std::vector<std::string>& components, const char* delim,
++                 std::string* result);
+ 
+ inline std::string JoinStrings(const std::vector<std::string>& components,
+                                const char* delim) {
+@@ -275,9 +269,9 @@ inline std::string JoinStrings(const std::vector<std::string>& components,
+ //    processed.
+ //    ----------------------------------------------------------------------
+ 
+-PROTOBUF_EXPORT int UnescapeCEscapeSequences(const char* source, char* dest);
+-PROTOBUF_EXPORT int UnescapeCEscapeSequences(const char* source, char* dest,
+-                                             std::vector<std::string>* errors);
++int UnescapeCEscapeSequences(const char* source, char* dest);
++int UnescapeCEscapeSequences(const char* source, char* dest,
++                             std::vector<std::string>* errors);
+ 
+ // ----------------------------------------------------------------------
+ // UnescapeCEscapeString()
+@@ -294,12 +288,10 @@ PROTOBUF_EXPORT int UnescapeCEscapeSequences(const char* source, char* dest,
+ //    the third call, the new string is returned.
+ // ----------------------------------------------------------------------
+ 
+-PROTOBUF_EXPORT int UnescapeCEscapeString(const std::string& src,
+-                                          std::string* dest);
+-PROTOBUF_EXPORT int UnescapeCEscapeString(const std::string& src,
+-                                          std::string* dest,
+-                                          std::vector<std::string>* errors);
+-PROTOBUF_EXPORT std::string UnescapeCEscapeString(const std::string& src);
++int UnescapeCEscapeString(const std::string& src, std::string* dest);
++int UnescapeCEscapeString(const std::string& src, std::string* dest,
++                          std::vector<std::string>* errors);
++std::string UnescapeCEscapeString(const std::string& src);
+ 
+ // ----------------------------------------------------------------------
+ // CEscape()
+@@ -308,21 +300,21 @@ PROTOBUF_EXPORT std::string UnescapeCEscapeString(const std::string& src);
+ //
+ //    Escaped chars: \n, \r, \t, ", ', \, and !isprint().
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT std::string CEscape(const std::string& src);
++std::string CEscape(const std::string& src);
+ 
+ // ----------------------------------------------------------------------
+ // CEscapeAndAppend()
+ //    Escapes 'src' using C-style escape sequences, and appends the escaped
+ //    string to 'dest'.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT void CEscapeAndAppend(absl::string_view src, std::string* dest);
++void CEscapeAndAppend(absl::string_view src, std::string* dest);
+ 
+ namespace strings {
+ // Like CEscape() but does not escape bytes with the upper bit set.
+-PROTOBUF_EXPORT std::string Utf8SafeCEscape(const std::string& src);
++std::string Utf8SafeCEscape(const std::string& src);
+ 
+ // Like CEscape() but uses hex (\x) escapes instead of octals.
+-PROTOBUF_EXPORT std::string CHexEscape(const std::string& src);
++std::string CHexEscape(const std::string& src);
+ }  // namespace strings
+ 
+ // ----------------------------------------------------------------------
+@@ -335,10 +327,8 @@ PROTOBUF_EXPORT std::string CHexEscape(const std::string& src);
+ //    platforms, so using these is safer, from the point of view of
+ //    overflow behavior, than using the standard libc functions.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int32_t strto32_adaptor(const char* nptr, char** endptr,
+-                                        int base);
+-PROTOBUF_EXPORT uint32_t strtou32_adaptor(const char* nptr, char** endptr,
+-                                          int base);
++int32_t strto32_adaptor(const char* nptr, char** endptr, int base);
++uint32_t strtou32_adaptor(const char* nptr, char** endptr, int base);
+ 
+ inline int32_t strto32(const char* nptr, char** endptr, int base) {
+   if (sizeof(int32_t) == sizeof(long))
+@@ -377,10 +367,10 @@ inline uint64_t strtou64(const char* nptr, char** endptr, int base) {
+ // safe_strtof()
+ // safe_strtod()
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT bool safe_strtob(absl::string_view str, bool* value);
++bool safe_strtob(absl::string_view str, bool* value);
+ 
+-PROTOBUF_EXPORT bool safe_strto32(const std::string& str, int32_t* value);
+-PROTOBUF_EXPORT bool safe_strtou32(const std::string& str, uint32_t* value);
++bool safe_strto32(const std::string& str, int32_t* value);
++bool safe_strtou32(const std::string& str, uint32_t* value);
+ inline bool safe_strto32(const char* str, int32_t* value) {
+   return safe_strto32(std::string(str), value);
+ }
+@@ -394,8 +384,8 @@ inline bool safe_strtou32(absl::string_view str, uint32_t* value) {
+   return safe_strtou32(std::string(str), value);
+ }
+ 
+-PROTOBUF_EXPORT bool safe_strto64(const std::string& str, int64_t* value);
+-PROTOBUF_EXPORT bool safe_strtou64(const std::string& str, uint64_t* value);
++bool safe_strto64(const std::string& str, int64_t* value);
++bool safe_strtou64(const std::string& str, uint64_t* value);
+ inline bool safe_strto64(const char* str, int64_t* value) {
+   return safe_strto64(std::string(str), value);
+ }
+@@ -409,8 +399,8 @@ inline bool safe_strtou64(absl::string_view str, uint64_t* value) {
+   return safe_strtou64(std::string(str), value);
+ }
+ 
+-PROTOBUF_EXPORT bool safe_strtof(const char* str, float* value);
+-PROTOBUF_EXPORT bool safe_strtod(const char* str, double* value);
++bool safe_strtof(const char* str, float* value);
++bool safe_strtod(const char* str, double* value);
+ inline bool safe_strtof(const std::string& str, float* value) {
+   return safe_strtof(str.c_str(), value);
+ }
+@@ -450,13 +440,13 @@ inline bool safe_strtod(absl::string_view str, double* value) {
+ // DoubleToBuffer() and FloatToBuffer().
+ static const int kFastToBufferSize = 32;
+ 
+-PROTOBUF_EXPORT char* FastInt32ToBuffer(int32_t i, char* buffer);
+-PROTOBUF_EXPORT char* FastInt64ToBuffer(int64_t i, char* buffer);
++char* FastInt32ToBuffer(int32_t i, char* buffer);
++char* FastInt64ToBuffer(int64_t i, char* buffer);
+ char* FastUInt32ToBuffer(uint32_t i, char* buffer);  // inline below
+ char* FastUInt64ToBuffer(uint64_t i, char* buffer);  // inline below
+-PROTOBUF_EXPORT char* FastHexToBuffer(int i, char* buffer);
+-PROTOBUF_EXPORT char* FastHex64ToBuffer(uint64_t i, char* buffer);
+-PROTOBUF_EXPORT char* FastHex32ToBuffer(uint32_t i, char* buffer);
++char* FastHexToBuffer(int i, char* buffer);
++char* FastHex64ToBuffer(uint64_t i, char* buffer);
++char* FastHex32ToBuffer(uint32_t i, char* buffer);
+ 
+ // at least 22 bytes long
+ inline char* FastIntToBuffer(int i, char* buffer) {
+@@ -492,10 +482,10 @@ inline char* FastULongToBuffer(unsigned long i, char* buffer) {
+ // terminating the string).
+ // ----------------------------------------------------------------------
+ 
+-PROTOBUF_EXPORT char* FastInt32ToBufferLeft(int32_t i, char* buffer);
+-PROTOBUF_EXPORT char* FastUInt32ToBufferLeft(uint32_t i, char* buffer);
+-PROTOBUF_EXPORT char* FastInt64ToBufferLeft(int64_t i, char* buffer);
+-PROTOBUF_EXPORT char* FastUInt64ToBufferLeft(uint64_t i, char* buffer);
++char* FastInt32ToBufferLeft(int32_t i, char* buffer);
++char* FastUInt32ToBufferLeft(uint32_t i, char* buffer);
++char* FastInt64ToBufferLeft(int64_t i, char* buffer);
++char* FastUInt64ToBufferLeft(uint64_t i, char* buffer);
+ 
+ // Just define these in terms of the above.
+ inline char* FastUInt32ToBuffer(uint32_t i, char* buffer) {
+@@ -515,12 +505,12 @@ inline std::string SimpleBtoa(bool value) { return value ? "true" : "false"; }
+ //
+ //    Return value: string
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT std::string SimpleItoa(int i);
+-PROTOBUF_EXPORT std::string SimpleItoa(unsigned int i);
+-PROTOBUF_EXPORT std::string SimpleItoa(long i);
+-PROTOBUF_EXPORT std::string SimpleItoa(unsigned long i);
+-PROTOBUF_EXPORT std::string SimpleItoa(long long i);
+-PROTOBUF_EXPORT std::string SimpleItoa(unsigned long long i);
++std::string SimpleItoa(int i);
++std::string SimpleItoa(unsigned int i);
++std::string SimpleItoa(long i);
++std::string SimpleItoa(unsigned long i);
++std::string SimpleItoa(long long i);
++std::string SimpleItoa(unsigned long long i);
+ 
+ // ----------------------------------------------------------------------
+ // SimpleDtoa()
+@@ -541,11 +531,11 @@ PROTOBUF_EXPORT std::string SimpleItoa(unsigned long long i);
+ //
+ //    Return value: string
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT std::string SimpleDtoa(double value);
+-PROTOBUF_EXPORT std::string SimpleFtoa(float value);
++std::string SimpleDtoa(double value);
++std::string SimpleFtoa(float value);
+ 
+-PROTOBUF_EXPORT char* DoubleToBuffer(double i, char* buffer);
+-PROTOBUF_EXPORT char* FloatToBuffer(float i, char* buffer);
++char* DoubleToBuffer(double i, char* buffer);
++char* FloatToBuffer(float i, char* buffer);
+ 
+ // In practice, doubles should never need more than 24 bytes and floats
+ // should never need more than 14 (including null terminators), but we
+@@ -563,7 +553,7 @@ using Hex = absl::Hex;
+ // ToHex()
+ //    Return a lower-case hex string representation of the given integer.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT std::string ToHex(uint64_t num);
++std::string ToHex(uint64_t num);
+ 
+ // ----------------------------------------------------------------------
+ // GlobalReplaceSubstring()
+@@ -572,9 +562,8 @@ PROTOBUF_EXPORT std::string ToHex(uint64_t num);
+ //
+ //    NOTE: The string pieces must not overlap s.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int GlobalReplaceSubstring(const std::string& substring,
+-                                           const std::string& replacement,
+-                                           std::string* s);
++int GlobalReplaceSubstring(const std::string& substring,
++                           const std::string& replacement, std::string* s);
+ 
+ // ----------------------------------------------------------------------
+ // Base64Unescape()
+@@ -582,7 +571,7 @@ PROTOBUF_EXPORT int GlobalReplaceSubstring(const std::string& substring,
+ //    writes it to "dest". If src contains invalid characters, dest is cleared
+ //    and the function returns false. Returns true on success.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT bool Base64Unescape(absl::string_view src, std::string* dest);
++bool Base64Unescape(absl::string_view src, std::string* dest);
+ 
+ // ----------------------------------------------------------------------
+ // WebSafeBase64Unescape()
+@@ -595,18 +584,16 @@ PROTOBUF_EXPORT bool Base64Unescape(absl::string_view src, std::string* dest);
+ //    returns false (with dest empty) if src contains invalid chars; for
+ //    this version src and dest must be different strings.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int WebSafeBase64Unescape(const char* src, int slen, char* dest,
+-                                          int szdest);
+-PROTOBUF_EXPORT bool WebSafeBase64Unescape(absl::string_view src,
+-                                           std::string* dest);
++int WebSafeBase64Unescape(const char* src, int slen, char* dest, int szdest);
++bool WebSafeBase64Unescape(absl::string_view src, std::string* dest);
+ 
+ // Return the length to use for the output buffer given to the base64 escape
+ // routines. Make sure to use the same value for do_padding in both.
+ // This function may return incorrect results if given input_len values that
+ // are extremely high, which should happen rarely.
+-PROTOBUF_EXPORT int CalculateBase64EscapedLen(int input_len, bool do_padding);
++int CalculateBase64EscapedLen(int input_len, bool do_padding);
+ // Use this version when calling Base64Escape without a do_padding arg.
+-PROTOBUF_EXPORT int CalculateBase64EscapedLen(int input_len);
++int CalculateBase64EscapedLen(int input_len);
+ 
+ // ----------------------------------------------------------------------
+ // Base64Escape()
+@@ -620,24 +607,20 @@ PROTOBUF_EXPORT int CalculateBase64EscapedLen(int input_len);
+ //    to escape them.  It also has an extra parameter "do_padding",
+ //    which when set to false will prevent padding with "=".
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int Base64Escape(const unsigned char* src, int slen, char* dest,
+-                                 int szdest);
+-PROTOBUF_EXPORT int WebSafeBase64Escape(const unsigned char* src, int slen,
+-                                        char* dest, int szdest,
+-                                        bool do_padding);
++int Base64Escape(const unsigned char* src, int slen, char* dest, int szdest);
++int WebSafeBase64Escape(const unsigned char* src, int slen, char* dest,
++                        int szdest, bool do_padding);
+ // Encode src into dest with padding.
+-PROTOBUF_EXPORT void Base64Escape(absl::string_view src, std::string* dest);
++void Base64Escape(absl::string_view src, std::string* dest);
+ // Encode src into dest web-safely without padding.
+-PROTOBUF_EXPORT void WebSafeBase64Escape(absl::string_view src,
+-                                         std::string* dest);
++void WebSafeBase64Escape(absl::string_view src, std::string* dest);
+ // Encode src into dest web-safely with padding.
+-PROTOBUF_EXPORT void WebSafeBase64EscapeWithPadding(absl::string_view src,
+-                                                    std::string* dest);
++void WebSafeBase64EscapeWithPadding(absl::string_view src, std::string* dest);
+ 
+-PROTOBUF_EXPORT void Base64Escape(const unsigned char* src, int szsrc,
+-                                  std::string* dest, bool do_padding);
+-PROTOBUF_EXPORT void WebSafeBase64Escape(const unsigned char* src, int szsrc,
+-                                         std::string* dest, bool do_padding);
++void Base64Escape(const unsigned char* src, int szsrc, std::string* dest,
++                  bool do_padding);
++void WebSafeBase64Escape(const unsigned char* src, int szsrc, std::string* dest,
++                         bool do_padding);
+ 
+ inline bool IsValidCodePoint(uint32_t code_point) {
+   return code_point < 0xD800 ||
+@@ -651,13 +634,13 @@ static const int UTFmax = 4;
+ //  in any external dependencies. The output buffer must be as least 4 bytes
+ //  large.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int EncodeAsUTF8Char(uint32_t code_point, char* output);
++int EncodeAsUTF8Char(uint32_t code_point, char* output);
+ 
+ // ----------------------------------------------------------------------
+ // UTF8FirstLetterNumBytes()
+ //   Length of the first UTF-8 character.
+ // ----------------------------------------------------------------------
+-PROTOBUF_EXPORT int UTF8FirstLetterNumBytes(const char* src, int len);
++int UTF8FirstLetterNumBytes(const char* src, int len);
+ 
+ // From google3/third_party/absl/strings/escaping.h
+ 
+@@ -693,13 +676,11 @@ PROTOBUF_EXPORT int UTF8FirstLetterNumBytes(const char* src, int len);
+ //
+ //       (1) determines the presence of LF (first one is ok)
+ //       (2) if yes, removes any CR, else convert every CR to LF
+-PROTOBUF_EXPORT void CleanStringLineEndings(const std::string& src,
+-                                            std::string* dst,
+-                                            bool auto_end_last_line);
++void CleanStringLineEndings(const std::string& src, std::string* dst,
++                            bool auto_end_last_line);
+ 
+ // Same as above, but transforms the argument in place.
+-PROTOBUF_EXPORT void CleanStringLineEndings(std::string* str,
+-                                            bool auto_end_last_line);
++void CleanStringLineEndings(std::string* str, bool auto_end_last_line);
+ 
+ namespace strings {
+ inline bool EndsWith(absl::string_view text, absl::string_view suffix) {
+@@ -720,6 +701,5 @@ double NoLocaleStrtod(const char* str, char** endptr);
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include <google/protobuf/util/converter/port_undef.inc>
+ 
+ #endif  // GOOGLE_PROTOBUF_STUBS_STRUTIL_H__
+\ No newline at end of file
+diff --git a/src/google/protobuf/util/converter/BUILD.bazel b/src/google/protobuf/util/converter/BUILD.bazel
+index bff9574..bcfa7ea 100644
+--- a/src/google/protobuf/util/converter/BUILD.bazel
++++ b/src/google/protobuf/util/converter/BUILD.bazel
+@@ -28,8 +28,7 @@ cc_library(
+     hdrs = ["constants.h"],
+     strip_include_prefix = "/src",
+     deps = [
+-        "//src/google/protobuf/stubs",
+-        "//src/google/protobuf/util/converter:port_def",
++        "//src/google/protobuf/util/converter:port",
+     ],
+ )
+ 
+@@ -42,19 +41,16 @@ cc_library(
+     deps = [
+         ":constants",
+         ":utility",
+-        "//src/google/protobuf/stubs",
+-        "//src/google/protobuf/util/converter:port_def",
++        "//src/google/protobuf/util/converter:port",
+         "@com_google_absl//absl/strings",
+         "@com_google_protobuf//:protobuf",
+     ],
+ )
+ 
+ cc_library(
+-    name = "port_def",
++    name = "port",
+     hdrs = [
+         "port.h",
+-        "port_def.inc",
+-        "port_undef.inc",
+     ],
+     strip_include_prefix = "/src",
+     visibility = [
+@@ -78,7 +74,7 @@ cc_library(
+         ":type_info",
+         ":utility",
+         "//src/google/protobuf/stubs",
+-        "//src/google/protobuf/util/converter:port_def",
++        "//src/google/protobuf/util/converter:port",
+     ],
+ )
+ 
+@@ -133,7 +129,7 @@ cc_library(
+         ":object_writer",
+         ":utility",
+         "//src/google/protobuf/stubs",
+-        "//src/google/protobuf/util/converter:port_def",
++        "//src/google/protobuf/util/converter:port",
+         "@com_google_absl//absl/status",
+         "@com_google_absl//absl/strings",
+         "@com_google_protobuf//:protobuf",
+diff --git a/src/google/protobuf/util/converter/constants.h b/src/google/protobuf/util/converter/constants.h
+index ff75f92..3843aa2 100644
+--- a/src/google/protobuf/util/converter/constants.h
++++ b/src/google/protobuf/util/converter/constants.h
+@@ -19,8 +19,6 @@
+ 
+ #include <cstdint>
+ 
+-#include "google/protobuf/stubs/common.h"
+-
+ // This file contains constants used by //net/proto2/util/converter.
+ 
+ namespace google {
+diff --git a/src/google/protobuf/util/converter/datapiece.cc b/src/google/protobuf/util/converter/datapiece.cc
+index 3acd35d..c7c12ef 100644
+--- a/src/google/protobuf/util/converter/datapiece.cc
++++ b/src/google/protobuf/util/converter/datapiece.cc
+@@ -18,18 +18,17 @@
+ #include <cstdint>
+ #include <limits>
+ 
+-#include "google/protobuf/struct.pb.h"
+-#include "google/protobuf/type.pb.h"
+-#include "google/protobuf/descriptor.h"
+ #include "absl/status/status.h"
+ #include "absl/strings/ascii.h"
+ #include "absl/strings/cord.h"
+ #include "absl/strings/escaping.h"
++#include "absl/strings/match.h"
+ #include "absl/strings/str_cat.h"
+-#include "google/protobuf/util/converter/utility.h"
+-#include "google/protobuf/stubs/strutil.h"
++#include "google/protobuf/descriptor.h"
++#include "google/protobuf/struct.pb.h"
+ #include "google/protobuf/stubs/strutil.h"
+-#include "absl/strings/match.h"
++#include "google/protobuf/type.pb.h"
++#include "google/protobuf/util/converter/utility.h"
+ 
+ namespace google {
+ namespace protobuf {
+diff --git a/src/google/protobuf/util/converter/datapiece.h b/src/google/protobuf/util/converter/datapiece.h
+index 68b6b0e..fc25a7a 100644
+--- a/src/google/protobuf/util/converter/datapiece.h
++++ b/src/google/protobuf/util/converter/datapiece.h
+@@ -20,15 +20,10 @@
+ #include <cstdint>
+ #include <string>
+ 
+-#include "google/protobuf/stubs/common.h"
+-#include "google/protobuf/type.pb.h"
+ #include "absl/log/absl_log.h"
+-
+ #include "absl/status/statusor.h"
+ #include "absl/strings/string_view.h"
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "google/protobuf/type.pb.h"
+ 
+ namespace google {
+ namespace protobuf {
+@@ -46,7 +41,7 @@ class ProtoWriter;
+ // storage for the actual string or Cord, so it is the user's responsibility to
+ // guarantee that the underlying storage is still valid when the DataPiece is
+ // accessed.
+-class PROTOBUF_EXPORT DataPiece {
++class DataPiece {
+  public:
+   // Identifies data type of the value.
+   // These are the types supported by DataPiece.
+@@ -107,8 +102,7 @@ class PROTOBUF_EXPORT DataPiece {
+ 
+   static DataPiece NullData() { return DataPiece(TYPE_NULL, 0); }
+ 
+-  virtual ~DataPiece() {
+-  }
++  virtual ~DataPiece() {}
+ 
+   // Accessors
+   Type type() const { return type_; }
+@@ -120,7 +114,6 @@ class PROTOBUF_EXPORT DataPiece {
+     return str_;
+   }
+ 
+-
+   // Parses, casts or converts the value stored in the DataPiece into an int32.
+   absl::StatusOr<int32_t> ToInt32() const;
+ 
+@@ -206,6 +199,4 @@ class PROTOBUF_EXPORT DataPiece {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_DATAPIECE_H_
+diff --git a/src/google/protobuf/util/converter/default_value_objectwriter.h b/src/google/protobuf/util/converter/default_value_objectwriter.h
+index 0b253c8..4538fc7 100644
+--- a/src/google/protobuf/util/converter/default_value_objectwriter.h
++++ b/src/google/protobuf/util/converter/default_value_objectwriter.h
+@@ -31,9 +31,6 @@
+ #include "google/protobuf/util/converter/utility.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -45,7 +42,7 @@ namespace converter {
+ // ObjectWriter when EndObject() is called on the root object. It also writes
+ // out all non-repeated primitive fields that haven't been explicitly rendered
+ // with their default values (0 for numbers, "" for strings, etc).
+-class PROTOBUF_EXPORT DefaultValueObjectWriter : public ObjectWriter {
++class DefaultValueObjectWriter : public ObjectWriter {
+  public:
+   // A Callback function to check whether a field needs to be scrubbed.
+   //
+@@ -134,7 +131,7 @@ class PROTOBUF_EXPORT DefaultValueObjectWriter : public ObjectWriter {
+ 
+   // "Node" represents a node in the tree that holds the input of
+   // DefaultValueObjectWriter.
+-  class PROTOBUF_EXPORT Node {
++  class Node {
+    public:
+     Node(const std::string& name, const google::protobuf::Type* type,
+          NodeKind kind, const DataPiece& data, bool is_placeholder,
+@@ -312,6 +309,4 @@ class PROTOBUF_EXPORT DefaultValueObjectWriter : public ObjectWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_DEFAULT_VALUE_OBJECTWRITER_H_
+diff --git a/src/google/protobuf/util/converter/error_listener.h b/src/google/protobuf/util/converter/error_listener.h
+index 2d671a5..04c4df6 100644
+--- a/src/google/protobuf/util/converter/error_listener.h
++++ b/src/google/protobuf/util/converter/error_listener.h
+@@ -22,21 +22,17 @@
+ #include <string>
+ #include <vector>
+ 
+-#include "google/protobuf/stubs/callback.h"
+-#include "google/protobuf/stubs/common.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/stubs/callback.h"
+ #include "google/protobuf/util/converter/location_tracker.h"
+ 
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ 
+ // Interface for error listener.
+-class PROTOBUF_EXPORT ErrorListener {
++class ErrorListener {
+  public:
+   ErrorListener(const ErrorListener&) = delete;
+   ErrorListener& operator=(const ErrorListener&) = delete;
+@@ -61,7 +57,7 @@ class PROTOBUF_EXPORT ErrorListener {
+ };
+ 
+ // An error listener that ignores all errors.
+-class PROTOBUF_EXPORT NoopErrorListener : public ErrorListener {
++class NoopErrorListener : public ErrorListener {
+  public:
+   NoopErrorListener() {}
+   NoopErrorListener(const NoopErrorListener&) = delete;
+@@ -80,12 +76,9 @@ class PROTOBUF_EXPORT NoopErrorListener : public ErrorListener {
+                     absl::string_view /* missing_name */) override {}
+ };
+ 
+-
+ }  // namespace converter
+ }  // namespace util
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_ERROR_LISTENER_H_
+diff --git a/src/google/protobuf/util/converter/field_mask_utility.cc b/src/google/protobuf/util/converter/field_mask_utility.cc
+index 03736d7..c3a8ec2 100644
+--- a/src/google/protobuf/util/converter/field_mask_utility.cc
++++ b/src/google/protobuf/util/converter/field_mask_utility.cc
+@@ -17,11 +17,8 @@
+ #include "absl/status/status.h"
+ #include "absl/strings/match.h"
+ #include "absl/strings/str_cat.h"
+-#include "google/protobuf/util/converter/utility.h"
+ #include "google/protobuf/stubs/status_macros.h"
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "google/protobuf/util/converter/utility.h"
+ 
+ namespace google {
+ namespace protobuf {
+diff --git a/src/google/protobuf/util/converter/json_objectwriter.h b/src/google/protobuf/util/converter/json_objectwriter.h
+index e3caf4d..4069682 100644
+--- a/src/google/protobuf/util/converter/json_objectwriter.h
++++ b/src/google/protobuf/util/converter/json_objectwriter.h
+@@ -21,20 +21,15 @@
+ #include <memory>
+ #include <string>
+ 
++#include "google/protobuf/io/coded_stream.h"
+ #include "google/protobuf/stubs/bytestream.h"
+ #include "google/protobuf/util/converter/structured_objectwriter.h"
+-#include "google/protobuf/io/coded_stream.h"
+-
+-// clang-format off
+-#include "google/protobuf/util/converter/port_def.inc"
+-// clang-format on
+ 
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ 
+-
+ // An ObjectWriter implementation that outputs JSON. This ObjectWriter
+ // supports writing a compact form or a pretty printed form.
+ //
+@@ -74,7 +69,7 @@ namespace converter {
+ // uint64 would lose precision if rendered as numbers.
+ //
+ // JsonObjectWriter is thread-unsafe.
+-class PROTOBUF_EXPORT JsonObjectWriter : public StructuredObjectWriter {
++class JsonObjectWriter : public StructuredObjectWriter {
+  public:
+   JsonObjectWriter(absl::string_view indent_string, io::CodedOutputStream* out)
+       : element_(new Element(/*parent=*/nullptr, /*is_json_object=*/false)),
+@@ -127,7 +122,7 @@ class PROTOBUF_EXPORT JsonObjectWriter : public StructuredObjectWriter {
+   }
+ 
+  protected:
+-  class PROTOBUF_EXPORT Element : public BaseElement {
++  class Element : public BaseElement {
+    public:
+     Element(Element* parent, bool is_json_object)
+         : BaseElement(parent),
+@@ -158,7 +153,7 @@ class PROTOBUF_EXPORT JsonObjectWriter : public StructuredObjectWriter {
+   Element* element() override { return element_.get(); }
+ 
+  private:
+-  class PROTOBUF_EXPORT ByteSinkWrapper : public strings::ByteSink {
++  class ByteSinkWrapper : public strings::ByteSink {
+    public:
+     explicit ByteSinkWrapper(io::CodedOutputStream* stream) : stream_(stream) {}
+     ByteSinkWrapper(const ByteSinkWrapper&) = delete;
+@@ -260,6 +255,4 @@ class PROTOBUF_EXPORT JsonObjectWriter : public StructuredObjectWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_JSON_OBJECTWRITER_H_
+diff --git a/src/google/protobuf/util/converter/json_stream_parser.h b/src/google/protobuf/util/converter/json_stream_parser.h
+index ed30e3a..3cc40a4 100644
+--- a/src/google/protobuf/util/converter/json_stream_parser.h
++++ b/src/google/protobuf/util/converter/json_stream_parser.h
+@@ -21,22 +21,15 @@
+ #include <stack>
+ #include <string>
+ 
+-#include "google/protobuf/stubs/common.h"
+ #include "absl/status/status.h"
+-#include "absl/types/optional.h"
+-
+ #include "absl/strings/string_view.h"
+-
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "absl/types/optional.h"
+ 
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ 
+-
+ class ObjectWriter;
+ 
+ // A JSON parser that can parse a stream of JSON chunks rather than needing the
+@@ -59,7 +52,7 @@ class ObjectWriter;
+ //
+ // This parser is thread-compatible as long as only one thread is calling a
+ // Parse() method at a time.
+-class PROTOBUF_EXPORT JsonStreamParser {
++class JsonStreamParser {
+  public:
+   // Creates a JsonStreamParser that will write to the given ObjectWriter.
+   explicit JsonStreamParser(ObjectWriter* ow);
+@@ -74,14 +67,12 @@ class PROTOBUF_EXPORT JsonStreamParser {
+   // string snippet of the error with type_url kParseErrorSnippetUrl.
+   absl::Status Parse(absl::string_view json);
+ 
+-
+   // Finish parsing the JSON string. If the returned status is non-ok, the
+   // status might contain a payload ParseErrorType with type_url
+   // kParseErrorTypeUrl and a payload containing string snippet of the error
+   // with type_url kParseErrorSnippetUrl.
+   absl::Status FinishParse();
+ 
+-
+   // Sets the max recursion depth of JSON message to be deserialized. JSON
+   // messages over this depth will fail to be deserialized.
+   // Default value is 100.
+@@ -331,6 +322,4 @@ class PROTOBUF_EXPORT JsonStreamParser {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_JSON_STREAM_PARSER_H_
+diff --git a/src/google/protobuf/util/converter/legacy_json_util.cc b/src/google/protobuf/util/converter/legacy_json_util.cc
+index 6f37aa5..0ea7e3c 100644
+--- a/src/google/protobuf/util/converter/legacy_json_util.cc
++++ b/src/google/protobuf/util/converter/legacy_json_util.cc
+@@ -18,26 +18,22 @@
+ 
+ #include "absl/base/call_once.h"
+ #include "absl/status/status.h"
+-#include "google/protobuf/stubs/bytestream.h"
+ #include "absl/strings/str_cat.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/io/coded_stream.h"
++#include "google/protobuf/io/zero_copy_sink.h"
++#include "google/protobuf/io/zero_copy_stream.h"
++#include "google/protobuf/stubs/bytestream.h"
++#include "google/protobuf/stubs/status_macros.h"
+ #include "google/protobuf/util/converter/default_value_objectwriter.h"
+ #include "google/protobuf/util/converter/error_listener.h"
+ #include "google/protobuf/util/converter/json_objectwriter.h"
+ #include "google/protobuf/util/converter/json_stream_parser.h"
+ #include "google/protobuf/util/converter/protostream_objectsource.h"
+ #include "google/protobuf/util/converter/protostream_objectwriter.h"
+-#include "google/protobuf/io/coded_stream.h"
+-#include "google/protobuf/io/zero_copy_sink.h"
+-#include "google/protobuf/io/zero_copy_stream.h"
+ #include "google/protobuf/util/type_resolver.h"
+ #include "google/protobuf/util/type_resolver_util.h"
+-#include "google/protobuf/stubs/status_macros.h"
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+ 
+-namespace google {
+ namespace protobuf {
+ namespace util {
+ using ::google::protobuf::io::zc_sink_internal::ZeroCopyStreamByteSink;
+diff --git a/src/google/protobuf/util/converter/legacy_json_util.h b/src/google/protobuf/util/converter/legacy_json_util.h
+index 3399da0..44c0d07 100644
+--- a/src/google/protobuf/util/converter/legacy_json_util.h
++++ b/src/google/protobuf/util/converter/legacy_json_util.h
+@@ -24,9 +24,6 @@
+ #include "google/protobuf/message.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -57,27 +54,27 @@ struct JsonPrintOptions {
+ 
+ typedef JsonPrintOptions JsonOptions;
+ 
+-PROTOBUF_EXPORT absl::Status MessageToJsonString(const Message& message,
+-                                                 std::string* output,
+-                                                 const JsonOptions& options);
++absl::Status MessageToJsonString(const Message& message, std::string* output,
++                                 const JsonOptions& options);
+ 
+ inline absl::Status MessageToJsonString(const Message& message,
+                                         std::string* output) {
+   return MessageToJsonString(message, output, JsonOptions());
+ }
+ 
+-PROTOBUF_EXPORT absl::Status JsonStringToMessage(
+-    absl::string_view input, Message* message, const JsonParseOptions& options);
++absl::Status JsonStringToMessage(absl::string_view input, Message* message,
++                                 const JsonParseOptions& options);
+ 
+ inline absl::Status JsonStringToMessage(absl::string_view input,
+                                         Message* message) {
+   return JsonStringToMessage(input, message, JsonParseOptions());
+ }
+ 
+-PROTOBUF_EXPORT absl::Status BinaryToJsonStream(
+-    TypeResolver* resolver, const std::string& type_url,
+-    io::ZeroCopyInputStream* binary_input,
+-    io::ZeroCopyOutputStream* json_output, const JsonPrintOptions& options);
++absl::Status BinaryToJsonStream(TypeResolver* resolver,
++                                const std::string& type_url,
++                                io::ZeroCopyInputStream* binary_input,
++                                io::ZeroCopyOutputStream* json_output,
++                                const JsonPrintOptions& options);
+ 
+ inline absl::Status BinaryToJsonStream(TypeResolver* resolver,
+                                        const std::string& type_url,
+@@ -87,10 +84,11 @@ inline absl::Status BinaryToJsonStream(TypeResolver* resolver,
+                             JsonPrintOptions());
+ }
+ 
+-PROTOBUF_EXPORT absl::Status BinaryToJsonString(
+-    TypeResolver* resolver, const std::string& type_url,
+-    const std::string& binary_input, std::string* json_output,
+-    const JsonPrintOptions& options);
++absl::Status BinaryToJsonString(TypeResolver* resolver,
++                                const std::string& type_url,
++                                const std::string& binary_input,
++                                std::string* json_output,
++                                const JsonPrintOptions& options);
+ 
+ inline absl::Status BinaryToJsonString(TypeResolver* resolver,
+                                        const std::string& type_url,
+@@ -100,10 +98,11 @@ inline absl::Status BinaryToJsonString(TypeResolver* resolver,
+                             JsonPrintOptions());
+ }
+ 
+-PROTOBUF_EXPORT absl::Status JsonToBinaryStream(
+-    TypeResolver* resolver, const std::string& type_url,
+-    io::ZeroCopyInputStream* json_input,
+-    io::ZeroCopyOutputStream* binary_output, const JsonParseOptions& options);
++absl::Status JsonToBinaryStream(TypeResolver* resolver,
++                                const std::string& type_url,
++                                io::ZeroCopyInputStream* json_input,
++                                io::ZeroCopyOutputStream* binary_output,
++                                const JsonParseOptions& options);
+ 
+ inline absl::Status JsonToBinaryStream(
+     TypeResolver* resolver, const std::string& type_url,
+@@ -113,10 +112,11 @@ inline absl::Status JsonToBinaryStream(
+                             JsonParseOptions());
+ }
+ 
+-PROTOBUF_EXPORT absl::Status JsonToBinaryString(
+-    TypeResolver* resolver, const std::string& type_url,
+-    absl::string_view json_input, std::string* binary_output,
+-    const JsonParseOptions& options);
++absl::Status JsonToBinaryString(TypeResolver* resolver,
++                                const std::string& type_url,
++                                absl::string_view json_input,
++                                std::string* binary_output,
++                                const JsonParseOptions& options);
+ 
+ inline absl::Status JsonToBinaryString(TypeResolver* resolver,
+                                        const std::string& type_url,
+@@ -130,6 +130,4 @@ inline absl::Status JsonToBinaryString(TypeResolver* resolver,
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_JSON_LEGACY_UTIL_H_
+diff --git a/src/google/protobuf/util/converter/legacy_json_util_test.cc b/src/google/protobuf/util/converter/legacy_json_util_test.cc
+index eda760a..c95abe9 100644
+--- a/src/google/protobuf/util/converter/legacy_json_util_test.cc
++++ b/src/google/protobuf/util/converter/legacy_json_util_test.cc
+@@ -14,6 +14,9 @@
+ 
+ #include "google/protobuf/util/converter/legacy_json_util.h"
+ 
++#include <gmock/gmock.h>
++#include <gtest/gtest.h>
++
+ #include <algorithm>
+ #include <cstdint>
+ #include <list>
+@@ -21,29 +24,24 @@
+ #include <string>
+ #include <vector>
+ 
+-#include "google/protobuf/duration.pb.h"
+-#include "google/protobuf/field_mask.pb.h"
+-#include "google/protobuf/struct.pb.h"
+-#include "google/protobuf/timestamp.pb.h"
+-#include "google/protobuf/wrappers.pb.h"
+-#include <gmock/gmock.h>
+-#include <gtest/gtest.h>
+ #include "absl/status/status.h"
+ #include "absl/status/statusor.h"
+ #include "absl/strings/string_view.h"
+-#include "google/protobuf/util/converter/testdata/maps.pb.h"
+ #include "google/protobuf/descriptor_database.h"
++#include "google/protobuf/duration.pb.h"
+ #include "google/protobuf/dynamic_message.h"
++#include "google/protobuf/field_mask.pb.h"
+ #include "google/protobuf/io/zero_copy_stream_impl_lite.h"
++#include "google/protobuf/struct.pb.h"
++#include "google/protobuf/stubs/status_macros.h"
++#include "google/protobuf/timestamp.pb.h"
++#include "google/protobuf/unittest.pb.h"
++#include "google/protobuf/util/converter/testdata/maps.pb.h"
+ #include "google/protobuf/util/json_format.pb.h"
+ #include "google/protobuf/util/json_format_proto3.pb.h"
+-#include "google/protobuf/unittest.pb.h"
+ #include "google/protobuf/util/type_resolver.h"
+ #include "google/protobuf/util/type_resolver_util.h"
+-#include "google/protobuf/stubs/status_macros.h"
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "google/protobuf/wrappers.pb.h"
+ 
+ namespace google {
+ namespace protobuf {
+@@ -257,7 +255,6 @@ TEST_P(JsonTest, TestPreserveProtoFieldNames) {
+   JsonPrintOptions options;
+   options.preserve_proto_field_names = true;
+   EXPECT_THAT(ToJson(m, options), IsOkAndHolds("{\"message_value\":{}}"));
+-
+ }
+ 
+ TEST_P(JsonTest, Camels) {
+@@ -971,7 +968,6 @@ TEST_P(JsonTest, TestOverwriteRepeated) {
+   EXPECT_THAT(m.repeated_int32_value(), ElementsAre(1, 2, 3));
+ }
+ 
+-
+ TEST_P(JsonTest, TestDuration) {
+   auto m = ToProto<proto3::TestDuration>(R"json(
+     {
+diff --git a/src/google/protobuf/util/converter/location_tracker.h b/src/google/protobuf/util/converter/location_tracker.h
+index 1246114..5c896f2 100644
+--- a/src/google/protobuf/util/converter/location_tracker.h
++++ b/src/google/protobuf/util/converter/location_tracker.h
+@@ -19,9 +19,6 @@
+ 
+ #include <string>
+ 
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -29,7 +26,7 @@ namespace converter {
+ 
+ // LocationTrackerInterface is an interface for classes that track
+ // the location information for the purpose of error reporting.
+-class PROTOBUF_EXPORT LocationTrackerInterface {
++class LocationTrackerInterface {
+  public:
+   LocationTrackerInterface(const LocationTrackerInterface&) = delete;
+   LocationTrackerInterface& operator=(const LocationTrackerInterface&) = delete;
+@@ -50,6 +47,4 @@ class PROTOBUF_EXPORT LocationTrackerInterface {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_LOCATION_TRACKER_H_
+diff --git a/src/google/protobuf/util/converter/object_source.h b/src/google/protobuf/util/converter/object_source.h
+index 6a780d5..6d048aa 100644
+--- a/src/google/protobuf/util/converter/object_source.h
++++ b/src/google/protobuf/util/converter/object_source.h
+@@ -20,10 +20,6 @@
+ #include "absl/status/status.h"
+ #include "absl/strings/string_view.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -37,7 +33,7 @@ class ObjectWriter;
+ // example, a character stream, or protobuf.
+ //
+ // Derived classes could be thread-unsafe.
+-class PROTOBUF_EXPORT ObjectSource {
++class ObjectSource {
+  public:
+   ObjectSource(const ObjectSource&) = delete;
+   ObjectSource& operator=(const ObjectSource&) = delete;
+@@ -63,6 +59,4 @@ class PROTOBUF_EXPORT ObjectSource {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_OBJECT_SOURCE_H_
+diff --git a/src/google/protobuf/util/converter/object_writer.h b/src/google/protobuf/util/converter/object_writer.h
+index 499d9c0..5a7df8e 100644
+--- a/src/google/protobuf/util/converter/object_writer.h
++++ b/src/google/protobuf/util/converter/object_writer.h
+@@ -19,19 +19,13 @@
+ 
+ #include <cstdint>
+ 
+-#include "google/protobuf/stubs/common.h"
+-
+ #include "absl/strings/string_view.h"
+ 
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ 
+-
+ class DataPiece;
+ 
+ // An ObjectWriter is an interface for writing a stream of events
+@@ -48,7 +42,7 @@ class DataPiece;
+ //
+ // TODO(xinb): seems like a prime candidate to apply the RAII paradigm
+ // and get rid the need to call EndXXX().
+-class PROTOBUF_EXPORT ObjectWriter {
++class ObjectWriter {
+  public:
+   ObjectWriter(const ObjectWriter&) = delete;
+   ObjectWriter& operator=(const ObjectWriter&) = delete;
+@@ -83,7 +77,6 @@ class PROTOBUF_EXPORT ObjectWriter {
+   virtual ObjectWriter* RenderUint64(absl::string_view name,
+                                      uint64_t value) = 0;
+ 
+-
+   // Renders a double value.
+   virtual ObjectWriter* RenderDouble(absl::string_view name, double value) = 0;
+   // Renders a float value.
+@@ -100,12 +93,10 @@ class PROTOBUF_EXPORT ObjectWriter {
+   // Renders a Null value.
+   virtual ObjectWriter* RenderNull(absl::string_view name) = 0;
+ 
+-
+   // Renders a DataPiece object to a ObjectWriter.
+   static void RenderDataPieceTo(const DataPiece& data, absl::string_view name,
+                                 ObjectWriter* ow);
+ 
+-
+   // Indicates whether this ObjectWriter has completed writing the root message,
+   // usually this means writing of one complete object. Subclasses must override
+   // this behavior appropriately.
+@@ -133,6 +124,4 @@ class PROTOBUF_EXPORT ObjectWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_OBJECT_WRITER_H_
+diff --git a/src/google/protobuf/util/converter/proto_writer.cc b/src/google/protobuf/util/converter/proto_writer.cc
+index 2683c08..f1f718e 100644
+--- a/src/google/protobuf/util/converter/proto_writer.cc
++++ b/src/google/protobuf/util/converter/proto_writer.cc
+@@ -34,10 +34,6 @@
+ #include "google/protobuf/util/converter/utility.h"
+ #include "google/protobuf/wire_format_lite.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -45,7 +41,6 @@ namespace converter {
+ using ::google::protobuf::internal::WireFormatLite;
+ using ::google::protobuf::io::CodedOutputStream;
+ 
+-
+ ProtoWriter::ProtoWriter(TypeResolver* type_resolver,
+                          const google::protobuf::Type& type,
+                          strings::ByteSink* output, ErrorListener* listener)
+@@ -437,8 +432,7 @@ void ProtoWriter::MissingField(absl::string_view missing_name) {
+   listener_->MissingField(location(), missing_name);
+ }
+ 
+-ProtoWriter* ProtoWriter::StartObject(
+-    absl::string_view name) {
++ProtoWriter* ProtoWriter::StartObject(absl::string_view name) {
+   // Starting the root message. Create the root ProtoElement and return.
+   if (element_ == nullptr) {
+     if (!name.empty()) {
+@@ -470,7 +464,6 @@ ProtoWriter* ProtoWriter::StartObject(
+   return StartObjectField(*field, *type);
+ }
+ 
+-
+ ProtoWriter* ProtoWriter::EndObject() {
+   if (invalid_depth_ > 0) {
+     --invalid_depth_;
+@@ -481,7 +474,6 @@ ProtoWriter* ProtoWriter::EndObject() {
+     element_.reset(element_->pop());
+   }
+ 
+-
+   // If ending the root element,
+   // then serialize the full message with calculated sizes.
+   if (element_ == nullptr) {
+@@ -490,9 +482,7 @@ ProtoWriter* ProtoWriter::EndObject() {
+   return this;
+ }
+ 
+-ProtoWriter* ProtoWriter::StartList(
+-    absl::string_view name) {
+-
++ProtoWriter* ProtoWriter::StartList(absl::string_view name) {
+   const google::protobuf::Field* field = BeginNamed(name, true);
+ 
+   if (field == nullptr) return this;
+@@ -513,7 +503,6 @@ ProtoWriter* ProtoWriter::StartList(
+   return StartListField(*field, *type);
+ }
+ 
+-
+ ProtoWriter* ProtoWriter::EndList() {
+   if (invalid_depth_ > 0) {
+     --invalid_depth_;
+@@ -523,8 +512,8 @@ ProtoWriter* ProtoWriter::EndList() {
+   return this;
+ }
+ 
+-ProtoWriter* ProtoWriter::RenderDataPiece(
+-    absl::string_view name, const DataPiece& data) {
++ProtoWriter* ProtoWriter::RenderDataPiece(absl::string_view name,
++                                          const DataPiece& data) {
+   absl::Status status;
+   if (invalid_depth_ > 0) return this;
+ 
+@@ -568,7 +557,7 @@ bool ProtoWriter::IsRepeated(const google::protobuf::Field& field) {
+ 
+ ProtoWriter* ProtoWriter::StartObjectField(const google::protobuf::Field& field,
+                                            const google::protobuf::Type& type) {
+-    WriteTag(field);
++  WriteTag(field);
+   element_.reset(new ProtoElement(element_.release(), &field, type, false));
+   return this;
+ }
+@@ -803,7 +792,6 @@ void ProtoWriter::WriteTag(const google::protobuf::Field& field) {
+   stream_->WriteTag(WireFormatLite::MakeTag(field.number(), wire_type));
+ }
+ 
+-
+ }  // namespace converter
+ }  // namespace util
+ }  // namespace protobuf
+diff --git a/src/google/protobuf/util/converter/proto_writer.h b/src/google/protobuf/util/converter/proto_writer.h
+index dd28102..bce0d4a 100644
+--- a/src/google/protobuf/util/converter/proto_writer.h
++++ b/src/google/protobuf/util/converter/proto_writer.h
+@@ -22,29 +22,24 @@
+ #include <string>
+ #include <vector>
+ 
+-#include "google/protobuf/type.pb.h"
+-#include "google/protobuf/descriptor.h"
+ #include "absl/container/flat_hash_set.h"
+ #include "absl/status/status.h"
++#include "google/protobuf/descriptor.h"
++#include "google/protobuf/io/coded_stream.h"
++#include "google/protobuf/io/zero_copy_stream_impl.h"
+ #include "google/protobuf/stubs/bytestream.h"
++#include "google/protobuf/type.pb.h"
+ #include "google/protobuf/util/converter/datapiece.h"
+ #include "google/protobuf/util/converter/error_listener.h"
+ #include "google/protobuf/util/converter/structured_objectwriter.h"
+ #include "google/protobuf/util/converter/type_info.h"
+-#include "google/protobuf/io/coded_stream.h"
+-#include "google/protobuf/io/zero_copy_stream_impl.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ 
+-
+ class ObjectLocationTracker;
+ 
+ // An ObjectWriter that can write protobuf bytes directly from writer events.
+@@ -53,9 +48,9 @@ class ObjectLocationTracker;
+ // special types by inheriting from it or by wrapping it.
+ //
+ // It also supports streaming.
+-class PROTOBUF_EXPORT ProtoWriter : public StructuredObjectWriter {
++class ProtoWriter : public StructuredObjectWriter {
+  public:
+-// Constructor. Does not take ownership of any parameter passed in.
++  // Constructor. Does not take ownership of any parameter passed in.
+   ProtoWriter(TypeResolver* type_resolver, const google::protobuf::Type& type,
+               strings::ByteSink* output, ErrorListener* listener);
+   ProtoWriter() = delete;
+@@ -105,13 +100,11 @@ class PROTOBUF_EXPORT ProtoWriter : public StructuredObjectWriter {
+     return RenderDataPiece(name, DataPiece::NullData());
+   }
+ 
+-
+   // Renders a DataPiece 'value' into a field whose wire type is determined
+   // from the given field 'name'.
+   virtual ProtoWriter* RenderDataPiece(absl::string_view name,
+                                        const DataPiece& data);
+ 
+-
+   // Returns the location tracker to use for tracking locations for errors.
+   const LocationTrackerInterface& location() {
+     return element_ != nullptr ? *element_ : *tracker_;
+@@ -156,8 +149,7 @@ class PROTOBUF_EXPORT ProtoWriter : public StructuredObjectWriter {
+   }
+ 
+  protected:
+-  class PROTOBUF_EXPORT ProtoElement : public BaseElement,
+-                                       public LocationTrackerInterface {
++  class ProtoElement : public BaseElement, public LocationTrackerInterface {
+    public:
+     // Constructor for the root element. No parent nor field.
+     ProtoElement(const TypeInfo* typeinfo, const google::protobuf::Type& type,
+@@ -278,7 +270,6 @@ class PROTOBUF_EXPORT ProtoWriter : public StructuredObjectWriter {
+   // Helper method to write proto tags based on the given field.
+   void WriteTag(const google::protobuf::Field& field);
+ 
+-
+   // Returns true if the field for type_ can be set as a oneof. If field is not
+   // a oneof type, this function does nothing and returns true.
+   // If another field for this oneof is already set, this function returns
+@@ -371,6 +362,4 @@ class PROTOBUF_EXPORT ProtoWriter : public StructuredObjectWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_PROTO_WRITER_H_
+diff --git a/src/google/protobuf/util/converter/protostream_objectsource.cc b/src/google/protobuf/util/converter/protostream_objectsource.cc
+index fa4fe38..fa64ccd 100644
+--- a/src/google/protobuf/util/converter/protostream_objectsource.cc
++++ b/src/google/protobuf/util/converter/protostream_objectsource.cc
+@@ -18,10 +18,6 @@
+ #include <utility>
+ #include <vector>
+ 
+-#include "google/protobuf/descriptor.h"
+-#include "google/protobuf/unknown_field_set.h"
+-#include "google/protobuf/stubs/strutil.h"
+-#include "google/protobuf/stubs/strutil.h"
+ #include "absl/base/call_once.h"
+ #include "absl/base/casts.h"
+ #include "absl/container/btree_map.h"
+@@ -32,19 +28,17 @@
+ #include "absl/strings/str_format.h"
+ #include "absl/strings/string_view.h"
+ #include "absl/time/time.h"
++#include "google/protobuf/descriptor.h"
++#include "google/protobuf/io/coded_stream.h"
++#include "google/protobuf/io/zero_copy_stream_impl.h"
++#include "google/protobuf/stubs/status_macros.h"
++#include "google/protobuf/stubs/strutil.h"
++#include "google/protobuf/unknown_field_set.h"
+ #include "google/protobuf/util/converter/constants.h"
+ #include "google/protobuf/util/converter/field_mask_utility.h"
+ #include "google/protobuf/util/converter/utility.h"
+-#include "google/protobuf/io/coded_stream.h"
+-#include "google/protobuf/io/zero_copy_stream_impl.h"
+ #include "google/protobuf/wire_format.h"
+ #include "google/protobuf/wire_format_lite.h"
+-#include "google/protobuf/stubs/status_macros.h"
+-
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ 
+ namespace google {
+ namespace protobuf {
+@@ -94,7 +88,6 @@ absl::StatusOr<std::string> MapKeyDefaultValueAsString(
+ }
+ }  // namespace
+ 
+-
+ ProtoStreamObjectSource::ProtoStreamObjectSource(
+     io::CodedInputStream* stream, TypeResolver* type_resolver,
+     const google::protobuf::Type& type, const RenderOptions& render_options)
+@@ -162,7 +155,6 @@ absl::Status ProtoStreamObjectSource::WriteMessage(
+     const google::protobuf::Type& type, absl::string_view name,
+     const uint32_t end_tag, bool include_start_and_end,
+     ObjectWriter* ow) const {
+-
+   const TypeRenderer* type_renderer = FindTypeRenderer(type.name());
+   if (type_renderer != nullptr) {
+     return (*type_renderer)(this, type, name, ow);
+@@ -174,7 +166,6 @@ absl::Status ProtoStreamObjectSource::WriteMessage(
+   uint32_t tag = stream_->ReadTag(), last_tag = tag + 1;
+   UnknownFieldSet unknown_fields;
+ 
+-
+   if (include_start_and_end) {
+     ow->StartObject(name);
+   }
+@@ -193,9 +184,7 @@ absl::Status ProtoStreamObjectSource::WriteMessage(
+     if (field == nullptr) {
+       // If we didn't find a field, skip this unknown tag.
+       // TODO(wpoon): Check return boolean value.
+-      WireFormat::SkipField(
+-          stream_, tag,
+-                                                nullptr);
++      WireFormat::SkipField(stream_, tag, nullptr);
+       tag = stream_->ReadTag();
+       continue;
+     }
+@@ -215,7 +204,6 @@ absl::Status ProtoStreamObjectSource::WriteMessage(
+     }
+   }
+ 
+-
+   if (include_start_and_end) {
+     ow->EndObject();
+   }
+@@ -323,12 +311,7 @@ absl::Status ProtoStreamObjectSource::RenderTimestamp(
+   std::string formatted_seconds =
+       absl::FormatTime(kRfc3339TimeFormat, tm, absl::UTCTimeZone());
+   std::string formatted_time = absl::StrFormat(
+-      "%s%sZ", formatted_seconds.c_str(),
+-      FormatNanos(
+-          nanos,
+-          false
+-          )
+-          .c_str());
++      "%s%sZ", formatted_seconds.c_str(), FormatNanos(nanos, false).c_str());
+   ow->RenderString(field_name, formatted_time);
+   return absl::Status();
+ }
+@@ -366,11 +349,7 @@ absl::Status ProtoStreamObjectSource::RenderDuration(
+   }
+   std::string formatted_duration = absl::StrFormat(
+       "%s%lld%ss", sign.c_str(), static_cast<long long>(seconds),  // NOLINT
+-      FormatNanos(
+-          nanos,
+-          false
+-          )
+-          .c_str());
++      FormatNanos(nanos, false).c_str());
+   ow->RenderString(field_name, formatted_duration);
+   return absl::Status();
+ }
+@@ -665,12 +644,10 @@ absl::Status ProtoStreamObjectSource::RenderFieldMask(
+   return absl::Status();
+ }
+ 
+-
+ absl::flat_hash_map<std::string, ProtoStreamObjectSource::TypeRenderer>*
+     ProtoStreamObjectSource::renderers_ = nullptr;
+ absl::once_flag source_renderers_init_;
+ 
+-
+ void ProtoStreamObjectSource::InitRendererMap() {
+   renderers_ = new absl::flat_hash_map<std::string,
+                                        ProtoStreamObjectSource::TypeRenderer>();
+@@ -866,10 +843,10 @@ absl::Status ProtoStreamObjectSource::RenderNonMessageField(
+             ow->RenderString(field_name, enum_value->name());
+           }
+         } else {
+-            ow->RenderInt32(field_name, buffer32);
++          ow->RenderInt32(field_name, buffer32);
+         }
+       } else {
+-          ow->RenderInt32(field_name, buffer32);
++        ow->RenderInt32(field_name, buffer32);
+       }
+       break;
+     }
+diff --git a/src/google/protobuf/util/converter/protostream_objectsource.h b/src/google/protobuf/util/converter/protostream_objectsource.h
+index b962707..fb10442 100644
+--- a/src/google/protobuf/util/converter/protostream_objectsource.h
++++ b/src/google/protobuf/util/converter/protostream_objectsource.h
+@@ -23,21 +23,16 @@
+ #include <stack>
+ #include <string>
+ 
+-#include "google/protobuf/stubs/common.h"
+-#include "google/protobuf/type.pb.h"
+ #include "absl/container/flat_hash_map.h"
+ #include "absl/status/status.h"
+ #include "absl/status/statusor.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/type.pb.h"
+ #include "google/protobuf/util/converter/object_source.h"
+ #include "google/protobuf/util/converter/object_writer.h"
+ #include "google/protobuf/util/converter/type_info.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -58,9 +53,8 @@ class TypeInfo;
+ //                              <your message google::protobuf::Type>);
+ //
+ //   Status status = os.WriteTo(<some ObjectWriter>);
+-class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
++class ProtoStreamObjectSource : public ObjectSource {
+  public:
+-
+   struct RenderOptions {
+     // Sets whether or not to use lowerCamelCase casing for enum values. If set
+     // to false, enum values are output without any case conversions.
+@@ -94,7 +88,6 @@ class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
+ 
+     // Whether to preserve proto field names
+     bool preserve_proto_field_names = false;
+-
+   };
+ 
+   ProtoStreamObjectSource(io::CodedInputStream* stream,
+@@ -158,7 +151,6 @@ class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
+   std::string ReadFieldValueAsString(
+       const google::protobuf::Field& field) const;
+ 
+-
+   // Returns the input stream.
+   io::CodedInputStream* stream() const { return stream_; }
+ 
+@@ -266,7 +258,6 @@ class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
+                                      absl::string_view field_name,
+                                      ObjectWriter* ow) const;
+ 
+-
+   // Utility function to detect proto maps. The 'field' MUST be repeated.
+   bool IsMap(const google::protobuf::Field& field) const;
+ 
+@@ -295,7 +286,6 @@ class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
+   // google::protobuf::Type of the message source.
+   const google::protobuf::Type& type_;
+ 
+-
+   const RenderOptions render_options_;
+ 
+   // Tracks current recursion depth.
+@@ -310,6 +300,4 @@ class PROTOBUF_EXPORT ProtoStreamObjectSource : public ObjectSource {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_PROTOSTREAM_OBJECTSOURCE_H_
+diff --git a/src/google/protobuf/util/converter/protostream_objectwriter.cc b/src/google/protobuf/util/converter/protostream_objectwriter.cc
+index 5489063..cfe426b 100644
+--- a/src/google/protobuf/util/converter/protostream_objectwriter.cc
++++ b/src/google/protobuf/util/converter/protostream_objectwriter.cc
+@@ -18,7 +18,6 @@
+ #include <functional>
+ #include <stack>
+ 
+-#include "google/protobuf/stubs/strutil.h"
+ #include "absl/base/call_once.h"
+ #include "absl/log/absl_check.h"
+ #include "absl/log/absl_log.h"
+@@ -28,16 +27,13 @@
+ #include "absl/strings/str_cat.h"
+ #include "absl/strings/strip.h"
+ #include "absl/time/time.h"
++#include "google/protobuf/stubs/strutil.h"
+ #include "google/protobuf/util/converter/constants.h"
+ #include "google/protobuf/util/converter/field_mask_utility.h"
+ #include "google/protobuf/util/converter/object_location_tracker.h"
+ #include "google/protobuf/util/converter/utility.h"
+ #include "google/protobuf/wire_format_lite.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -47,7 +43,6 @@ using ::absl::Status;
+ using ::google::protobuf::internal::WireFormatLite;
+ using std::placeholders::_1;
+ 
+-
+ ProtoStreamObjectWriter::ProtoStreamObjectWriter(
+     TypeResolver* type_resolver, const google::protobuf::Type& type,
+     strings::ByteSink* output, ErrorListener* listener,
+@@ -482,7 +477,6 @@ bool ProtoStreamObjectWriter::Item::InsertMapKeyIfNotPresent(
+   return map_keys_.insert(std::string(map_key)).second;
+ }
+ 
+-
+ ProtoStreamObjectWriter* ProtoStreamObjectWriter::StartObject(
+     absl::string_view name) {
+   if (invalid_depth() > 0) {
+@@ -678,7 +672,6 @@ ProtoStreamObjectWriter* ProtoStreamObjectWriter::EndObject() {
+   return this;
+ }
+ 
+-
+ ProtoStreamObjectWriter* ProtoStreamObjectWriter::StartList(
+     absl::string_view name) {
+   if (invalid_depth() > 0) {
+@@ -924,8 +917,7 @@ Status ProtoStreamObjectWriter::RenderStructValue(ProtoStreamObjectWriter* ow,
+         absl::StatusOr<int32_t> int_value = data.ToInt32();
+         if (int_value.ok()) {
+           ow->ProtoWriter::RenderDataPiece(
+-              "string_value",
+-              DataPiece(SimpleDtoa(int_value.value()), true));
++              "string_value", DataPiece(SimpleDtoa(int_value.value()), true));
+           return Status();
+         }
+       }
+@@ -937,8 +929,7 @@ Status ProtoStreamObjectWriter::RenderStructValue(ProtoStreamObjectWriter* ow,
+         absl::StatusOr<uint32_t> int_value = data.ToUint32();
+         if (int_value.ok()) {
+           ow->ProtoWriter::RenderDataPiece(
+-              "string_value",
+-              DataPiece(SimpleDtoa(int_value.value()), true));
++              "string_value", DataPiece(SimpleDtoa(int_value.value()), true));
+           return Status();
+         }
+       }
+@@ -978,8 +969,7 @@ Status ProtoStreamObjectWriter::RenderStructValue(ProtoStreamObjectWriter* ow,
+         absl::StatusOr<float> float_value = data.ToFloat();
+         if (float_value.ok()) {
+           ow->ProtoWriter::RenderDataPiece(
+-              "string_value",
+-              DataPiece(SimpleDtoa(float_value.value()), true));
++              "string_value", DataPiece(SimpleDtoa(float_value.value()), true));
+           return Status();
+         }
+       }
+@@ -1368,9 +1358,9 @@ bool ProtoStreamObjectWriter::ValidMapKey(absl::string_view unnormalized_name) {
+   return true;
+ }
+ 
+-void ProtoStreamObjectWriter::Push(
+-    absl::string_view name, Item::ItemType item_type, bool is_placeholder,
+-    bool is_list) {
++void ProtoStreamObjectWriter::Push(absl::string_view name,
++                                   Item::ItemType item_type,
++                                   bool is_placeholder, bool is_list) {
+   is_list ? ProtoWriter::StartList(name) : ProtoWriter::StartObject(name);
+ 
+   // invalid_depth == 0 means it is a successful StartObject or StartList.
+diff --git a/src/google/protobuf/util/converter/protostream_objectwriter.h b/src/google/protobuf/util/converter/protostream_objectwriter.h
+index c9a93f7..92fcc0f 100644
+--- a/src/google/protobuf/util/converter/protostream_objectwriter.h
++++ b/src/google/protobuf/util/converter/protostream_objectwriter.h
+@@ -20,25 +20,21 @@
+ #include <deque>
+ #include <string>
+ 
+-#include "google/protobuf/type.pb.h"
+-#include "google/protobuf/descriptor.h"
+ #include "absl/container/flat_hash_set.h"
+ #include "absl/status/status.h"
+-#include "google/protobuf/stubs/bytestream.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/descriptor.h"
++#include "google/protobuf/io/coded_stream.h"
++#include "google/protobuf/io/zero_copy_stream_impl.h"
++#include "google/protobuf/stubs/bytestream.h"
++#include "google/protobuf/type.pb.h"
+ #include "google/protobuf/util/converter/datapiece.h"
+ #include "google/protobuf/util/converter/error_listener.h"
+ #include "google/protobuf/util/converter/proto_writer.h"
+ #include "google/protobuf/util/converter/structured_objectwriter.h"
+ #include "google/protobuf/util/converter/type_info.h"
+-#include "google/protobuf/io/coded_stream.h"
+-#include "google/protobuf/io/zero_copy_stream_impl.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+@@ -51,7 +47,7 @@ class ObjectLocationTracker;
+ // the ProtoWriter class to write raw proto bytes.
+ //
+ // It also supports streaming.
+-class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
++class ProtoStreamObjectWriter : public ProtoWriter {
+  public:
+   // Options that control ProtoStreamObjectWriter class's behavior.
+   struct Options {
+@@ -158,7 +154,7 @@ class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
+                                        const DataPiece&);
+ 
+   // Handles writing Anys out using nested object writers and the like.
+-  class PROTOBUF_EXPORT AnyWriter {
++  class AnyWriter {
+    public:
+     explicit AnyWriter(ProtoStreamObjectWriter* parent);
+     ~AnyWriter();
+@@ -183,7 +179,7 @@ class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
+    private:
+     // Before the "@type" field is encountered, we store all incoming data
+     // into this Event struct and replay them after we get the "@type" field.
+-    class PROTOBUF_EXPORT Event {
++    class Event {
+      public:
+       enum Type {
+         START_OBJECT = 0,
+@@ -272,7 +268,7 @@ class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
+ 
+   // Represents an item in a stack of items used to keep state between
+   // ObjectWrier events.
+-  class PROTOBUF_EXPORT Item : public BaseElement {
++  class Item : public BaseElement {
+    public:
+     // Indicates the type of item.
+     enum ItemType {
+@@ -405,7 +401,6 @@ class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
+   void Push(absl::string_view name, Item::ItemType item_type,
+             bool is_placeholder, bool is_list);
+ 
+-
+   // Pops items from the stack. All placeholder items are popped until a
+   // non-placeholder item is found.
+   void Pop();
+@@ -435,6 +430,4 @@ class PROTOBUF_EXPORT ProtoStreamObjectWriter : public ProtoWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_PROTOSTREAM_OBJECTWRITER_H_
+diff --git a/src/google/protobuf/util/converter/structured_objectwriter.h b/src/google/protobuf/util/converter/structured_objectwriter.h
+index ada20d6..656ab13 100644
+--- a/src/google/protobuf/util/converter/structured_objectwriter.h
++++ b/src/google/protobuf/util/converter/structured_objectwriter.h
+@@ -21,10 +21,7 @@
+ 
+ #include "absl/base/casts.h"
+ #include "google/protobuf/util/converter/object_writer.h"
+-
+-// Must be included last.
+ #include "google/protobuf/util/converter/port.h"
+-#include "google/protobuf/util/converter/port_def.inc"
+ 
+ namespace google {
+ namespace protobuf {
+@@ -42,7 +39,7 @@ namespace converter {
+ // StructuredObjectWriter and its use.
+ //
+ // Derived classes could be thread-unsafe.
+-class PROTOBUF_EXPORT StructuredObjectWriter : public ObjectWriter {
++class StructuredObjectWriter : public ObjectWriter {
+  public:
+   StructuredObjectWriter(const StructuredObjectWriter&) = delete;
+   StructuredObjectWriter& operator=(const StructuredObjectWriter&) = delete;
+@@ -54,7 +51,7 @@ class PROTOBUF_EXPORT StructuredObjectWriter : public ObjectWriter {
+   // StructuredObjectWriter behaves as a visitor. BaseElement represents a node
+   // in the input tree. Implementation of StructuredObjectWriter should also
+   // extend BaseElement to keep track of the location in the input tree.
+-  class PROTOBUF_EXPORT BaseElement {
++  class BaseElement {
+    public:
+     // Takes ownership of the parent Element.
+     explicit BaseElement(BaseElement* parent)
+@@ -105,6 +102,4 @@ class PROTOBUF_EXPORT StructuredObjectWriter : public ObjectWriter {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_STRUCTURED_OBJECTWRITER_H_
+diff --git a/src/google/protobuf/util/converter/type_info.h b/src/google/protobuf/util/converter/type_info.h
+index f1caf90..8884e5f 100644
+--- a/src/google/protobuf/util/converter/type_info.h
++++ b/src/google/protobuf/util/converter/type_info.h
+@@ -17,23 +17,19 @@
+ #ifndef GOOGLE_PROTOBUF_UTIL_CONVERTER_TYPE_INFO_H_
+ #define GOOGLE_PROTOBUF_UTIL_CONVERTER_TYPE_INFO_H_
+ 
+-#include "google/protobuf/type.pb.h"
+ #include "absl/status/status.h"
+ #include "absl/status/statusor.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/type.pb.h"
+ #include "google/protobuf/util/type_resolver.h"
+ 
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
+-
+ namespace google {
+ namespace protobuf {
+ namespace util {
+ namespace converter {
+ // Internal helper class for type resolving. Note that this class is not
+ // thread-safe and should only be accessed in one thread.
+-class PROTOBUF_EXPORT TypeInfo {
++class TypeInfo {
+  public:
+   TypeInfo() {}
+   TypeInfo(const TypeInfo&) = delete;
+@@ -77,6 +73,4 @@ class PROTOBUF_EXPORT TypeInfo {
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_TYPE_INFO_H_
+diff --git a/src/google/protobuf/util/converter/utility.cc b/src/google/protobuf/util/converter/utility.cc
+index 0770b0a..4007424 100644
+--- a/src/google/protobuf/util/converter/utility.cc
++++ b/src/google/protobuf/util/converter/utility.cc
+@@ -20,22 +20,17 @@
+ #include <iterator>
+ #include <limits>
+ 
+-#include "google/protobuf/stubs/callback.h"
+-#include "google/protobuf/stubs/common.h"
+-#include "google/protobuf/wrappers.pb.h"
+-#include "google/protobuf/descriptor.pb.h"
+-#include "google/protobuf/descriptor.h"
+-#include "google/protobuf/stubs/strutil.h"
+ #include "absl/container/flat_hash_set.h"
+ #include "absl/strings/ascii.h"
+ #include "absl/strings/cord.h"
+ #include "absl/strings/match.h"
+ #include "absl/strings/str_cat.h"
+ #include "absl/strings/string_view.h"
++#include "google/protobuf/descriptor.h"
++#include "google/protobuf/descriptor.pb.h"
++#include "google/protobuf/stubs/strutil.h"
+ #include "google/protobuf/util/converter/constants.h"
+-
+-// must be last
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "google/protobuf/wrappers.pb.h"
+ 
+ namespace google {
+ namespace protobuf {
+diff --git a/src/google/protobuf/util/converter/utility.h b/src/google/protobuf/util/converter/utility.h
+index a98793b..f00ad3a 100644
+--- a/src/google/protobuf/util/converter/utility.h
++++ b/src/google/protobuf/util/converter/utility.h
+@@ -22,19 +22,13 @@
+ #include <string>
+ #include <utility>
+ 
+-#include "google/protobuf/stubs/common.h"
+-#include "google/protobuf/any.pb.h"
+-#include "google/protobuf/type.pb.h"
+-#include "google/protobuf/repeated_field.h"
+-#include "google/protobuf/stubs/strutil.h"
+ #include "absl/status/status.h"
+ #include "absl/status/statusor.h"
+ #include "absl/strings/str_cat.h"
+ #include "absl/strings/string_view.h"
+-
+-
+-// Must be included last.
+-#include "google/protobuf/util/converter/port_def.inc"
++#include "google/protobuf/any.pb.h"
++#include "google/protobuf/repeated_field.h"
++#include "google/protobuf/type.pb.h"
+ 
+ namespace google {
+ namespace protobuf {
+@@ -47,25 +41,25 @@ static const int64_t kTypeUrlSize = 19;
+ // Finds the tech option identified by option_name. Parses the boolean value and
+ // returns it.
+ // When the option with the given name is not found, default_value is returned.
+-PROTOBUF_EXPORT bool GetBoolOptionOrDefault(
++bool GetBoolOptionOrDefault(
+     const RepeatedPtrField<google::protobuf::Option>& options,
+     absl::string_view option_name, bool default_value);
+ 
+ // Returns int64 option value. If the option isn't found, returns the
+ // default_value.
+-PROTOBUF_EXPORT int64_t GetInt64OptionOrDefault(
++int64_t GetInt64OptionOrDefault(
+     const RepeatedPtrField<google::protobuf::Option>& options,
+     absl::string_view option_name, int64_t default_value);
+ 
+ // Returns double option value. If the option isn't found, returns the
+ // default_value.
+-PROTOBUF_EXPORT double GetDoubleOptionOrDefault(
++double GetDoubleOptionOrDefault(
+     const RepeatedPtrField<google::protobuf::Option>& options,
+     absl::string_view option_name, double default_value);
+ 
+ // Returns string option value. If the option isn't found, returns the
+ // default_value.
+-PROTOBUF_EXPORT std::string GetStringOptionOrDefault(
++std::string GetStringOptionOrDefault(
+     const RepeatedPtrField<google::protobuf::Option>& options,
+     absl::string_view option_name, absl::string_view default_value);
+ 
+@@ -73,21 +67,20 @@ PROTOBUF_EXPORT std::string GetStringOptionOrDefault(
+ // TODO(skarvaje): Make these utilities dealing with Any types more generic,
+ // add more error checking and move to a more public/shareable location so
+ // others can use.
+-PROTOBUF_EXPORT bool GetBoolFromAny(const google::protobuf::Any& any);
++bool GetBoolFromAny(const google::protobuf::Any& any);
+ 
+ // Returns int64 value contained in Any type.
+-PROTOBUF_EXPORT int64_t GetInt64FromAny(const google::protobuf::Any& any);
++int64_t GetInt64FromAny(const google::protobuf::Any& any);
+ 
+ // Returns double value contained in Any type.
+-PROTOBUF_EXPORT double GetDoubleFromAny(const google::protobuf::Any& any);
++double GetDoubleFromAny(const google::protobuf::Any& any);
+ 
+ // Returns string value contained in Any type.
+-PROTOBUF_EXPORT std::string GetStringFromAny(const google::protobuf::Any& any);
++std::string GetStringFromAny(const google::protobuf::Any& any);
+ 
+ // Returns the type string without the url prefix. e.g.: If the passed type is
+ // 'type.googleapis.com/tech.type.Bool', the returned value is 'tech.type.Bool'.
+-PROTOBUF_EXPORT absl::string_view GetTypeWithoutUrl(
+-    absl::string_view type_url);
++absl::string_view GetTypeWithoutUrl(absl::string_view type_url);
+ 
+ // Returns the simple_type with the base type url (kTypeServiceBaseUrl)
+ // prefixed.
+@@ -95,8 +88,7 @@ PROTOBUF_EXPORT absl::string_view GetTypeWithoutUrl(
+ // E.g:
+ // GetFullTypeWithUrl("google.protobuf.Timestamp") returns the string
+ // "type.googleapis.com/google.protobuf.Timestamp".
+-PROTOBUF_EXPORT std::string GetFullTypeWithUrl(
+-    absl::string_view simple_type);
++std::string GetFullTypeWithUrl(absl::string_view simple_type);
+ 
+ // Finds and returns option identified by name and option_name within the
+ // provided map. Returns nullptr if none found.
+@@ -136,31 +128,31 @@ const google::protobuf::EnumValue* FindEnumValueByNameWithoutUnderscoreOrNull(
+     const google::protobuf::Enum* enum_type, absl::string_view enum_name);
+ 
+ // Converts input to camel-case and returns it.
+-PROTOBUF_EXPORT std::string ToCamelCase(const absl::string_view input);
++std::string ToCamelCase(const absl::string_view input);
+ 
+ // Converts enum name string to camel-case and returns it.
+ std::string EnumValueNameToLowerCamelCase(const absl::string_view input);
+ 
+ // Converts input to snake_case and returns it.
+-PROTOBUF_EXPORT std::string ToSnakeCase(absl::string_view input);
++std::string ToSnakeCase(absl::string_view input);
+ 
+ // Returns true if type_name represents a well-known type.
+-PROTOBUF_EXPORT bool IsWellKnownType(const std::string& type_name);
++bool IsWellKnownType(const std::string& type_name);
+ 
+ // Returns true if 'bool_string' represents a valid boolean value. Only "true",
+ // "false", "0" and "1" are allowed.
+-PROTOBUF_EXPORT bool IsValidBoolString(absl::string_view bool_string);
++bool IsValidBoolString(absl::string_view bool_string);
+ 
+ // Returns true if "field" is a protobuf map field based on its type.
+-PROTOBUF_EXPORT bool IsMap(const google::protobuf::Field& field,
+-                           const google::protobuf::Type& type);
++bool IsMap(const google::protobuf::Field& field,
++           const google::protobuf::Type& type);
+ 
+ // Returns true if the given type has special MessageSet wire format.
+ bool IsMessageSetWireFormat(const google::protobuf::Type& type);
+ 
+ // Infinity/NaN-aware conversion to string.
+-PROTOBUF_EXPORT std::string DoubleAsString(double value);
+-PROTOBUF_EXPORT std::string FloatAsString(float value);
++std::string DoubleAsString(double value);
++std::string FloatAsString(float value);
+ 
+ // Convert from int32, int64, uint32, uint64, double or float to string.
+ template <typename T>
+@@ -180,13 +172,11 @@ inline std::string ValueAsString(double value) {
+ 
+ // Converts a string to float. Unlike safe_strtof, conversion will fail if the
+ // value fits into double but not float (e.g., DBL_MAX).
+-PROTOBUF_EXPORT bool SafeStrToFloat(absl::string_view str, float* value);
++bool SafeStrToFloat(absl::string_view str, float* value);
+ 
+ }  // namespace converter
+ }  // namespace util
+ }  // namespace protobuf
+ }  // namespace google
+ 
+-#include "google/protobuf/util/converter/port_undef.inc"
+-
+ #endif  // GOOGLE_PROTOBUF_UTIL_CONVERTER_UTILITY_H_
diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
index b84d93ef7a..015659851c 100644
--- a/bazel/envoy_internal.bzl
+++ b/bazel/envoy_internal.bzl
@@ -125,6 +125,7 @@ def envoy_copts(repository, test = False):
            envoy_select_static_extension_registration(["-DENVOY_STATIC_EXTENSION_REGISTRATION"], repository) + \
            envoy_select_disable_logging(["-DENVOY_DISABLE_LOGGING"], repository) + \
            _envoy_select_perf_annotation(["-DENVOY_PERF_ANNOTATION"]) + \
+           _envoy_select_execution_context() + \
            _envoy_select_perfetto(["-DENVOY_PERFETTO"]) + \
            envoy_select_google_grpc(["-DENVOY_GOOGLE_GRPC"], repository) + \
            envoy_select_signal_trace(["-DENVOY_HANDLE_SIGNALS"], repository) + \
@@ -190,6 +191,12 @@ def _envoy_select_perf_annotation(xs):
         "//conditions:default": [],
     })
 
+def _envoy_select_execution_context():
+    return select({
+        "@envoy//bazel:enable_execution_context": ["-DENVOY_ENABLE_EXECUTION_CONTEXT"],
+        "//conditions:default": [],
+    })
+
 def _envoy_select_perfetto(xs):
     return select({
         "@envoy//bazel:enable_perf_tracing": xs,
diff --git a/bazel/envoy_test.bzl b/bazel/envoy_test.bzl
index f554eaf50a..ec68fec9cc 100644
--- a/bazel/envoy_test.bzl
+++ b/bazel/envoy_test.bzl
@@ -240,6 +240,7 @@ def envoy_cc_test_library(
         visibility = ["//visibility:public"],
         alwayslink = alwayslink,
         disable_pch = disable_pch,
+        exec_properties = exec_properties,
         **kargs
     )
 
diff --git a/bazel/get_workspace_status b/bazel/get_workspace_status
index 472e9ed20c..16fb0245cd 100755
--- a/bazel/get_workspace_status
+++ b/bazel/get_workspace_status
@@ -29,7 +29,8 @@ then
     exit 0
 fi
 
-if [[ -n "$BAZEL_FAKE_SCM_REVISION" ]]; then
+if [[ -e ".BAZEL_FAKE_SCM_REVISION" ]]; then
+    BAZEL_FAKE_SCM_REVISION="$(cat .BAZEL_FAKE_SCM_REVISION)"
     echo "BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "ENVOY_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
     echo "STABLE_BUILD_SCM_REVISION $BAZEL_FAKE_SCM_REVISION"
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 99f1d57d6c..6379ed63d3 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -79,6 +79,13 @@ def _cc_deps():
         name = "com_google_protoconverter",
         patch_args = ["-p1"],
         patches = ["@envoy//bazel:com_google_protoconverter.patch"],
+        patch_cmds = [
+            "rm src/google/protobuf/stubs/common.cc",
+            "rm src/google/protobuf/stubs/common.h",
+            "rm src/google/protobuf/stubs/common_unittest.cc",
+            "rm src/google/protobuf/util/converter/port_def.inc",
+            "rm src/google/protobuf/util/converter/port_undef.inc",
+        ],
     )
     external_http_archive("com_google_protofieldextraction")
     external_http_archive("com_google_protoprocessinglib")
diff --git a/changelogs/current.yaml b/changelogs/current.yaml
index 4ae0bc88ca..b773fb76f6 100644
--- a/changelogs/current.yaml
+++ b/changelogs/current.yaml
@@ -54,6 +54,10 @@ behavior_changes:
     <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.access_log>`.
     This change can be disabled by setting the runtime guard flag
     ``envoy.reloadable_features.filter_access_loggers_first`` to ``false``.
+- area: monitoring
+  change: |
+    Removed runtime feature flag ``envoy.restart_features.enable_execution_context``. The execution context feature
+    now could be enabled only by setting compile option ``--define=execution_context=enabled``.
 
 minor_behavior_changes:
 # *Changes that may cause incompatibilities for some users, but should not for most*
@@ -77,6 +81,10 @@ minor_behavior_changes:
   change: |
     When Lua script executes httpCall, backpressure is exercised when receiving body from downstream client. This behavior can be reverted
     by setting the runtime guard ``envoy.reloadable_features.lua_flow_control_while_http_call`` to false.
+- area: ext_proc
+  change: |
+    Added support for :ref:`send_body_without_waiting_for_header_response
+    <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.send_body_without_waiting_for_header_response>`.
 - area: http
   change: |
     Modified the authority header value validator to allow the same characters as oghttp2
@@ -101,6 +109,9 @@ minor_behavior_changes:
   change: |
     Enhanced listener filter chain execution to include the case that listener filter has maxReadBytes() of 0,
     but may return StopIteration in onAccept to wait for asynchronous callback.
+- area: tracers
+  change: |
+    Set status code based on GRPC status code for OpenTelemetry tracers (previously unset).
 - area: http2
   change: |
     Changes the default value of ``envoy.reloadable_features.http2_use_oghttp2`` to ``false``. This changes the codec used for HTTP/2
@@ -189,6 +200,9 @@ bug_fixes:
   change: |
     Set token cookies in response regardless of :ref:`forward_bearer_token
     <envoy_v3_api_field_extensions.filters.http.oauth2.v3.OAuth2Config.forward_bearer_token>` config option.
+- area: tracing
+  change: |
+    Fixed a bug where the OpenTelemetry tracer exports the OTLP request even when no spans are present.
 
 removed_config_or_runtime:
 # *Normally occurs at the end of the* :ref:`deprecation period <deprecated>`
@@ -289,6 +303,10 @@ new_features:
   change: |
     Added full feature absl::FormatTime() support to the DateFormatter. This allows the timepoint formatters (like
     ``%START_TIME%``) to use ``%E#S``, ``%E*S``, ``%E#f`` and ``%E*f`` to format the subsecond part of the timepoint.
+- area: http
+  change: |
+    Added configuration setting for the :ref:`maximum size of response headers
+    <envoy_v3_api_field_config.core.v3.HttpProtocolOptions.max_response_headers_kb>` in responses.
 - area: http_11_proxy
   change: |
     Added the option to configure the transport socket via locality or endpoint metadata.
@@ -379,6 +397,17 @@ new_features:
 - area: geoip
   change: |
     Added ``envoy.reloadable_features.mmdb_files_reload_enabled`` runtime flag that enables reload of mmdb files by default.
+- area: access_log
+  change: |
+    Added new JSON access log formatter implementation which provides 16-25x performance improvement over the old
+    implementation. The legacy implementation will be enabled by default for now but will be deprecated and removed
+    in a future release.
+    The :ref:`sort_properties <envoy_v3_api_field_config.core.v3.JsonFormatOptions.sort_properties>` field will
+    be ignored in the new implementation because the new implementation always sorts properties. And the new implementation
+    will always keep the value type in the JSON output. For example, the duration field will always be rendered as a number
+    instead of a string.
+    The new JSON formatter could be enabled by setting the runtime guard
+    ``envoy.reloadable_features.logging_with_fast_json_formatter`` to true.
 - area: access_logs
   change: |
     Added support for %UPSTREAM_CONNECTION_ID% access log substitution string in TCP and UDP tunneling flows.
@@ -426,5 +455,10 @@ new_features:
     Added allow list
     :ref:`allowed_override_modes <envoy_v3_api_field_extensions.filters.http.ext_proc.v3.ExternalProcessor.allowed_override_modes>`
     for :ref:`mode_override <envoy_v3_api_field_service.ext_proc.v3.ProcessingResponse.mode_override>`.
+- area: load_balancing
+  change: |
+    WIP: Added implementation of :ref:`client_side_weighted_round_robin
+    <envoy_v3_api_msg_extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin>`
+    load balancing policy that uses ``OrcaLoadReport`` provided by the upstream host to calculate host load balancing weight.
 
 deprecated:
diff --git a/ci/Dockerfile-envoy b/ci/Dockerfile-envoy
index e2a8738d2e..7106f86eb3 100644
--- a/ci/Dockerfile-envoy
+++ b/ci/Dockerfile-envoy
@@ -59,7 +59,7 @@ COPY --chown=0:0 --chmod=755 \
 
 
 # STAGE: envoy-distroless
-FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:4cc93c5b247e24470905bf3cdf8285aeac176bb0e7c62ee2b748a95c0c4123b5 AS envoy-distroless
+FROM gcr.io/distroless/base-nossl-debian12:nonroot@sha256:e130c09889f3b6c05dacd52d2612c30811e04eefe3280a6659037cfdd018de6c AS envoy-distroless
 EXPOSE 10000
 ENTRYPOINT ["/usr/local/bin/envoy"]
 CMD ["-c", "/etc/envoy/envoy.yaml"]
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 6d4295b53b..f67bbca4fd 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -377,7 +377,7 @@ case $CI_TARGET in
         # fi
         ;;
 
-    check_and_fix_proto_format)
+    format-api|check_and_fix_proto_format)
         setup_clang_toolchain
         echo "Check and fix proto format ..."
         "${ENVOY_SRCDIR}/ci/check_and_fix_format.sh"
diff --git a/ci/mac_ci_steps.sh b/ci/mac_ci_steps.sh
index a09175c1c0..2f2cc584f3 100755
--- a/ci/mac_ci_steps.sh
+++ b/ci/mac_ci_steps.sh
@@ -17,8 +17,6 @@ BAZEL_BUILD_OPTIONS=(
     "${BAZEL_BUILD_EXTRA_OPTIONS[@]}"
     "${BAZEL_EXTRA_TEST_OPTIONS[@]}")
 
-echo "RUN MAC: ${BAZEL_BUILD_OPTIONS[*]}"
-
 NCPU=$(sysctl -n hw.ncpu)
 if [[ $NCPU -gt 0 ]]; then
     echo "limiting build to $NCPU jobs, based on CPU count"
diff --git a/ci/run_envoy_docker.sh b/ci/run_envoy_docker.sh
index 72251f96e2..dcb86af9db 100755
--- a/ci/run_envoy_docker.sh
+++ b/ci/run_envoy_docker.sh
@@ -131,7 +131,6 @@ docker run --rm \
        -e BAZEL_STARTUP_OPTIONS \
        -e BAZEL_BUILD_EXTRA_OPTIONS \
        -e BAZEL_EXTRA_TEST_OPTIONS \
-       -e BAZEL_FAKE_SCM_REVISION \
        -e BAZEL_REMOTE_CACHE \
        -e BAZEL_STARTUP_EXTRA_OPTIONS \
        -e CI_BRANCH \
diff --git a/contrib/checksum/filters/http/test/BUILD b/contrib/checksum/filters/http/test/BUILD
index 215f73efd0..28f51df99b 100644
--- a/contrib/checksum/filters/http/test/BUILD
+++ b/contrib/checksum/filters/http/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "checksum_filter_test",
     srcs = ["checksum_filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/checksum/filters/http/source:checksum_filter_lib",
         "//source/common/buffer:buffer_lib",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/checksum/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/contrib/client_ssl_auth/filters/network/test/BUILD b/contrib/client_ssl_auth/filters/network/test/BUILD
index 13f6a67785..090144f029 100644
--- a/contrib/client_ssl_auth/filters/network/test/BUILD
+++ b/contrib/client_ssl_auth/filters/network/test/BUILD
@@ -12,6 +12,7 @@ envoy_cc_test(
     name = "client_ssl_auth_test",
     srcs = ["client_ssl_auth_test.cc"],
     data = glob(["test_data/**"]),
+    rbe_pool = "2core",
     deps = [
         "//contrib/client_ssl_auth/filters/network/source:client_ssl_auth",
         "//test/mocks/network:network_mocks",
@@ -28,6 +29,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/client_ssl_auth/filters/network/source:config",
         "//source/common/protobuf:utility_lib",
diff --git a/contrib/config/test/BUILD b/contrib/config/test/BUILD
index 36a4dc4e44..abfd044846 100644
--- a/contrib/config/test/BUILD
+++ b/contrib/config/test/BUILD
@@ -39,6 +39,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":invalid_proto_kv_store_config_proto_cc_proto",
         "//contrib/config/source:kv_store_xds_delegate",
diff --git a/contrib/cryptomb/private_key_providers/test/BUILD b/contrib/cryptomb/private_key_providers/test/BUILD
index 777cc49f89..5a3c668293 100644
--- a/contrib/cryptomb/private_key_providers/test/BUILD
+++ b/contrib/cryptomb/private_key_providers/test/BUILD
@@ -50,6 +50,7 @@ envoy_cc_test(
     data = [
         "//contrib/cryptomb/private_key_providers/test/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":test_fake_factory",
         "//source/common/common:random_generator_lib",
diff --git a/contrib/dlb/test/BUILD b/contrib/dlb/test/BUILD
index de39044fe7..6239630e0a 100644
--- a/contrib/dlb/test/BUILD
+++ b/contrib/dlb/test/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
         "//bazel:linux_x86_64": ["config_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//contrib/dlb/source:connection_balancer",
         "//source/common/protobuf:utility_lib",
diff --git a/contrib/dynamo/filters/http/test/BUILD b/contrib/dynamo/filters/http/test/BUILD
index 7bd200aba3..1040b43408 100644
--- a/contrib/dynamo/filters/http/test/BUILD
+++ b/contrib/dynamo/filters/http/test/BUILD
@@ -47,6 +47,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/dynamo/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/contrib/exe/BUILD b/contrib/exe/BUILD
index 6c085c76ba..337bda2e03 100644
--- a/contrib/exe/BUILD
+++ b/contrib/exe/BUILD
@@ -30,6 +30,7 @@ SELECTED_CONTRIB_EXTENSIONS = select({
 
 envoy_cc_binary(
     name = "envoy-static",
+    rbe_pool = "2core",
     stamped = True,
     visibility = ["//visibility:public"],
     deps = ["//source/exe:envoy_main_entry_lib"] + SELECTED_CONTRIB_EXTENSIONS,
@@ -47,6 +48,7 @@ envoy_cc_test(
         "DISABLE_TEST_MERGE": "true",
         "GODEBUG": "cgocheck=0",
     },
+    rbe_pool = "2core",
     deps = [
         "//test/config_test:example_configs_test_lib",
     ] + SELECTED_CONTRIB_EXTENSIONS,
diff --git a/contrib/generic_proxy/filters/network/test/codecs/kafka/BUILD b/contrib/generic_proxy/filters/network/test/codecs/kafka/BUILD
index 43f68dcdc9..820700ed99 100644
--- a/contrib/generic_proxy/filters/network/test/codecs/kafka/BUILD
+++ b/contrib/generic_proxy/filters/network/test/codecs/kafka/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/generic_proxy/filters/network/source/codecs/kafka:config",
         "//test/extensions/filters/network/generic_proxy/mocks:codec_mocks",
diff --git a/contrib/golang/filters/http/test/BUILD b/contrib/golang/filters/http/test/BUILD
index bd23137031..625fbf831a 100644
--- a/contrib/golang/filters/http/test/BUILD
+++ b/contrib/golang/filters/http/test/BUILD
@@ -16,6 +16,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/http/test/test_data/passthrough:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -30,6 +31,7 @@ envoy_cc_test(
         "//contrib/golang/filters/http/test/test_data/passthrough:filter.so",
         "//contrib/golang/filters/http/test/test_data/routeconfig:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:golang_filter_lib",
         "//source/common/stream_info:stream_info_lib",
@@ -60,6 +62,7 @@ envoy_cc_test(
         "//contrib/golang/filters/http/test/test_data/property:filter.so",
         "//contrib/golang/filters/http/test/test_data/routeconfig:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/http/source:config",
         "//source/exe:main_common_lib",
@@ -85,6 +88,7 @@ envoy_cc_fuzz_test(
     name = "golang_filter_fuzz_test",
     srcs = ["golang_filter_fuzz_test.cc"],
     corpus = "golang_filter_corpus",
+    rbe_pool = "2core",
     deps = [
         ":golang_filter_fuzz_proto_cc_proto",
         "//contrib/golang/common/dso/test:dso_mocks",
@@ -106,6 +110,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/http/test/test_data/websocket:filter.so",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
diff --git a/contrib/golang/filters/http/test/test_data/access_log/go.mod b/contrib/golang/filters/http/test/test_data/access_log/go.mod
index a019ffa882..b1e07cfaf9 100644
--- a/contrib/golang/filters/http/test/test_data/access_log/go.mod
+++ b/contrib/golang/filters/http/test/test_data/access_log/go.mod
@@ -1,6 +1,6 @@
 module example.com/access_log
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/action/go.mod b/contrib/golang/filters/http/test/test_data/action/go.mod
index 0c6cbba1b5..2e75a107b1 100644
--- a/contrib/golang/filters/http/test/test_data/action/go.mod
+++ b/contrib/golang/filters/http/test/test_data/action/go.mod
@@ -1,6 +1,6 @@
 module example.com/action
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/basic/go.mod b/contrib/golang/filters/http/test/test_data/basic/go.mod
index 12f18783fe..ef1378b50c 100644
--- a/contrib/golang/filters/http/test/test_data/basic/go.mod
+++ b/contrib/golang/filters/http/test/test_data/basic/go.mod
@@ -1,6 +1,6 @@
 module example.com/basic
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/buffer/go.mod b/contrib/golang/filters/http/test/test_data/buffer/go.mod
index 2f4c5c44b8..a1f71d5160 100644
--- a/contrib/golang/filters/http/test/test_data/buffer/go.mod
+++ b/contrib/golang/filters/http/test/test_data/buffer/go.mod
@@ -1,6 +1,6 @@
 module example.com/buffer
 
-go 1.23
+go 1.22
 
 require (
 	github.com/envoyproxy/envoy v1.24.0
diff --git a/contrib/golang/filters/http/test/test_data/dummy/go.mod b/contrib/golang/filters/http/test/test_data/dummy/go.mod
index e8c9ba548e..1355c37b76 100644
--- a/contrib/golang/filters/http/test/test_data/dummy/go.mod
+++ b/contrib/golang/filters/http/test/test_data/dummy/go.mod
@@ -1,6 +1,6 @@
 module example.com/dummy
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/echo/go.mod b/contrib/golang/filters/http/test/test_data/echo/go.mod
index 3647faba91..d77fa5a01c 100644
--- a/contrib/golang/filters/http/test/test_data/echo/go.mod
+++ b/contrib/golang/filters/http/test/test_data/echo/go.mod
@@ -1,6 +1,6 @@
 module example.com/echo
 
-go 1.23
+go 1.22
 
 require (
 	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa
diff --git a/contrib/golang/filters/http/test/test_data/metric/go.mod b/contrib/golang/filters/http/test/test_data/metric/go.mod
index f35013f025..470e4da15e 100644
--- a/contrib/golang/filters/http/test/test_data/metric/go.mod
+++ b/contrib/golang/filters/http/test/test_data/metric/go.mod
@@ -1,6 +1,6 @@
 module example.com/basic
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/passthrough/go.mod b/contrib/golang/filters/http/test/test_data/passthrough/go.mod
index bf3abff8c5..7900685fdc 100644
--- a/contrib/golang/filters/http/test/test_data/passthrough/go.mod
+++ b/contrib/golang/filters/http/test/test_data/passthrough/go.mod
@@ -1,6 +1,6 @@
 module example.com/passthrough
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/http/test/test_data/property/go.mod b/contrib/golang/filters/http/test/test_data/property/go.mod
index 830e11ad80..2dbd5e7ef8 100644
--- a/contrib/golang/filters/http/test/test_data/property/go.mod
+++ b/contrib/golang/filters/http/test/test_data/property/go.mod
@@ -1,6 +1,6 @@
 module example.com/property
 
-go 1.23
+go 1.22
 
 require (
 	github.com/envoyproxy/envoy v1.24.0
diff --git a/contrib/golang/filters/http/test/test_data/routeconfig/go.mod b/contrib/golang/filters/http/test/test_data/routeconfig/go.mod
index 6359d3e96b..7e51fdbaf5 100644
--- a/contrib/golang/filters/http/test/test_data/routeconfig/go.mod
+++ b/contrib/golang/filters/http/test/test_data/routeconfig/go.mod
@@ -1,6 +1,6 @@
 module example.com/routeconfig
 
-go 1.23
+go 1.22
 
 require (
 	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa
diff --git a/contrib/golang/filters/http/test/test_data/websocket/go.mod b/contrib/golang/filters/http/test/test_data/websocket/go.mod
index 15446803fe..d05aa1beec 100644
--- a/contrib/golang/filters/http/test/test_data/websocket/go.mod
+++ b/contrib/golang/filters/http/test/test_data/websocket/go.mod
@@ -1,6 +1,6 @@
 module example.com/websocket
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/filters/network/test/BUILD b/contrib/golang/filters/network/test/BUILD
index c8644e893d..b7c781317d 100644
--- a/contrib/golang/filters/network/test/BUILD
+++ b/contrib/golang/filters/network/test/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
     data = [
         "//contrib/golang/filters/network/test/test_data:filter.so",
     ],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/filters/network/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/common/dso/test:dso_mocks",
         "//contrib/golang/filters/network/source:golang",
@@ -43,6 +45,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "upstream_test",
     srcs = ["upstream_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/common/dso/test:dso_mocks",
         "//contrib/golang/filters/network/source:upstream",
diff --git a/contrib/golang/filters/network/test/test_data/go.mod b/contrib/golang/filters/network/test/test_data/go.mod
index 6e19aa70b3..bd17fec1b4 100644
--- a/contrib/golang/filters/network/test/test_data/go.mod
+++ b/contrib/golang/filters/network/test/test_data/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/envoy/contrib/golang/filters/network/test/test_data
 
-go 1.23
+go 1.22
 
 require github.com/envoyproxy/envoy v1.24.0
 
diff --git a/contrib/golang/router/cluster_specifier/test/BUILD b/contrib/golang/router/cluster_specifier/test/BUILD
index d483b3a692..00a339d306 100644
--- a/contrib/golang/router/cluster_specifier/test/BUILD
+++ b/contrib/golang/router/cluster_specifier/test/BUILD
@@ -15,6 +15,7 @@ envoy_cc_test(
         "//contrib/golang/router/cluster_specifier/test/test_data/simple:plugin.so",
     ],
     env = {"GODEBUG": "cgocheck=0"},
+    rbe_pool = "2core",
     deps = [
         "//contrib/golang/router/cluster_specifier/source:config",
         "//source/exe:main_common_lib",
diff --git a/contrib/golang/router/cluster_specifier/test/test_data/simple/go.mod b/contrib/golang/router/cluster_specifier/test/test_data/simple/go.mod
index 20bada9d81..82f1b15caf 100644
--- a/contrib/golang/router/cluster_specifier/test/test_data/simple/go.mod
+++ b/contrib/golang/router/cluster_specifier/test/test_data/simple/go.mod
@@ -1,6 +1,6 @@
 module example.com/routeconfig
 
-go 1.23
+go 1.22
 
 require (
 	github.com/cncf/xds/go v0.0.0-20231128003011-0fa0005c9caa
diff --git a/contrib/hyperscan/matching/input_matchers/test/BUILD b/contrib/hyperscan/matching/input_matchers/test/BUILD
index 3be84e8b8c..1ef6af2cc1 100644
--- a/contrib/hyperscan/matching/input_matchers/test/BUILD
+++ b/contrib/hyperscan/matching/input_matchers/test/BUILD
@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/matching/input_matchers/source:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/contrib/hyperscan/regex_engines/test/BUILD b/contrib/hyperscan/regex_engines/test/BUILD
index ba7cc2eced..591bded8ca 100644
--- a/contrib/hyperscan/regex_engines/test/BUILD
+++ b/contrib/hyperscan/regex_engines/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/regex_engines/source:config",
         "//test/mocks/server:factory_context_mocks",
@@ -31,6 +32,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "integration_test",
     srcs = ["integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/hyperscan/regex_engines/source:config",
         "//test/integration:integration_lib",
diff --git a/contrib/kafka/filters/network/source/BUILD b/contrib/kafka/filters/network/source/BUILD
index 438d87ee48..88731e90d1 100644
--- a/contrib/kafka/filters/network/source/BUILD
+++ b/contrib/kafka/filters/network/source/BUILD
@@ -109,6 +109,7 @@ envoy_cc_library(
         "external/responses.h",
         "kafka_response_parser.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":kafka_response_lib",
         ":parser_lib",
diff --git a/contrib/kafka/filters/network/test/broker/BUILD b/contrib/kafka/filters/network/test/broker/BUILD
index 54fff0b86a..054eb8319d 100644
--- a/contrib/kafka/filters/network/test/broker/BUILD
+++ b/contrib/kafka/filters/network/test/broker/BUILD
@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_unit_test",
     srcs = ["config_unit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/kafka/filters/network/source/broker:config_lib",
         "//test/mocks/server:factory_context_mocks",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_unit_test",
     srcs = ["filter_unit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/kafka/filters/network/source/broker:filter_lib",
         "//envoy/event:timer_interface",
diff --git a/contrib/kafka/filters/network/test/mesh/BUILD b/contrib/kafka/filters/network/test/mesh/BUILD
index 184e5623c6..f5ee655809 100644
--- a/contrib/kafka/filters/network/test/mesh/BUILD
+++ b/contrib/kafka/filters/network/test/mesh/BUILD
@@ -12,6 +12,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "config_unit_test",
     srcs = ["config_unit_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/kafka/filters/network/source/mesh:config_lib",
@@ -23,6 +24,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_unit_test",
     srcs = ["filter_unit_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/kafka/filters/network/source/mesh:filter_lib",
diff --git a/contrib/language/filters/http/test/BUILD b/contrib/language/filters/http/test/BUILD
index 315733e5eb..d38e2637a8 100644
--- a/contrib/language/filters/http/test/BUILD
+++ b/contrib/language/filters/http/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "language_config_test",
     srcs = ["language_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/language/filters/http/source:config_lib",
         "//test/mocks/server:factory_context_mocks",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "language_integration_test",
     srcs = ["language_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/language/filters/http/source:config_lib",
         "//test/integration:http_protocol_integration_lib",
diff --git a/contrib/mysql_proxy/filters/network/test/BUILD b/contrib/mysql_proxy/filters/network/test/BUILD
index bb6bfecf23..bfd45738d2 100644
--- a/contrib/mysql_proxy/filters/network/test/BUILD
+++ b/contrib/mysql_proxy/filters/network/test/BUILD
@@ -93,6 +93,7 @@ envoy_cc_test(
     data = [
         "mysql_test_config.yaml",
     ],
+    rbe_pool = "2core",
     deps = [
         ":mysql_test_utils_lib",
         "//contrib/mysql_proxy/filters/network/source:config",
diff --git a/contrib/postgres_proxy/filters/network/source/postgres_filter.cc b/contrib/postgres_proxy/filters/network/source/postgres_filter.cc
index 5db7d1058e..b238d48e0d 100644
--- a/contrib/postgres_proxy/filters/network/source/postgres_filter.cc
+++ b/contrib/postgres_proxy/filters/network/source/postgres_filter.cc
@@ -211,7 +211,7 @@ bool PostgresFilter::onSSLRequest() {
   buf.add("S");
   // Add callback to be notified when the reply message has been
   // transmitted.
-  read_callbacks_->connection().addBytesSentCallback([=](uint64_t bytes) -> bool {
+  read_callbacks_->connection().addBytesSentCallback([=, this](uint64_t bytes) -> bool {
     // Wait until 'S' has been transmitted.
     if (bytes >= 1) {
       if (!read_callbacks_->connection().startSecureTransport()) {
diff --git a/contrib/postgres_proxy/filters/network/test/BUILD b/contrib/postgres_proxy/filters/network/test/BUILD
index fe10ba4ad9..5c0c459867 100644
--- a/contrib/postgres_proxy/filters/network/test/BUILD
+++ b/contrib/postgres_proxy/filters/network/test/BUILD
@@ -69,6 +69,7 @@ envoy_cc_test(
         "postgres_test_config.yaml-template",
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":postgres_integration_proto_cc_proto",
         ":postgres_test_utils_lib",
diff --git a/contrib/qat/compression/qatzip/compressor/test/BUILD b/contrib/qat/compression/qatzip/compressor/test/BUILD
index 4c39ee53fc..4be6817eb0 100644
--- a/contrib/qat/compression/qatzip/compressor/test/BUILD
+++ b/contrib/qat/compression/qatzip/compressor/test/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
         "//bazel:linux_x86_64": ["qatzip_compressor_impl_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//contrib/qat/compression/qatzip/compressor/source:config",
         "//source/extensions/compression/gzip/decompressor:zlib_decompressor_impl_lib",
diff --git a/contrib/qat/compression/qatzstd/compressor/test/BUILD b/contrib/qat/compression/qatzstd/compressor/test/BUILD
index 85297caa14..fb7486c74e 100644
--- a/contrib/qat/compression/qatzstd/compressor/test/BUILD
+++ b/contrib/qat/compression/qatzstd/compressor/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "compressor_test",
     srcs = ["qatzstd_compressor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/qat/compression/qatzstd/compressor/source:config",
         "//source/extensions/compression/zstd/decompressor:decompressor_lib",
diff --git a/contrib/qat/private_key_providers/test/BUILD b/contrib/qat/private_key_providers/test/BUILD
index 85a8d16ae1..33007b18a1 100644
--- a/contrib/qat/private_key_providers/test/BUILD
+++ b/contrib/qat/private_key_providers/test/BUILD
@@ -48,6 +48,7 @@ envoy_cc_test(
     data = [
         "//contrib/qat/private_key_providers/test/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":test_fake_factory",
         "//source/common/common:random_generator_lib",
@@ -70,6 +71,7 @@ envoy_cc_test(
     data = [
         "//contrib/qat/private_key_providers/test/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":test_fake_factory",
         "//source/common/tls/private_key:private_key_manager_lib",
diff --git a/contrib/rocketmq_proxy/filters/network/test/BUILD b/contrib/rocketmq_proxy/filters/network/test/BUILD
index 507faac000..b214135b6d 100644
--- a/contrib/rocketmq_proxy/filters/network/test/BUILD
+++ b/contrib/rocketmq_proxy/filters/network/test/BUILD
@@ -14,6 +14,7 @@ envoy_cc_mock(
     name = "mocks_lib",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/rocketmq_proxy/filters/network/source:config",
         "//contrib/rocketmq_proxy/filters/network/source/router:router_lib",
@@ -42,6 +43,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "router_test",
     srcs = ["router_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -64,6 +66,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_manager_test",
     srcs = ["conn_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//test/common/stats:stat_test_utility_lib",
@@ -79,6 +82,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "active_message_test",
     srcs = ["active_message_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//contrib/rocketmq_proxy/filters/network/source:config",
@@ -93,6 +97,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/rocketmq_proxy/filters/network/source:config",
         "//test/mocks/local_info:local_info_mocks",
@@ -118,6 +123,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "route_matcher_test",
     srcs = ["route_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/rocketmq_proxy/filters/network/source/router:route_matcher",
         "//test/mocks/server:server_factory_context_mocks",
diff --git a/contrib/sip_proxy/filters/network/test/BUILD b/contrib/sip_proxy/filters/network/test/BUILD
index 969deb122d..698223deec 100644
--- a/contrib/sip_proxy/filters/network/test/BUILD
+++ b/contrib/sip_proxy/filters/network/test/BUILD
@@ -54,6 +54,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//contrib/sip_proxy/filters/network/source:config",
@@ -67,6 +68,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_manager_test",
     srcs = ["conn_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -86,6 +88,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "tra_test",
     srcs = ["tra_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -106,6 +109,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "decoder_test",
     srcs = ["decoder_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -126,6 +130,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "router_test",
     srcs = ["router_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
diff --git a/contrib/squash/filters/http/test/BUILD b/contrib/squash/filters/http/test/BUILD
index a2a9b49f4c..47ac1a1966 100644
--- a/contrib/squash/filters/http/test/BUILD
+++ b/contrib/squash/filters/http/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "squash_filter_test",
     srcs = ["squash_filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/squash/filters/http/source:squash_filter_lib",
         "//envoy/event:dispatcher_interface",
@@ -27,6 +28,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "squash_filter_integration_test",
     srcs = ["squash_filter_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/squash/filters/http/source:config",
         "//test/integration:http_integration_lib",
@@ -37,6 +39,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//contrib/squash/filters/http/source:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/contrib/sxg/filters/http/test/BUILD b/contrib/sxg/filters/http/test/BUILD
index 62df2d888c..e216da6d55 100644
--- a/contrib/sxg/filters/http/test/BUILD
+++ b/contrib/sxg/filters/http/test/BUILD
@@ -11,6 +11,7 @@ envoy_contrib_package()
 envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/sxg/filters/http/source:config",
@@ -27,6 +28,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//contrib/sxg/filters/http/source:config",
diff --git a/docs/root/intro/arch_overview/advanced/attributes.rst b/docs/root/intro/arch_overview/advanced/attributes.rst
index eae665abf3..f3f8e6fb84 100644
--- a/docs/root/intro/arch_overview/advanced/attributes.rst
+++ b/docs/root/intro/arch_overview/advanced/attributes.rst
@@ -93,6 +93,7 @@ Response attributes are only available after the request completes.
    response.trailers, "map<string, string>", All response trailers indexed by the lower-cased trailer name
    response.size, int, Size of the response body
    response.total_size, int, Total size of the response including the approximate uncompressed size of the headers and the trailers
+   response.backend_latency, duration, Duration between the first byte sent to and the last byte received from the upstream backend
 
 Connection attributes
 ---------------------
diff --git a/envoy/common/BUILD b/envoy/common/BUILD
index 3c8680576e..12c71b554b 100644
--- a/envoy/common/BUILD
+++ b/envoy/common/BUILD
@@ -124,15 +124,19 @@ envoy_cc_library(
 envoy_cc_library(
     name = "execution_context",
     hdrs = ["execution_context.h"],
-    deps = [":pure_lib"],
+    deps = [
+        ":pure_lib",
+        ":scope_tracker_interface",
+    ],
 )
 
 envoy_cc_library(
     name = "scope_tracker_interface",
     hdrs = ["scope_tracker.h"],
     deps = [
-        ":execution_context",
+        ":optref_lib",
         ":pure_lib",
+        "//envoy/stream_info:stream_info_interface",
     ],
 )
 
diff --git a/envoy/common/execution_context.h b/envoy/common/execution_context.h
index fb227a05af..b723a221bc 100644
--- a/envoy/common/execution_context.h
+++ b/envoy/common/execution_context.h
@@ -3,22 +3,25 @@
 #include <cstddef>
 
 #include "envoy/common/pure.h"
+#include "envoy/common/scope_tracker.h"
+#include "envoy/stream_info/stream_info.h"
 
 #include "source/common/common/non_copyable.h"
 
 namespace Envoy {
 
+#ifdef ENVOY_ENABLE_EXECUTION_CONTEXT
+
+static constexpr absl::string_view kConnectionExecutionContextFilterStateName =
+    "envoy.network.connection_execution_context";
+
 class ScopedExecutionContext;
 
 // ExecutionContext can be inherited by subclasses to represent arbitrary information associated
 // with the execution of a piece of code. activate/deactivate are called when the said execution
 // starts/ends. For an example usage, please see
 // https://github.com/envoyproxy/envoy/issues/32012.
-class ExecutionContext : NonCopyable {
-public:
-  ExecutionContext() = default;
-  virtual ~ExecutionContext() = default;
-
+class ExecutionContext : public StreamInfo::FilterState::Object, NonCopyable {
 protected:
   // Called when the current thread starts to run code on behalf of the owner of this object.
   // protected because it should only be called by ScopedExecutionContext.
@@ -43,7 +46,8 @@ class ExecutionContext : NonCopyable {
 class ScopedExecutionContext : NonCopyable {
 public:
   ScopedExecutionContext() : ScopedExecutionContext(nullptr) {}
-  ScopedExecutionContext(ExecutionContext* context) : context_(context) {
+  ScopedExecutionContext(const ScopeTrackedObject* object)
+      : context_(object != nullptr ? getExecutionContext(object->trackedStream()) : nullptr) {
     if (context_ != nullptr) {
       context_->activate();
     }
@@ -62,7 +66,18 @@ class ScopedExecutionContext : NonCopyable {
   bool isNull() const { return context_ == nullptr; }
 
 private:
+  ExecutionContext* getExecutionContext(OptRef<const StreamInfo::StreamInfo> info) {
+    if (!info.has_value()) {
+      return nullptr;
+    }
+    const auto* const_context = info->filterState().getDataReadOnly<ExecutionContext>(
+        kConnectionExecutionContextFilterStateName);
+    return const_cast<ExecutionContext*>(const_context);
+  }
+
   ExecutionContext* context_;
 };
 
+#endif
+
 } // namespace Envoy
diff --git a/envoy/common/scope_tracker.h b/envoy/common/scope_tracker.h
index f964255415..e846f284e4 100644
--- a/envoy/common/scope_tracker.h
+++ b/envoy/common/scope_tracker.h
@@ -2,16 +2,17 @@
 
 #include <ostream>
 
-#include "envoy/common/execution_context.h"
+#include "envoy/common/optref.h"
 #include "envoy/common/pure.h"
+#include "envoy/stream_info/stream_info.h"
 
 namespace Envoy {
 
 /*
  * An interface for tracking the scope of work. Implementors of this interface
  * can be registered to the dispatcher when they're active on the stack. If a
- * fatal error occurs while they were active, the dumpState method will be
- * called.
+ * fatal error occurs while they were active, the dumpState() method will be
+ * called to output the active state.
  *
  * Currently this is only used for the L4 network connection and L7 stream.
  */
@@ -20,9 +21,11 @@ class ScopeTrackedObject {
   virtual ~ScopeTrackedObject() = default;
 
   /**
-   * If the tracked object has a ExecutionContext, returns it. Returns nullptr otherwise.
+   * Return the tracked stream info that related to the scope tracked object (L4
+   * network connection or L7 stream).
+   * @return optional reference to stream info of stream (L4 connection or L7 stream).
    */
-  virtual ExecutionContext* executionContext() const { return nullptr; }
+  virtual OptRef<const StreamInfo::StreamInfo> trackedStream() const { return {}; }
 
   /**
    * Dump debug state of the object in question to the provided ostream.
diff --git a/envoy/http/original_ip_detection.h b/envoy/http/original_ip_detection.h
index f5ddb13573..e697ba486e 100644
--- a/envoy/http/original_ip_detection.h
+++ b/envoy/http/original_ip_detection.h
@@ -74,12 +74,12 @@ class OriginalIPDetectionFactory : public Envoy::Config::TypedFactory {
   ~OriginalIPDetectionFactory() override = default;
 
   /**
-   * Creates a particular extension implementation.
+   * Creates a particular extension implementation or return an error status.
    *
    * @param config supplies the configuration for the original IP detection extension.
    * @return OriginalIPDetectionSharedPtr the extension instance.
    */
-  virtual OriginalIPDetectionSharedPtr
+  virtual absl::StatusOr<OriginalIPDetectionSharedPtr>
   createExtension(const Protobuf::Message& config,
                   Server::Configuration::FactoryContext& context) PURE;
 
diff --git a/envoy/network/BUILD b/envoy/network/BUILD
index f40b97d530..95ab4e4677 100644
--- a/envoy/network/BUILD
+++ b/envoy/network/BUILD
@@ -25,6 +25,7 @@ envoy_cc_library(
         ":filter_interface",
         ":listen_socket_interface",
         "//envoy/buffer:buffer_interface",
+        "//envoy/common:scope_tracker_interface",
         "//envoy/event:deferred_deletable",
         "//envoy/ssl:connection_interface",
         "//envoy/stream_info:stream_info_interface",
@@ -174,7 +175,6 @@ envoy_cc_library(
     deps = [
         ":io_handle_interface",
         ":socket_interface",
-        "//envoy/common:scope_tracker_interface",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],
 )
diff --git a/envoy/network/listen_socket.h b/envoy/network/listen_socket.h
index e600d2d0e4..08f4a4d5a6 100644
--- a/envoy/network/listen_socket.h
+++ b/envoy/network/listen_socket.h
@@ -7,7 +7,6 @@
 
 #include "envoy/common/exception.h"
 #include "envoy/common/pure.h"
-#include "envoy/common/scope_tracker.h"
 #include "envoy/config/core/v3/base.pb.h"
 #include "envoy/network/address.h"
 #include "envoy/network/io_handle.h"
@@ -26,7 +25,7 @@ namespace Network {
  * TODO(jrajahalme): Hide internals (e.g., fd) from listener filters by providing callbacks filters
  * may need (set/getsockopt(), peek(), recv(), etc.)
  */
-class ConnectionSocket : public virtual Socket, public virtual ScopeTrackedObject {
+class ConnectionSocket : public virtual Socket {
 public:
   /**
    * Set detected transport protocol (e.g. RAW_BUFFER, TLS).
@@ -83,6 +82,16 @@ class ConnectionSocket : public virtual Socket, public virtual ScopeTrackedObjec
    * return value is cwnd(in packets) times the connection's MSS.
    */
   virtual absl::optional<uint64_t> congestionWindowInBytes() const PURE;
+
+  /**
+   * Dump debug state of the object in question to the provided ostream.
+   *
+   * This is called on Envoy fatal errors, so should do minimal memory allocation.
+   *
+   * @param os the ostream to output to.
+   * @param indent_level how far to indent, for pretty-printed classes and subclasses.
+   */
+  virtual void dumpState(std::ostream& os, int indent_level = 0) const PURE;
 };
 
 using ConnectionSocketPtr = std::unique_ptr<ConnectionSocket>;
diff --git a/envoy/upstream/load_balancer.h b/envoy/upstream/load_balancer.h
index 196102790b..0970a85a1d 100644
--- a/envoy/upstream/load_balancer.h
+++ b/envoy/upstream/load_balancer.h
@@ -110,16 +110,24 @@ class LoadBalancerContext {
   class OrcaLoadReportCallbacks {
   public:
     virtual ~OrcaLoadReportCallbacks() = default;
-    // Invoked when a new orca report is received for this LB context.
+    /**
+     * Invoked when a new orca report is received for this LB context.
+     * @param orca_load_report supplies the ORCA load report.
+     * @param host supplies the upstream host, which provided the load report.
+     * @return absl::Status the result of ORCA load report processing by the load balancer.
+     */
     virtual absl::Status
-    onOrcaLoadReport(const xds::data::orca::v3::OrcaLoadReport& orca_load_report) PURE;
+    onOrcaLoadReport(const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+                     const HostDescription& host) PURE;
   };
 
   /**
    * Install a callback to be invoked when ORCA Load report is received for this
    * LB context.
+   * Note: LB Context keeps a weak pointer to `callbacks` and doesn't invoke the callback
+   * if it is `expired()`.
    */
-  virtual void setOrcaLoadReportCallbacks(OrcaLoadReportCallbacks& callbacks) PURE;
+  virtual void setOrcaLoadReportCallbacks(std::weak_ptr<OrcaLoadReportCallbacks> callbacks) PURE;
 };
 
 /**
diff --git a/envoy/upstream/upstream.h b/envoy/upstream/upstream.h
index e307de9471..1288341140 100644
--- a/envoy/upstream/upstream.h
+++ b/envoy/upstream/upstream.h
@@ -308,17 +308,28 @@ class Host : virtual public HostDescription {
   public:
     virtual ~HostLbPolicyData() = default;
   };
-  using HostLbPolicyDataPtr = std::shared_ptr<HostLbPolicyData>;
+  using HostLbPolicyDataPtr = std::unique_ptr<HostLbPolicyData>;
 
-  /* Takes ownership of lb_policy_data and attaches it to the host.
-   * Must be called before the host is used across threads.
+  /**
+   * Set load balancing policy related data to the host.
+   * NOTE: this method should only be called at main thread before the host is used
+   * across worker threads.
    */
   virtual void setLbPolicyData(HostLbPolicyDataPtr lb_policy_data) PURE;
 
-  /*
-   * @return a reference to the LbPolicyData attached to the host.
+  /**
+   * Get the load balancing policy related data of the host.
+   * @return the optional reference to the load balancing policy related data of the host.
+   */
+  virtual OptRef<HostLbPolicyData> lbPolicyData() const PURE;
+
+  /**
+   * Get the typed load balancing policy related data of the host.
+   * @return the optional reference to the typed load balancing policy related data of the host.
    */
-  virtual const HostLbPolicyDataPtr& lbPolicyData() const PURE;
+  template <class HostLbPolicyDataType> OptRef<HostLbPolicyDataType> typedLbPolicyData() const {
+    return makeOptRefFromPtr(dynamic_cast<HostLbPolicyDataType*>(lbPolicyData().ptr()));
+  }
 };
 
 using HostConstSharedPtr = std::shared_ptr<const Host>;
@@ -1068,6 +1079,11 @@ class ClusterInfo : public Http::FilterChainFactory {
    */
   virtual uint32_t maxResponseHeadersCount() const PURE;
 
+  /**
+   * @return uint32_t the maximum total size of response headers in KB.
+   */
+  virtual absl::optional<uint16_t> maxResponseHeadersKb() const PURE;
+
   /**
    * @return the human readable name of the cluster.
    */
diff --git a/go.mod b/go.mod
index ecd12d00ec..396033361a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/envoyproxy/envoy
 
-go 1.23
+go 1.22
 
 require google.golang.org/protobuf v1.34.2
 
diff --git a/mobile/test/performance/files_em_does_not_use b/mobile/test/performance/files_em_does_not_use
index 16c1f69644..5d9be3672e 100644
--- a/mobile/test/performance/files_em_does_not_use
+++ b/mobile/test/performance/files_em_does_not_use
@@ -20,4 +20,3 @@ source/common/tls/ocsp/ocsp.h
 source/common/formatter/http_specific_formatter.h
 source/common/formatter/stream_info_formatter.h
 source/common/tls/default_tls_certificate_selector.h
-source/common/json/json_streamer.h
diff --git a/source/common/common/scope_tracker.h b/source/common/common/scope_tracker.h
index dfe9947042..9deb53381d 100644
--- a/source/common/common/scope_tracker.h
+++ b/source/common/common/scope_tracker.h
@@ -18,9 +18,7 @@ namespace Envoy {
 class ScopeTrackerScopeState {
 public:
   ScopeTrackerScopeState(const ScopeTrackedObject* object, Event::ScopeTracker& tracker)
-      : registered_object_(object),
-        scoped_execution_context_(executionContextEnabled() ? object->executionContext() : nullptr),
-        tracker_(tracker) {
+      : registered_object_(object), tracker_(tracker) {
     tracker_.pushTrackedObject(registered_object_);
   }
 
@@ -36,14 +34,13 @@ class ScopeTrackerScopeState {
 
 private:
   friend class ScopeTrackerScopeStateTest;
-  static bool& executionContextEnabled() {
-    static bool enabled =
-        Runtime::runtimeFeatureEnabled("envoy.restart_features.enable_execution_context");
-    return enabled;
-  }
+
   const ScopeTrackedObject* registered_object_;
-  ScopedExecutionContext scoped_execution_context_;
   Event::ScopeTracker& tracker_;
+
+#ifdef ENVOY_ENABLE_EXECUTION_CONTEXT
+  ScopedExecutionContext scoped_execution_context_{registered_object_};
+#endif
 };
 
 } // namespace Envoy
diff --git a/source/common/common/stl_helpers.h b/source/common/common/stl_helpers.h
index 96a18e5e60..acd12bc7e7 100644
--- a/source/common/common/stl_helpers.h
+++ b/source/common/common/stl_helpers.h
@@ -2,9 +2,7 @@
 
 #include <algorithm>
 #include <functional>
-#include <iostream>
 #include <numeric>
-#include <vector>
 
 #include "absl/strings/str_join.h"
 
@@ -49,20 +47,3 @@ inline std::string_view toStdStringView(absl::string_view view) { // NOLINT(std:
 }
 
 } // namespace Envoy
-
-// NOLINT(namespace-envoy)
-// Overload functions in std library.
-namespace std {
-// Overload std::operator<< to output a vector.
-template <class T> std::ostream& operator<<(std::ostream& out, const std::vector<T>& v) {
-  out << "vector { " << absl::StrJoin(v, ", ", absl::StreamFormatter()) << " }";
-  return out;
-}
-
-// Overload std::operator<< to output a pair.
-template <class T1, class T2>
-std::ostream& operator<<(std::ostream& out, const std::pair<T1, T2>& v) {
-  out << "pair(" << v.first << ", " << v.second << ")";
-  return out;
-}
-} // namespace std
diff --git a/source/common/formatter/BUILD b/source/common/formatter/BUILD
index 393eb6daa9..76a0fc474c 100644
--- a/source/common/formatter/BUILD
+++ b/source/common/formatter/BUILD
@@ -26,6 +26,7 @@ envoy_cc_library(
         "//source/common/http:header_map_lib",
         "//source/common/http:utility_lib",
         "//source/common/json:json_loader_lib",
+        "//source/common/json:json_streamer_lib",
         "@com_google_absl//absl/strings:str_format",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],
@@ -55,6 +56,7 @@ envoy_cc_library(
         "//source/common/http:header_utility_lib",
         "//source/common/http:utility_lib",
         "//source/common/protobuf:utility_lib",
+        "//source/common/runtime:runtime_features_lib",
         "//source/common/stream_info:utility_lib",
     ],
 )
@@ -85,6 +87,7 @@ envoy_cc_library(
     name = "stream_info_formatter_extension_lib",
     srcs = ["stream_info_formatter.cc"],
     hdrs = ["stream_info_formatter.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/api:api_interface",
         "//envoy/formatter:substitution_formatter_interface",
diff --git a/source/common/formatter/substitution_format_string.h b/source/common/formatter/substitution_format_string.h
index c66c77eaff..3a03ee3cfc 100644
--- a/source/common/formatter/substitution_format_string.h
+++ b/source/common/formatter/substitution_format_string.h
@@ -12,6 +12,7 @@
 #include "source/common/formatter/substitution_formatter.h"
 #include "source/common/protobuf/message_validator_impl.h"
 #include "source/common/protobuf/protobuf.h"
+#include "source/common/runtime/runtime_features.h"
 #include "source/server/generic_factory_context.h"
 
 namespace Envoy {
@@ -93,8 +94,15 @@ class SubstitutionFormatStringUtils {
   createJsonFormatter(const ProtobufWkt::Struct& struct_format, bool preserve_types,
                       bool omit_empty_values, bool sort_properties,
                       const std::vector<CommandParserBasePtr<FormatterContext>>& commands = {}) {
-    return std::make_unique<JsonFormatterBaseImpl<FormatterContext>>(
-        struct_format, preserve_types, omit_empty_values, sort_properties, commands);
+
+    if (!Runtime::runtimeFeatureEnabled(
+            "envoy.reloadable_features.logging_with_fast_json_formatter")) {
+      return std::make_unique<LegacyJsonFormatterBaseImpl<FormatterContext>>(
+          struct_format, preserve_types, omit_empty_values, sort_properties, commands);
+    }
+
+    return std::make_unique<JsonFormatterImplBase<FormatterContext>>(struct_format,
+                                                                     omit_empty_values, commands);
   }
 };
 
diff --git a/source/common/formatter/substitution_formatter.cc b/source/common/formatter/substitution_formatter.cc
index a3278cf5d7..b24f821990 100644
--- a/source/common/formatter/substitution_formatter.cc
+++ b/source/common/formatter/substitution_formatter.cc
@@ -54,5 +54,95 @@ const re2::RE2& SubstitutionFormatParser::commandWithArgsRegex() {
   // clang-format on
 }
 
+JsonFormatBuilder::FormatElements
+JsonFormatBuilder::fromStruct(const ProtobufWkt::Struct& struct_format) {
+  elements_.clear();
+
+  // This call will iterate through the map tree and serialize the key/values as JSON.
+  // If a string value that contains a substitution commands is found, the current
+  // JSON piece and the substitution command will be pushed into the output list.
+  // After that, the iteration will continue until the whole tree is traversed.
+  formatValueToFormatElements(struct_format.fields());
+  elements_.push_back(FormatElement{std::move(buffer_), false});
+  buffer_.clear();
+
+  return std::move(elements_);
+};
+
+void JsonFormatBuilder::formatValueToFormatElements(const ProtobufWkt::Value& value) {
+  switch (value.kind_case()) {
+  case ProtobufWkt::Value::KIND_NOT_SET:
+  case ProtobufWkt::Value::kNullValue:
+    serializer_.addNull();
+    break;
+  case ProtobufWkt::Value::kNumberValue:
+    serializer_.addNumber(value.number_value());
+    break;
+  case ProtobufWkt::Value::kStringValue: {
+    absl::string_view string_format = value.string_value();
+    if (!absl::StrContains(string_format, '%')) {
+      serializer_.addString(string_format);
+      break;
+    }
+
+    // The string contains a formatter, we need to push the current exist JSON piece
+    // into the output list first.
+    elements_.push_back(FormatElement{std::move(buffer_), false});
+    buffer_.clear();
+
+    // Now a formatter is coming, we need to push the current raw string into
+    // the output list.
+    elements_.push_back(FormatElement{std::string(string_format), true});
+    break;
+  }
+  case ProtobufWkt::Value::kBoolValue:
+    serializer_.addBool(value.bool_value());
+    break;
+  case ProtobufWkt::Value::kStructValue: {
+    formatValueToFormatElements(value.struct_value().fields());
+    break;
+  case ProtobufWkt::Value::kListValue:
+    formatValueToFormatElements(value.list_value().values());
+    break;
+  }
+  }
+}
+
+void JsonFormatBuilder::formatValueToFormatElements(const ProtoList& list_value) {
+  serializer_.addArrayBeginDelimiter(); // Delimiter to start list.
+  for (int i = 0; i < list_value.size(); ++i) {
+    if (i > 0) {
+      serializer_.addElementsDelimiter(); // Delimiter to separate list elements.
+    }
+    formatValueToFormatElements(list_value[i]);
+  }
+  serializer_.addArrayEndDelimiter(); // Delimiter to end list.
+}
+
+void JsonFormatBuilder::formatValueToFormatElements(const ProtoDict& dict_value) {
+  std::vector<std::pair<absl::string_view, ProtoDict::const_iterator>> sorted_fields;
+  sorted_fields.reserve(dict_value.size());
+
+  for (auto it = dict_value.begin(); it != dict_value.end(); ++it) {
+    sorted_fields.push_back({it->first, it});
+  }
+
+  // Sort the keys to make the output deterministic.
+  std::sort(sorted_fields.begin(), sorted_fields.end(),
+            [](const auto& a, const auto& b) { return a.first < b.first; });
+
+  serializer_.addMapBeginDelimiter(); // Delimiter to start map.
+  for (size_t i = 0; i < sorted_fields.size(); ++i) {
+    if (i > 0) {
+      serializer_.addElementsDelimiter(); // Delimiter to separate map elements.
+    }
+    // Add the key.
+    serializer_.addString(sorted_fields[i].first);
+    serializer_.addKeyValueDelimiter(); // Delimiter to separate key and value.
+    formatValueToFormatElements(sorted_fields[i].second->second);
+  }
+  serializer_.addMapEndDelimiter(); // Delimiter to end map.
+}
+
 } // namespace Formatter
 } // namespace Envoy
diff --git a/source/common/formatter/substitution_formatter.h b/source/common/formatter/substitution_formatter.h
index abf6ff5a69..c2f1390388 100644
--- a/source/common/formatter/substitution_formatter.h
+++ b/source/common/formatter/substitution_formatter.h
@@ -15,6 +15,7 @@
 #include "source/common/common/utility.h"
 #include "source/common/formatter/http_formatter_context.h"
 #include "source/common/json/json_loader.h"
+#include "source/common/json/json_streamer.h"
 
 #include "absl/types/optional.h"
 #include "re2/re2.h"
@@ -243,6 +244,260 @@ template <class FormatterContext> class FormatterBaseImpl : public FormatterBase
   std::vector<FormatterProviderBasePtr<FormatterContext>> providers_;
 };
 
+// Helper class to write value to output buffer in JSON style.
+// NOTE: This helper class has duplicated logic with the Json::Streamer class but
+// provides lower level of APIs to operate on the output buffer (like control the
+// delimiters). This is designed for special scenario of substitution formatter and
+// is not intended to be used by other parts of the code.
+class JsonStringSerializer {
+public:
+  using OutputBufferType = Json::StringOutput;
+  explicit JsonStringSerializer(std::string& output_buffer) : output_buffer_(output_buffer) {}
+
+  // Methods that be used to add JSON delimiter to output buffer.
+  void addMapBeginDelimiter() { output_buffer_.add(Json::Constants::MapBegin); }
+  void addMapEndDelimiter() { output_buffer_.add(Json::Constants::MapEnd); }
+  void addArrayBeginDelimiter() { output_buffer_.add(Json::Constants::ArrayBegin); }
+  void addArrayEndDelimiter() { output_buffer_.add(Json::Constants::ArrayEnd); }
+  void addElementsDelimiter() { output_buffer_.add(Json::Constants::Comma); }
+  void addKeyValueDelimiter() { output_buffer_.add(Json::Constants::Colon); }
+
+  // Methods that be used to add JSON key or value to output buffer.
+  void addString(absl::string_view value) { addSanitized(R"(")", value, R"(")"); }
+  /**
+   * Serializes a number.
+   */
+  void addNumber(double d) {
+    if (std::isnan(d)) {
+      output_buffer_.add(Json::Constants::Null);
+    } else {
+      Buffer::Util::serializeDouble(d, output_buffer_);
+    }
+  }
+  /**
+   * Serializes a integer number.
+   * NOTE: All numbers in JSON is float. When loading output of this serializer, the parser's
+   * implementation decides if the full precision of big integer could be preserved or not.
+   * See discussion here https://stackoverflow.com/questions/13502398/json-integers-limit-on-size
+   * and spec https://www.rfc-editor.org/rfc/rfc7159#section-6 for more details.
+   */
+  void addNumber(uint64_t i) { output_buffer_.add(absl::StrCat(i)); }
+  void addNumber(int64_t i) { output_buffer_.add(absl::StrCat(i)); }
+  void addBool(bool b) { output_buffer_.add(b ? Json::Constants::True : Json::Constants::False); }
+  void addNull() { output_buffer_.add(Json::Constants::Null); }
+
+  // Low-level methods that be used to provide a low-level control to buffer.
+  void addSanitized(absl::string_view prefix, absl::string_view value, absl::string_view suffix) {
+    output_buffer_.add(prefix, Json::sanitize(sanitize_buffer_, value), suffix);
+  }
+  void addRawString(absl::string_view value) { output_buffer_.add(value); }
+
+protected:
+  std::string sanitize_buffer_;
+  OutputBufferType output_buffer_;
+};
+
+// Helper class to parse the Json format configuration. The class will be used to parse
+// the JSON format configuration and convert it to a list of raw JSON pieces and
+// substitution format template strings. See comments below for more details.
+class JsonFormatBuilder {
+public:
+  struct FormatElement {
+    // Pre-sanitized JSON piece or a format template string that contains
+    // substitution commands.
+    std::string value_;
+    // Whether the value is a template string.
+    // If true, the value is a format template string that contains substitution commands.
+    // If false, the value is a pre-sanitized JSON piece.
+    bool is_template_;
+  };
+  using FormatElements = std::vector<FormatElement>;
+
+  /**
+   * Constructor of JsonFormatBuilder.
+   */
+  JsonFormatBuilder() = default;
+
+  /**
+   * Convert a proto struct format configuration to an array of raw JSON pieces and
+   * substitution format template strings.
+   *
+   * The keys, raw values, delimiters will be serialized as JSON string pieces (raw
+   * JSON strings) directly when loading the configuration.
+   * The substitution format template strings will be kept as template string pieces and
+   * will be parsed to formatter providers by the JsonFormatter.
+   *
+   * NOTE: This class is used to parse the configuration of the proto struct format
+   * and should only be used in the context of parsing the configuration.
+   *
+   * For example given the following proto struct format configuration:
+   *
+   *   json_format:
+   *     name: "value"
+   *     template: "%START_TIME%"
+   *     number: 2
+   *     bool: true
+   *     list:
+   *       - "list_raw_value"
+   *       - false
+   *       - "%EMIT_TIME%"
+   *     nested:
+   *       nested_name: "nested_value"
+   *
+   * It will be parsed to the following pieces:
+   *
+   *   - '{"name":"value","template":'                                      # Raw JSON piece.
+   *   - '%START_TIME%'                                                     # Format template piece.
+   *   - ',"number":2,"bool":true,"list":["list_raw_value",false,'          # Raw JSON piece.
+   *   - '%EMIT_TIME%'                                                      # Format template piece.
+   *   - '],"nested":{"nested_name":"nested_value"}}'                       # Raw JSON piece.
+   *
+   * Finally, join the raw JSON pieces and output of substitution formatters in order
+   * to construct the final JSON output.
+   *
+   * @param struct_format the proto struct format configuration.
+   */
+  FormatElements fromStruct(const ProtobufWkt::Struct& struct_format);
+
+private:
+  using ProtoDict = Protobuf::Map<std::string, ProtobufWkt::Value>;
+  using ProtoList = Protobuf::RepeatedPtrField<ProtobufWkt::Value>;
+
+  void formatValueToFormatElements(const ProtoDict& dict_value);
+  void formatValueToFormatElements(const ProtobufWkt::Value& value);
+  void formatValueToFormatElements(const ProtoList& list_value);
+
+  std::string buffer_;                       // JSON writer buffer.
+  JsonStringSerializer serializer_{buffer_}; // JSON serializer.
+  FormatElements elements_;                  // Parsed elements.
+};
+
+template <class FormatterContext>
+class JsonFormatterImplBase : public FormatterBase<FormatterContext> {
+public:
+  using CommandParsers = std::vector<CommandParserBasePtr<FormatterContext>>;
+  using Formatter = FormatterProviderBasePtr<FormatterContext>;
+  using Formatters = std::vector<Formatter>;
+
+  JsonFormatterImplBase(const ProtobufWkt::Struct& struct_format, bool omit_empty_values,
+                        const CommandParsers& commands = {})
+      : empty_value_(omit_empty_values ? std::string()
+                                       : std::string(DefaultUnspecifiedValueStringView)) {
+
+    for (JsonFormatBuilder::FormatElement& element :
+         JsonFormatBuilder().fromStruct(struct_format)) {
+      if (element.is_template_) {
+        parsed_elements_.emplace_back(
+            SubstitutionFormatParser::parse<FormatterContext>(element.value_, commands));
+      } else {
+        parsed_elements_.emplace_back(std::move(element.value_));
+      }
+    }
+  }
+
+  std::string formatWithContext(const FormatterContext& context,
+                                const StreamInfo::StreamInfo& info) const override {
+    std::string log_line;
+    log_line.reserve(2048);
+    JsonStringSerializer serializer(log_line); // Helper to serialize the value to log line.
+
+    for (const ParsedFormatElement& element : parsed_elements_) {
+      // 1. Handle the raw string element.
+      if (absl::holds_alternative<std::string>(element)) {
+        // The raw string element will be added to the buffer directly.
+        // It is sanitized when loading the configuration.
+        serializer.addRawString(absl::get<std::string>(element));
+        continue;
+      }
+
+      ASSERT(absl::holds_alternative<Formatters>(element));
+      const Formatters& formatters = absl::get<Formatters>(element);
+      ASSERT(!formatters.empty());
+
+      if (formatters.size() != 1) {
+        // 2. Handle the formatter element with multiple or zero providers.
+        stringValueToLogLine(formatters, context, info, serializer);
+      } else {
+        // 3. Handle the formatter element with a single provider and value
+        //    type needs to be kept.
+        typedValueToLogLine(formatters, context, info, serializer);
+      }
+    }
+
+    log_line.push_back('\n');
+    return log_line;
+  }
+
+private:
+  void stringValueToLogLine(const Formatters& formatters, const FormatterContext& context,
+                            const StreamInfo::StreamInfo& info,
+                            JsonStringSerializer& serializer) const {
+
+    serializer.addRawString(Json::Constants::DoubleQuote); // Start the JSON string.
+    for (const Formatter& formatter : formatters) {
+      const absl::optional<std::string> value = formatter->formatWithContext(context, info);
+      if (!value.has_value()) {
+        // Add the empty value. This needn't be sanitized.
+        serializer.addRawString(empty_value_);
+        continue;
+      }
+      // Sanitize the string value and add it to the buffer. The string value will not be quoted
+      // since we handle the quoting by ourselves at the outer level.
+      serializer.addSanitized({}, value.value(), {});
+    }
+    serializer.addRawString(Json::Constants::DoubleQuote); // End the JSON string.
+  }
+
+  void typedValueToLogLine(const Formatters& formatters, const FormatterContext& context,
+                           const StreamInfo::StreamInfo& info,
+                           JsonStringSerializer& serializer) const {
+
+    const ProtobufWkt::Value value = formatters[0]->formatValueWithContext(context, info);
+
+    switch (value.kind_case()) {
+    case ProtobufWkt::Value::KIND_NOT_SET:
+    case ProtobufWkt::Value::kNullValue:
+      serializer.addNull();
+      break;
+    case ProtobufWkt::Value::kNumberValue:
+      serializer.addNumber(value.number_value());
+      break;
+    case ProtobufWkt::Value::kStringValue:
+      serializer.addString(value.string_value());
+      break;
+    case ProtobufWkt::Value::kBoolValue:
+      serializer.addBool(value.bool_value());
+      break;
+    case ProtobufWkt::Value::kStructValue:
+    case ProtobufWkt::Value::kListValue:
+      // Convert the struct or list to string. This may result in a performance
+      // degradation. But We rarely hit this case.
+      // Basically only metadata or filter state formatter may hit this case.
+#ifdef ENVOY_ENABLE_YAML
+      absl::StatusOr<std::string> json_or =
+          MessageUtil::getJsonStringFromMessage(value, false, true);
+      if (json_or.ok()) {
+        // We assume the output of getJsonStringFromMessage is a valid JSON string piece.
+        serializer.addRawString(json_or.value());
+      } else {
+        serializer.addString(json_or.status().ToString());
+      }
+#else
+      IS_ENVOY_BUG("Json support compiled out");
+      serializer.addRawString(R"EOF("Json support compiled out")EOF");
+#endif
+      break;
+    }
+  }
+
+  const std::string empty_value_;
+
+  using ParsedFormatElement = absl::variant<std::string, Formatters>;
+  std::vector<ParsedFormatElement> parsed_elements_;
+};
+
+using JsonFormatterImpl = JsonFormatterImplBase<HttpFormatterContext>;
+
 // Helper classes for StructFormatter::StructFormatMapVisitor.
 template <class... Ts> struct StructFormatMapVisitorHelper : Ts... { using Ts::operator()...; };
 template <class... Ts> StructFormatMapVisitorHelper(Ts...) -> StructFormatMapVisitorHelper<Ts...>;
@@ -450,13 +705,13 @@ template <class FormatterContext>
 using StructFormatterBasePtr = std::unique_ptr<StructFormatterBase<FormatterContext>>;
 
 template <class FormatterContext>
-class JsonFormatterBaseImpl : public FormatterBase<FormatterContext> {
+class LegacyJsonFormatterBaseImpl : public FormatterBase<FormatterContext> {
 public:
   using CommandParsers = std::vector<CommandParserBasePtr<FormatterContext>>;
 
-  JsonFormatterBaseImpl(const ProtobufWkt::Struct& format_mapping, bool preserve_types,
-                        bool omit_empty_values, bool sort_properties,
-                        const CommandParsers& commands = {})
+  LegacyJsonFormatterBaseImpl(const ProtobufWkt::Struct& format_mapping, bool preserve_types,
+                              bool omit_empty_values, bool sort_properties,
+                              const CommandParsers& commands = {})
       : struct_formatter_(format_mapping, preserve_types, omit_empty_values, commands),
         sort_properties_(sort_properties) {}
 
@@ -489,7 +744,7 @@ using StructFormatterPtr = std::unique_ptr<StructFormatter>;
 
 // Aliases for backwards compatibility.
 using FormatterImpl = FormatterBaseImpl<HttpFormatterContext>;
-using JsonFormatterImpl = JsonFormatterBaseImpl<HttpFormatterContext>;
+using LegacyJsonFormatterImpl = LegacyJsonFormatterBaseImpl<HttpFormatterContext>;
 
 } // namespace Formatter
 } // namespace Envoy
diff --git a/source/common/http/BUILD b/source/common/http/BUILD
index f0dc9190b8..cf716abd87 100644
--- a/source/common/http/BUILD
+++ b/source/common/http/BUILD
@@ -392,7 +392,6 @@ envoy_cc_library(
         "//source/common/config:utility_lib",
         "//source/common/http/http1:codec_lib",
         "//source/common/http/http2:codec_lib",
-        "//source/common/network:common_connection_filter_states_lib",
         "//source/common/network:proxy_protocol_filter_state_lib",
         "//source/common/network:utility_lib",
         "//source/common/quic:quic_server_factory_stub_lib",
diff --git a/source/common/http/codec_client.cc b/source/common/http/codec_client.cc
index 2f74974d98..77fb57a814 100644
--- a/source/common/http/codec_client.cc
+++ b/source/common/http/codec_client.cc
@@ -282,13 +282,14 @@ CodecClientProd::CodecClientProd(CodecType type, Network::ClientConnectionPtr&&
     }
     codec_ = std::make_unique<Http1::ClientConnectionImpl>(
         *connection_, host->cluster().http1CodecStats(), *this, host->cluster().http1Settings(),
-        host->cluster().maxResponseHeadersCount(), proxied);
+        host->cluster().maxResponseHeadersKb(), host->cluster().maxResponseHeadersCount(), proxied);
     break;
   }
   case CodecType::HTTP2:
     codec_ = std::make_unique<Http2::ClientConnectionImpl>(
         *connection_, *this, host->cluster().http2CodecStats(), random_generator,
-        host->cluster().http2Options(), Http::DEFAULT_MAX_REQUEST_HEADERS_KB,
+        host->cluster().http2Options(),
+        host->cluster().maxResponseHeadersKb().value_or(Http::DEFAULT_MAX_REQUEST_HEADERS_KB),
         host->cluster().maxResponseHeadersCount(), Http2::ProdNghttp2SessionFactory::get());
     break;
   case CodecType::HTTP3: {
@@ -296,7 +297,8 @@ CodecClientProd::CodecClientProd(CodecType type, Network::ClientConnectionPtr&&
     auto& quic_session = dynamic_cast<Quic::EnvoyQuicClientSession&>(*connection_);
     codec_ = std::make_unique<Quic::QuicHttpClientConnectionImpl>(
         quic_session, *this, host->cluster().http3CodecStats(), host->cluster().http3Options(),
-        Http::DEFAULT_MAX_REQUEST_HEADERS_KB, host->cluster().maxResponseHeadersCount());
+        host->cluster().maxResponseHeadersKb().value_or(Http::DEFAULT_MAX_REQUEST_HEADERS_KB),
+        host->cluster().maxResponseHeadersCount());
     // Initialize the session after max request header size is changed in above http client
     // connection creation.
     quic_session.Initialize();
diff --git a/source/common/http/conn_manager_impl.h b/source/common/http/conn_manager_impl.h
index aef542307f..d4f73ccef4 100644
--- a/source/common/http/conn_manager_impl.h
+++ b/source/common/http/conn_manager_impl.h
@@ -45,7 +45,6 @@
 #include "source/common/http/user_agent.h"
 #include "source/common/http/utility.h"
 #include "source/common/local_reply/local_reply.h"
-#include "source/common/network/common_connection_filter_states.h"
 #include "source/common/network/proxy_protocol_filter_state.h"
 #include "source/common/stream_info/stream_info_impl.h"
 #include "source/common/tracing/http_tracer_impl.h"
@@ -218,10 +217,9 @@ class ConnectionManagerImpl : Logger::Loggable<Logger::Id::http>,
     }
 
     // ScopeTrackedObject
-    ExecutionContext* executionContext() const override {
-      return getConnectionExecutionContext(connection_manager_.read_callbacks_->connection());
+    OptRef<const StreamInfo::StreamInfo> trackedStream() const override {
+      return filter_manager_.trackedStream();
     }
-
     void dumpState(std::ostream& os, int indent_level = 0) const override {
       const char* spaces = spacesForLevel(indent_level);
       os << spaces << "ActiveStream " << this << DUMP_MEMBER(stream_id_);
diff --git a/source/common/http/filter_manager.h b/source/common/http/filter_manager.h
index f1698144b3..1798106f86 100644
--- a/source/common/http/filter_manager.h
+++ b/source/common/http/filter_manager.h
@@ -651,6 +651,7 @@ class FilterManager : public ScopeTrackedObject,
   }
 
   // ScopeTrackedObject
+  OptRef<const StreamInfo::StreamInfo> trackedStream() const override { return streamInfo(); }
   void dumpState(std::ostream& os, int indent_level = 0) const override {
     const char* spaces = spacesForLevel(indent_level);
     os << spaces << "FilterManager " << this << DUMP_MEMBER(state_.has_1xx_headers_)
diff --git a/source/common/http/http1/BUILD b/source/common/http/http1/BUILD
index 0e31c65919..564dfd31f3 100644
--- a/source/common/http/http1/BUILD
+++ b/source/common/http/http1/BUILD
@@ -60,7 +60,6 @@ envoy_cc_library(
         "//source/common/http:headers_lib",
         "//source/common/http:status_lib",
         "//source/common/http:utility_lib",
-        "//source/common/network:common_connection_filter_states_lib",
         "//source/common/runtime:runtime_features_lib",
         "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
     ],
diff --git a/source/common/http/http1/codec_impl.cc b/source/common/http/http1/codec_impl.cc
index 5e054058a9..aea743c5f6 100644
--- a/source/common/http/http1/codec_impl.cc
+++ b/source/common/http/http1/codec_impl.cc
@@ -24,7 +24,6 @@
 #include "source/common/http/http1/header_formatter.h"
 #include "source/common/http/http1/legacy_parser_impl.h"
 #include "source/common/http/utility.h"
-#include "source/common/network/common_connection_filter_states.h"
 #include "source/common/runtime/runtime_features.h"
 
 #include "absl/container/fixed_array.h"
@@ -976,8 +975,8 @@ void ConnectionImpl::onResetStreamBase(StreamResetReason reason) {
   onResetStream(reason);
 }
 
-ExecutionContext* ConnectionImpl::executionContext() const {
-  return getConnectionExecutionContext(connection_);
+OptRef<const StreamInfo::StreamInfo> ConnectionImpl::trackedStream() const {
+  return connection_.trackedStream();
 }
 
 void ConnectionImpl::dumpState(std::ostream& os, int indent_level) const {
@@ -1428,9 +1427,11 @@ void ServerConnectionImpl::ActiveRequest::dumpState(std::ostream& os, int indent
 
 ClientConnectionImpl::ClientConnectionImpl(Network::Connection& connection, CodecStats& stats,
                                            ConnectionCallbacks&, const Http1Settings& settings,
+                                           absl::optional<uint16_t> max_response_headers_kb,
                                            const uint32_t max_response_headers_count,
                                            bool passing_through_proxy)
-    : ConnectionImpl(connection, stats, settings, MessageType::Response, MAX_RESPONSE_HEADERS_KB,
+    : ConnectionImpl(connection, stats, settings, MessageType::Response,
+                     max_response_headers_kb.value_or(MAX_RESPONSE_HEADERS_KB),
                      max_response_headers_count),
       owned_output_buffer_(connection.dispatcher().getWatermarkFactory().createBuffer(
           [&]() -> void { this->onBelowLowWatermark(); },
diff --git a/source/common/http/http1/codec_impl.h b/source/common/http/http1/codec_impl.h
index 26e3bfe82d..0efd6cdc7f 100644
--- a/source/common/http/http1/codec_impl.h
+++ b/source/common/http/http1/codec_impl.h
@@ -272,7 +272,7 @@ class ConnectionImpl : public virtual Connection,
   Envoy::Http::Status codec_status_;
 
   // ScopeTrackedObject
-  ExecutionContext* executionContext() const override;
+  OptRef<const StreamInfo::StreamInfo> trackedStream() const override;
   void dumpState(std::ostream& os, int indent_level) const override;
 
 protected:
@@ -590,6 +590,7 @@ class ClientConnectionImpl : public ClientConnection, public ConnectionImpl {
 public:
   ClientConnectionImpl(Network::Connection& connection, CodecStats& stats,
                        ConnectionCallbacks& callbacks, const Http1Settings& settings,
+                       absl::optional<uint16_t> max_response_headers_kb,
                        const uint32_t max_response_headers_count,
                        bool passing_through_proxy = false);
   // Http::ClientConnection
diff --git a/source/common/http/http2/BUILD b/source/common/http/http2/BUILD
index 281377db83..34b9dadd38 100644
--- a/source/common/http/http2/BUILD
+++ b/source/common/http/http2/BUILD
@@ -56,7 +56,6 @@ envoy_cc_library(
         "//source/common/http:headers_lib",
         "//source/common/http:status_lib",
         "//source/common/http:utility_lib",
-        "//source/common/network:common_connection_filter_states_lib",
         "//source/common/runtime:runtime_features_lib",
         "@com_github_google_quiche//:http2_adapter",
         "@com_google_absl//absl/algorithm",
diff --git a/source/common/http/http2/codec_impl.cc b/source/common/http/http2/codec_impl.cc
index 92ce356540..d707a60725 100644
--- a/source/common/http/http2/codec_impl.cc
+++ b/source/common/http/http2/codec_impl.cc
@@ -25,7 +25,6 @@
 #include "source/common/http/headers.h"
 #include "source/common/http/http2/codec_stats.h"
 #include "source/common/http/utility.h"
-#include "source/common/network/common_connection_filter_states.h"
 #include "source/common/runtime/runtime_features.h"
 
 #include "absl/cleanup/cleanup.h"
@@ -2066,8 +2065,8 @@ ConnectionImpl::ClientHttp2Options::ClientHttp2Options(
 #endif
 }
 
-ExecutionContext* ConnectionImpl::executionContext() const {
-  return getConnectionExecutionContext(connection_);
+OptRef<const StreamInfo::StreamInfo> ConnectionImpl::trackedStream() const {
+  return connection_.trackedStream();
 }
 
 void ConnectionImpl::dumpState(std::ostream& os, int indent_level) const {
diff --git a/source/common/http/http2/codec_impl.h b/source/common/http/http2/codec_impl.h
index e7603e24d6..f93f334773 100644
--- a/source/common/http/http2/codec_impl.h
+++ b/source/common/http/http2/codec_impl.h
@@ -179,7 +179,7 @@ class ConnectionImpl : public virtual Connection,
   }
 
   // ScopeTrackedObject
-  ExecutionContext* executionContext() const override;
+  OptRef<const StreamInfo::StreamInfo> trackedStream() const override;
   void dumpState(std::ostream& os, int indent_level) const override;
 
 protected:
diff --git a/source/common/json/constants.h b/source/common/json/constants.h
index 2207d6c7b5..1da68eda6b 100644
--- a/source/common/json/constants.h
+++ b/source/common/json/constants.h
@@ -11,6 +11,15 @@ class Constants {
   static constexpr absl::string_view True = "true";
   static constexpr absl::string_view False = "false";
   static constexpr absl::string_view Null = "null";
+
+  // Constants for common JSON delimiters.
+  static constexpr absl::string_view DoubleQuote = "\"";
+  static constexpr absl::string_view Comma = ",";
+  static constexpr absl::string_view Colon = ":";
+  static constexpr absl::string_view ArrayBegin = "[";
+  static constexpr absl::string_view ArrayEnd = "]";
+  static constexpr absl::string_view MapBegin = "{";
+  static constexpr absl::string_view MapEnd = "}";
 };
 
 } // namespace Json
diff --git a/source/common/json/json_streamer.h b/source/common/json/json_streamer.h
index ae18b7a386..49239326e6 100644
--- a/source/common/json/json_streamer.h
+++ b/source/common/json/json_streamer.h
@@ -393,6 +393,13 @@ template <class OutputBufferType> class StreamerBase {
       Buffer::Util::serializeDouble(d, response_);
     }
   }
+  /**
+   * Serializes a integer number.
+   * NOTE: All numbers in JSON is float. When loading output of this serializer, the parser's
+   * implementation decides if the full precision of big integer could be preserved or not.
+   * See discussion here https://stackoverflow.com/questions/13502398/json-integers-limit-on-size
+   * and spec https://www.rfc-editor.org/rfc/rfc7159#section-6 for more details.
+   */
   void addNumber(uint64_t u) { response_.add(absl::StrCat(u)); }
   void addNumber(int64_t i) { response_.add(absl::StrCat(i)); }
 
diff --git a/source/common/listener_manager/BUILD b/source/common/listener_manager/BUILD
index e567cb0ac8..400553b42f 100644
--- a/source/common/listener_manager/BUILD
+++ b/source/common/listener_manager/BUILD
@@ -19,6 +19,7 @@ envoy_cc_library(
         "listener_impl.h",
         "listener_manager_impl.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":active_raw_udp_listener_config",
         ":connection_handler_lib",
diff --git a/source/common/listener_manager/listener_impl.cc b/source/common/listener_manager/listener_impl.cc
index c38ade05fa..1e2c8cd03e 100644
--- a/source/common/listener_manager/listener_impl.cc
+++ b/source/common/listener_manager/listener_impl.cc
@@ -100,7 +100,8 @@ ListenSocketFactoryImpl::ListenSocketFactoryImpl(
     }
   }
 
-  sockets_.push_back(createListenSocketAndApplyOptions(factory, socket_type, 0));
+  sockets_.push_back(THROW_OR_RETURN_VALUE(
+      createListenSocketAndApplyOptions(factory, socket_type, 0), Network::SocketSharedPtr));
 
   if (sockets_[0] != nullptr && local_address_->ip() && local_address_->ip()->port() == 0) {
     local_address_ = sockets_[0]->connectionInfoProvider().localAddress();
@@ -113,7 +114,8 @@ ListenSocketFactoryImpl::ListenSocketFactoryImpl(
     if (bind_type_ != ListenerComponentFactory::BindType::ReusePort && sockets_[0] != nullptr) {
       sockets_.push_back(sockets_[0]->duplicate());
     } else {
-      sockets_.push_back(createListenSocketAndApplyOptions(factory, socket_type, i));
+      sockets_.push_back(THROW_OR_RETURN_VALUE(
+          createListenSocketAndApplyOptions(factory, socket_type, i), Network::SocketSharedPtr));
     }
   }
   ASSERT(sockets_.size() == num_sockets);
@@ -143,15 +145,15 @@ ListenSocketFactoryImpl::ListenSocketFactoryImpl(const ListenSocketFactoryImpl&
   }
 }
 
-Network::SocketSharedPtr ListenSocketFactoryImpl::createListenSocketAndApplyOptions(
+absl::StatusOr<Network::SocketSharedPtr> ListenSocketFactoryImpl::createListenSocketAndApplyOptions(
     ListenerComponentFactory& factory, Network::Socket::Type socket_type, uint32_t worker_index) {
   // Socket might be nullptr when doing server validation.
   // TODO(mattklein123): See the comment in the validation code. Make that code not return nullptr
   // so this code can be simpler.
-  Network::SocketSharedPtr socket = THROW_OR_RETURN_VALUE(
-      factory.createListenSocket(local_address_, socket_type, options_, bind_type_,
-                                 socket_creation_options_, worker_index),
-      Network::SocketSharedPtr);
+  absl::StatusOr<Network::SocketSharedPtr> socket_or_error = factory.createListenSocket(
+      local_address_, socket_type, options_, bind_type_, socket_creation_options_, worker_index);
+  RETURN_IF_NOT_OK_REF(socket_or_error.status());
+  Network::SocketSharedPtr socket = std::move(*socket_or_error);
 
   // Binding is done by now.
   ENVOY_LOG(debug, "Create listen socket for listener {} on address {}", listener_name_,
@@ -371,9 +373,9 @@ ListenerImpl::ListenerImpl(const envoy::config::listener::v3::Listener& config,
   // listener factory can provide additional options.
   THROW_IF_NOT_OK(buildUdpListenerFactory(config, parent_.server_.options().concurrency()));
   buildListenSocketOptions(config, address_opts_list);
-  createListenerFilterFactories(config);
-  validateFilterChains(config);
-  buildFilterChains(config);
+  THROW_IF_NOT_OK(createListenerFilterFactories(config));
+  THROW_IF_NOT_OK(validateFilterChains(config));
+  THROW_IF_NOT_OK(buildFilterChains(config));
   if (socket_type_ != Network::Socket::Type::Datagram) {
     buildSocketOptions(config);
     buildOriginalDstListenerFilter(config);
@@ -442,9 +444,9 @@ ListenerImpl::ListenerImpl(ListenerImpl& origin,
           POOL_COUNTER(listener_factory_context_->listenerScope()))}) {
   buildAccessLog(config);
   THROW_IF_NOT_OK(validateConfig());
-  createListenerFilterFactories(config);
-  validateFilterChains(config);
-  buildFilterChains(config);
+  THROW_IF_NOT_OK(createListenerFilterFactories(config));
+  THROW_IF_NOT_OK(validateFilterChains(config));
+  THROW_IF_NOT_OK(buildFilterChains(config));
   THROW_IF_NOT_OK(buildInternalListener(config));
   if (socket_type_ == Network::Socket::Type::Stream) {
     // Apply the options below only for TCP.
@@ -685,42 +687,47 @@ void ListenerImpl::buildListenSocketOptions(
   }
 }
 
-void ListenerImpl::createListenerFilterFactories(
-    const envoy::config::listener::v3::Listener& config) {
+absl::Status
+ListenerImpl::createListenerFilterFactories(const envoy::config::listener::v3::Listener& config) {
   if (!config.listener_filters().empty()) {
     switch (socket_type_) {
     case Network::Socket::Type::Datagram: {
       if (udp_listener_config_->listener_factory_->isTransportConnectionless()) {
-        udp_listener_filter_factories_ =
-            THROW_OR_RETURN_VALUE(parent_.factory_->createUdpListenerFilterFactoryList(
-                                      config.listener_filters(), *listener_factory_context_),
-                                  std::vector<Network::UdpListenerFilterFactoryCb>);
+        auto udp_listener_filter_factory_or_error =
+            parent_.factory_->createUdpListenerFilterFactoryList(config.listener_filters(),
+                                                                 *listener_factory_context_);
+        RETURN_IF_NOT_OK_REF(udp_listener_filter_factory_or_error.status());
+        udp_listener_filter_factories_ = std::move(*udp_listener_filter_factory_or_error);
       } else {
+        absl::StatusOr<Filter::QuicListenerFilterFactoriesList>
+            quic_listener_filter_factory_or_error =
+                parent_.factory_->createQuicListenerFilterFactoryList(config.listener_filters(),
+                                                                      *listener_factory_context_);
+        RETURN_IF_NOT_OK_REF(quic_listener_filter_factory_or_error.status());
         // This is a QUIC listener.
-        quic_listener_filter_factories_ =
-            THROW_OR_RETURN_VALUE(parent_.factory_->createQuicListenerFilterFactoryList(
-                                      config.listener_filters(), *listener_factory_context_),
-                                  Filter::QuicListenerFilterFactoriesList);
+        quic_listener_filter_factories_ = std::move(*quic_listener_filter_factory_or_error);
       }
       break;
     }
     case Network::Socket::Type::Stream:
-      listener_filter_factories_ =
-          THROW_OR_RETURN_VALUE(parent_.factory_->createListenerFilterFactoryList(
-                                    config.listener_filters(), *listener_factory_context_),
-                                Filter::ListenerFilterFactoriesList);
+      auto listener_filter_factory_or_error = parent_.factory_->createListenerFilterFactoryList(
+          config.listener_filters(), *listener_factory_context_);
+      RETURN_IF_NOT_OK_REF(listener_filter_factory_or_error.status());
+      listener_filter_factories_ = std::move(*listener_filter_factory_or_error);
       break;
     }
   }
+  return absl::OkStatus();
 }
 
-void ListenerImpl::validateFilterChains(const envoy::config::listener::v3::Listener& config) {
+absl::Status
+ListenerImpl::validateFilterChains(const envoy::config::listener::v3::Listener& config) {
   if (config.filter_chains().empty() && !config.has_default_filter_chain() &&
       (socket_type_ == Network::Socket::Type::Stream ||
        !udp_listener_config_->listener_factory_->isTransportConnectionless())) {
     // If we got here, this is a tcp listener or connection-oriented udp listener, so ensure there
     // is a filter chain specified
-    throwEnvoyExceptionOrPanic(
+    return absl::InvalidArgumentError(
         fmt::format("error adding listener '{}': no filter chains specified",
                     absl::StrJoin(addresses_, ",", Network::AddressStrFormatter())));
   } else if (udp_listener_config_ != nullptr &&
@@ -729,7 +736,7 @@ void ListenerImpl::validateFilterChains(const envoy::config::listener::v3::Liste
     if (anyFilterChain(config, [](const auto& filter_chain) {
           return !filter_chain.has_transport_socket();
         })) {
-      throwEnvoyExceptionOrPanic(
+      return absl::InvalidArgumentError(
           fmt::format("error adding listener '{}': no transport socket "
                       "specified for connection oriented UDP listener",
                       absl::StrJoin(addresses_, ",", Network::AddressStrFormatter())));
@@ -738,26 +745,28 @@ void ListenerImpl::validateFilterChains(const envoy::config::listener::v3::Liste
              udp_listener_config_ != nullptr &&
              udp_listener_config_->listener_factory_->isTransportConnectionless()) {
 
-    throwEnvoyExceptionOrPanic(
+    return absl::InvalidArgumentError(
         fmt::format("error adding listener '{}': {} filter chain(s) specified for "
                     "connection-less UDP listener.",
                     absl::StrJoin(addresses_, ",", Network::AddressStrFormatter()),
                     config.filter_chains_size()));
   }
+  return absl::OkStatus();
 }
 
-void ListenerImpl::buildFilterChains(const envoy::config::listener::v3::Listener& config) {
+absl::Status ListenerImpl::buildFilterChains(const envoy::config::listener::v3::Listener& config) {
   transport_factory_context_->setInitManager(*dynamic_init_manager_);
   ListenerFilterChainFactoryBuilder builder(*this, *transport_factory_context_);
-  THROW_IF_NOT_OK(filter_chain_manager_->addFilterChains(
+  return filter_chain_manager_->addFilterChains(
       config.has_filter_chain_matcher() ? &config.filter_chain_matcher() : nullptr,
       config.filter_chains(),
       config.has_default_filter_chain() ? &config.default_filter_chain() : nullptr, builder,
-      *filter_chain_manager_));
+      *filter_chain_manager_);
 }
 
-void ListenerImpl::buildConnectionBalancer(const envoy::config::listener::v3::Listener& config,
-                                           const Network::Address::Instance& address) {
+absl::Status
+ListenerImpl::buildConnectionBalancer(const envoy::config::listener::v3::Listener& config,
+                                      const Network::Address::Instance& address) {
   auto iter = connection_balancers_.find(address.asString());
   if (iter == connection_balancers_.end() && socket_type_ == Network::Socket::Type::Stream) {
 #ifdef WIN32
@@ -788,7 +797,7 @@ void ListenerImpl::buildConnectionBalancer(const envoy::config::listener::v3::Li
             Envoy::Registry::FactoryRegistry<Network::ConnectionBalanceFactory>::getFactoryByType(
                 connection_balance_library_type);
         if (factory == nullptr) {
-          throwEnvoyExceptionOrPanic(
+          return absl::InvalidArgumentError(
               fmt::format("Didn't find a registered implementation for type: '{}'",
                           connection_balance_library_type));
         }
@@ -799,7 +808,7 @@ void ListenerImpl::buildConnectionBalancer(const envoy::config::listener::v3::Li
         break;
       }
       case envoy::config::listener::v3::Listener_ConnectionBalanceConfig::BALANCE_TYPE_NOT_SET: {
-        throwEnvoyExceptionOrPanic("No valid balance type for connection balance");
+        return absl::InvalidArgumentError("No valid balance type for connection balance");
       }
       }
     } else {
@@ -808,6 +817,7 @@ void ListenerImpl::buildConnectionBalancer(const envoy::config::listener::v3::Li
     }
 #endif
   }
+  return absl::OkStatus();
 }
 
 void ListenerImpl::buildSocketOptions(const envoy::config::listener::v3::Listener& config) {
@@ -961,14 +971,15 @@ ListenerImpl::~ListenerImpl() {
 
 Init::Manager& ListenerImpl::initManager() { return *dynamic_init_manager_; }
 
-void ListenerImpl::addSocketFactory(Network::ListenSocketFactoryPtr&& socket_factory) {
-  buildConnectionBalancer(config(), *socket_factory->localAddress());
+absl::Status ListenerImpl::addSocketFactory(Network::ListenSocketFactoryPtr&& socket_factory) {
+  RETURN_IF_NOT_OK(buildConnectionBalancer(config(), *socket_factory->localAddress()));
   if (buildUdpListenerWorkerRouter(*socket_factory->localAddress(),
                                    parent_.server_.options().concurrency())) {
     parent_.server_.hotRestart().registerUdpForwardingListener(socket_factory->localAddress(),
                                                                udp_listener_config_);
   }
   socket_factories_.emplace_back(std::move(socket_factory));
+  return absl::OkStatus();
 }
 
 bool ListenerImpl::supportUpdateFilterChain(const envoy::config::listener::v3::Listener& new_config,
@@ -1132,10 +1143,11 @@ bool ListenerImpl::hasDuplicatedAddress(const ListenerImpl& other) const {
   return false;
 }
 
-void ListenerImpl::cloneSocketFactoryFrom(const ListenerImpl& other) {
+absl::Status ListenerImpl::cloneSocketFactoryFrom(const ListenerImpl& other) {
   for (auto& socket_factory : other.getSocketFactories()) {
-    addSocketFactory(socket_factory->clone());
+    RETURN_IF_NOT_OK(addSocketFactory(socket_factory->clone()));
   }
+  return absl::OkStatus();
 }
 
 void ListenerImpl::closeAllSockets() {
diff --git a/source/common/listener_manager/listener_impl.h b/source/common/listener_manager/listener_impl.h
index b54b66fcb6..f7bd70f47a 100644
--- a/source/common/listener_manager/listener_impl.h
+++ b/source/common/listener_manager/listener_impl.h
@@ -91,9 +91,9 @@ class ListenSocketFactoryImpl : public Network::ListenSocketFactory,
 private:
   ListenSocketFactoryImpl(const ListenSocketFactoryImpl& factory_to_clone);
 
-  Network::SocketSharedPtr createListenSocketAndApplyOptions(ListenerComponentFactory& factory,
-                                                             Network::Socket::Type socket_type,
-                                                             uint32_t worker_index);
+  absl::StatusOr<Network::SocketSharedPtr>
+  createListenSocketAndApplyOptions(ListenerComponentFactory& factory,
+                                    Network::Socket::Type socket_type, uint32_t worker_index);
 
   ListenerComponentFactory& factory_;
   // Initially, its port number might be 0. Once a socket is created, its port
@@ -250,7 +250,7 @@ class ListenerImpl final : public Network::ListenerConfig,
   DrainManager& localDrainManager() const {
     return listener_factory_context_->listener_factory_context_base_->drainManager();
   }
-  void addSocketFactory(Network::ListenSocketFactoryPtr&& socket_factory);
+  absl::Status addSocketFactory(Network::ListenSocketFactoryPtr&& socket_factory);
   void setSocketAndOptions(const Network::SocketSharedPtr& socket);
   const Network::Socket::OptionsSharedPtr& listenSocketOptions(uint32_t address_index) {
     ASSERT(listen_socket_options_list_.size() > address_index);
@@ -328,7 +328,7 @@ class ListenerImpl final : public Network::ListenerConfig,
     }
   }
 
-  void cloneSocketFactoryFrom(const ListenerImpl& other);
+  absl::Status cloneSocketFactoryFrom(const ListenerImpl& other);
   void closeAllSockets();
 
   Network::Socket::Type socketType() const { return socket_type_; }
@@ -396,11 +396,11 @@ class ListenerImpl final : public Network::ListenerConfig,
   void buildListenSocketOptions(const envoy::config::listener::v3::Listener& config,
                                 std::vector<std::reference_wrapper<const Protobuf::RepeatedPtrField<
                                     envoy::config::core::v3::SocketOption>>>& address_opts_list);
-  void createListenerFilterFactories(const envoy::config::listener::v3::Listener& config);
-  void validateFilterChains(const envoy::config::listener::v3::Listener& config);
-  void buildFilterChains(const envoy::config::listener::v3::Listener& config);
-  void buildConnectionBalancer(const envoy::config::listener::v3::Listener& config,
-                               const Network::Address::Instance& address);
+  absl::Status createListenerFilterFactories(const envoy::config::listener::v3::Listener& config);
+  absl::Status validateFilterChains(const envoy::config::listener::v3::Listener& config);
+  absl::Status buildFilterChains(const envoy::config::listener::v3::Listener& config);
+  absl::Status buildConnectionBalancer(const envoy::config::listener::v3::Listener& config,
+                                       const Network::Address::Instance& address);
   void buildSocketOptions(const envoy::config::listener::v3::Listener& config);
   void buildOriginalDstListenerFilter(const envoy::config::listener::v3::Listener& config);
   void buildProxyProtocolListenerFilter(const envoy::config::listener::v3::Listener& config);
diff --git a/source/common/listener_manager/listener_manager_impl.cc b/source/common/listener_manager/listener_manager_impl.cc
index 6d7d47c96a..1683caf51b 100644
--- a/source/common/listener_manager/listener_manager_impl.cc
+++ b/source/common/listener_manager/listener_manager_impl.cc
@@ -529,7 +529,7 @@ ListenerManagerImpl::setupSocketFactoryForListener(ListenerImpl& new_listener,
   if (!(existing_listener.hasCompatibleAddress(new_listener) && same_socket_options)) {
     RETURN_IF_NOT_OK(setNewOrDrainingSocketFactory(new_listener.name(), new_listener));
   } else {
-    new_listener.cloneSocketFactoryFrom(existing_listener);
+    RETURN_IF_NOT_OK(new_listener.cloneSocketFactoryFrom(existing_listener));
   }
   return absl::OkStatus();
 }
@@ -1177,7 +1177,7 @@ absl::Status ListenerManagerImpl::setNewOrDrainingSocketFactory(const std::strin
   }
 
   if (draining_listener_ptr != nullptr) {
-    listener.cloneSocketFactoryFrom(*draining_listener_ptr);
+    RETURN_IF_NOT_OK(listener.cloneSocketFactoryFrom(*draining_listener_ptr));
   } else {
     return createListenSocketFactory(listener);
   }
@@ -1191,25 +1191,32 @@ absl::Status ListenerManagerImpl::createListenSocketFactory(ListenerImpl& listen
     bind_type = listener.reusePort() ? ListenerComponentFactory::BindType::ReusePort
                                      : ListenerComponentFactory::BindType::NoReusePort;
   }
+  absl::Status socket_status = absl::OkStatus();
   TRY_ASSERT_MAIN_THREAD {
     Network::SocketCreationOptions creation_options;
     creation_options.mptcp_enabled_ = listener.mptcpEnabled();
     for (std::vector<Network::Address::InstanceConstSharedPtr>::size_type i = 0;
          i < listener.addresses().size(); i++) {
-      listener.addSocketFactory(std::make_unique<ListenSocketFactoryImpl>(
+      socket_status = listener.addSocketFactory(std::make_unique<ListenSocketFactoryImpl>(
           *factory_, listener.addresses()[i], socket_type, listener.listenSocketOptions(i),
           listener.name(), listener.tcpBacklogSize(), bind_type, creation_options,
           server_.options().concurrency()));
+      if (!socket_status.ok()) {
+        break;
+      }
     }
   }
   END_TRY
   CATCH(const EnvoyException& e, {
+    socket_status = absl::InvalidArgumentError(e.what());
+    ;
+  });
+  if (!socket_status.ok()) {
     ENVOY_LOG(error, "listener '{}' failed to bind or apply socket options: {}", listener.name(),
-              e.what());
+              socket_status.message());
     incListenerCreateFailureStat();
-    return absl::InvalidArgumentError(e.what());
-  });
-  return absl::OkStatus();
+  }
+  return socket_status;
 }
 
 void ListenerManagerImpl::maybeCloseSocketsForListener(ListenerImpl& listener) {
diff --git a/source/common/network/BUILD b/source/common/network/BUILD
index 7eefab3fa3..bb9b174fff 100644
--- a/source/common/network/BUILD
+++ b/source/common/network/BUILD
@@ -80,7 +80,6 @@ envoy_cc_library(
     srcs = ["connection_impl_base.cc"],
     hdrs = ["connection_impl_base.h"],
     deps = [
-        ":common_connection_filter_states_lib",
         ":connection_socket_lib",
         ":filter_manager_lib",
         "//envoy/common:scope_tracker_interface",
@@ -624,14 +623,3 @@ envoy_cc_library(
         "//envoy/network:filter_interface",
     ],
 )
-
-envoy_cc_library(
-    name = "common_connection_filter_states_lib",
-    srcs = ["common_connection_filter_states.cc"],
-    hdrs = ["common_connection_filter_states.h"],
-    deps = [
-        "//envoy/common:execution_context",
-        "//envoy/network:connection_interface",
-        "//envoy/stream_info:filter_state_interface",
-    ],
-)
diff --git a/source/common/network/common_connection_filter_states.cc b/source/common/network/common_connection_filter_states.cc
deleted file mode 100644
index 6aef205ac1..0000000000
--- a/source/common/network/common_connection_filter_states.cc
+++ /dev/null
@@ -1,14 +0,0 @@
-#include "source/common/network/common_connection_filter_states.h"
-
-namespace Envoy {
-namespace Network {
-
-ExecutionContext* getConnectionExecutionContext(const Network::Connection& connection) {
-  const ConnectionExecutionContextFilterState* filter_state =
-      connection.streamInfo().filterState().getDataReadOnly<ConnectionExecutionContextFilterState>(
-          kConnectionExecutionContextFilterStateName);
-  return filter_state == nullptr ? nullptr : filter_state->executionContext();
-}
-
-} // namespace Network
-} // namespace Envoy
diff --git a/source/common/network/common_connection_filter_states.h b/source/common/network/common_connection_filter_states.h
deleted file mode 100644
index 4de4e97647..0000000000
--- a/source/common/network/common_connection_filter_states.h
+++ /dev/null
@@ -1,34 +0,0 @@
-#pragma once
-
-#include "envoy/common/execution_context.h"
-#include "envoy/network/connection.h"
-#include "envoy/stream_info/filter_state.h"
-
-namespace Envoy {
-namespace Network {
-
-static constexpr absl::string_view kConnectionExecutionContextFilterStateName =
-    "envoy.network.connection_execution_context";
-
-// ConnectionExecutionContextFilterState is an optional connection-level filter state that goes by
-// the name kConnectionExecutionContextFilterStateName. It owns a ExecutionContext, whose
-// activate/deactivate methods will be called when a thread starts/finishes running code on behalf
-// of the corresponding connection.
-class ConnectionExecutionContextFilterState : public Envoy::StreamInfo::FilterState::Object {
-public:
-  // It is safe, although useless, to set execution_context to nullptr.
-  explicit ConnectionExecutionContextFilterState(
-      std::unique_ptr<ExecutionContext> execution_context)
-      : execution_context_(std::move(execution_context)) {}
-
-  ExecutionContext* executionContext() const { return execution_context_.get(); }
-
-private:
-  std::unique_ptr<ExecutionContext> execution_context_;
-};
-
-// Returns the ExecutionContext of a connection, if any. Or nullptr if not found.
-ExecutionContext* getConnectionExecutionContext(const Network::Connection& connection);
-
-} // namespace Network
-} // namespace Envoy
diff --git a/source/common/network/connection_impl.h b/source/common/network/connection_impl.h
index a66ffeb186..237f027e93 100644
--- a/source/common/network/connection_impl.h
+++ b/source/common/network/connection_impl.h
@@ -148,6 +148,7 @@ class ConnectionImpl : public ConnectionImplBase, public TransportSocketCallback
 
   // ScopeTrackedObject
   void dumpState(std::ostream& os, int indent_level) const override;
+
   DetectedCloseType detectedCloseType() const override { return detected_close_type_; }
 
 protected:
diff --git a/source/common/network/connection_impl_base.cc b/source/common/network/connection_impl_base.cc
index e0586db6a8..e047afd038 100644
--- a/source/common/network/connection_impl_base.cc
+++ b/source/common/network/connection_impl_base.cc
@@ -1,7 +1,5 @@
 #include "source/common/network/connection_impl_base.h"
 
-#include "source/common/network/common_connection_filter_states.h"
-
 namespace Envoy {
 namespace Network {
 
@@ -30,6 +28,10 @@ void ConnectionImplBase::removeConnectionCallbacks(ConnectionCallbacks& callback
   }
 }
 
+OptRef<const StreamInfo::StreamInfo> ConnectionImplBase::trackedStream() const {
+  return streamInfo();
+}
+
 void ConnectionImplBase::hashKey(std::vector<uint8_t>& hash) const { addIdToHashKey(hash, id()); }
 
 void ConnectionImplBase::setConnectionStats(const ConnectionStats& stats) {
@@ -42,10 +44,6 @@ void ConnectionImplBase::setDelayedCloseTimeout(std::chrono::milliseconds timeou
   delayed_close_timeout_ = timeout;
 }
 
-ExecutionContext* ConnectionImplBase::executionContext() const {
-  return getConnectionExecutionContext(*this);
-}
-
 void ConnectionImplBase::initializeDelayedCloseTimer() {
   const auto timeout = delayed_close_timeout_.count();
   ASSERT(delayed_close_timer_ == nullptr && timeout > 0);
diff --git a/source/common/network/connection_impl_base.h b/source/common/network/connection_impl_base.h
index 4b0104adbe..32660da1b1 100644
--- a/source/common/network/connection_impl_base.h
+++ b/source/common/network/connection_impl_base.h
@@ -29,7 +29,8 @@ class ConnectionImplBase : public FilterManagerConnection,
   void setConnectionStats(const ConnectionStats& stats) override;
   void setDelayedCloseTimeout(std::chrono::milliseconds timeout) override;
 
-  ExecutionContext* executionContext() const override;
+  // ScopeTrackedObject
+  OptRef<const StreamInfo::StreamInfo> trackedStream() const override;
 
 protected:
   void initializeDelayedCloseTimer();
diff --git a/source/common/orca/orca_load_metrics.cc b/source/common/orca/orca_load_metrics.cc
index 9b931ff263..d46e8d7412 100644
--- a/source/common/orca/orca_load_metrics.cc
+++ b/source/common/orca/orca_load_metrics.cc
@@ -21,54 +21,77 @@ static constexpr absl::string_view kRpsFractionalField = "rps_fractional";
 static constexpr absl::string_view kNamedMetricsFieldPrefix = "named_metrics.";
 static constexpr absl::string_view kRequestCostFieldPrefix = "request_cost.";
 static constexpr absl::string_view kUtilizationFieldPrefix = "utilization.";
-} // namespace
 
-void addOrcaNamedMetricToLoadMetricStats(const Protobuf::Map<std::string, double>& metrics_map,
-                                         const absl::string_view metric_name,
-                                         const absl::string_view metric_name_prefix,
-                                         Upstream::LoadMetricStats& stats) {
-  absl::string_view metric_name_without_prefix = absl::StripPrefix(metric_name, metric_name_prefix);
-  // If the metric name is "*", add all metrics from the map.
+using OnLoadReportMetricFn =
+    std::function<void(absl::string_view metric_name, double metric_value)>;
+
+void scanOrcaLoadReportMetricsMap(const Protobuf::Map<std::string, double>& metrics_map,
+                                  absl::string_view metric_name,
+                                  absl::string_view metric_name_prefix,
+                                  OnLoadReportMetricFn on_load_report_metric) {
+  absl::string_view metric_name_without_prefix = metric_name.substr(metric_name_prefix.size());
+  // If the metric name is "*", report all metrics from the map.
   if (metric_name_without_prefix == "*") {
     for (const auto& [key, value] : metrics_map) {
-      stats.add(absl::StrCat(metric_name_prefix, key), value);
+      on_load_report_metric(absl::StrCat(metric_name_prefix, key), value);
     }
   } else {
-    // Add the metric if it exists in the map.
+    // Report the metric if it exists in the map.
     const auto metric_it = metrics_map.find(metric_name_without_prefix);
     if (metric_it != metrics_map.end()) {
-      stats.add(metric_name, metric_it->second);
+      on_load_report_metric(metric_name, metric_it->second);
     }
   }
 }
 
-void addOrcaLoadReportToLoadMetricStats(const LrsReportMetricNames& metric_names,
-                                        const xds::data::orca::v3::OrcaLoadReport& report,
-                                        Upstream::LoadMetricStats& stats) {
+void scanOrcaLoadReport(const LrsReportMetricNames& metric_names,
+                        const xds::data::orca::v3::OrcaLoadReport& report,
+                        OnLoadReportMetricFn on_load_report_metric) {
   // TODO(efimki): Use InlineMap to speed up this loop.
   for (const std::string& metric_name : metric_names) {
     if (metric_name == kCpuUtilizationField) {
-      stats.add(metric_name, report.cpu_utilization());
+      on_load_report_metric(metric_name, report.cpu_utilization());
     } else if (metric_name == kMemUtilizationField) {
-      stats.add(metric_name, report.mem_utilization());
+      on_load_report_metric(metric_name, report.mem_utilization());
     } else if (metric_name == kApplicationUtilizationField) {
-      stats.add(metric_name, report.application_utilization());
+      on_load_report_metric(metric_name, report.application_utilization());
     } else if (metric_name == kEpsField) {
-      stats.add(metric_name, report.eps());
+      on_load_report_metric(metric_name, report.eps());
     } else if (metric_name == kRpsFractionalField) {
-      stats.add(metric_name, report.rps_fractional());
+      on_load_report_metric(metric_name, report.rps_fractional());
     } else if (absl::StartsWith(metric_name, kNamedMetricsFieldPrefix)) {
-      addOrcaNamedMetricToLoadMetricStats(report.named_metrics(), metric_name,
-                                          kNamedMetricsFieldPrefix, stats);
+      scanOrcaLoadReportMetricsMap(report.named_metrics(), metric_name, kNamedMetricsFieldPrefix,
+                                   on_load_report_metric);
     } else if (absl::StartsWith(metric_name, kUtilizationFieldPrefix)) {
-      addOrcaNamedMetricToLoadMetricStats(report.utilization(), metric_name,
-                                          kUtilizationFieldPrefix, stats);
+      scanOrcaLoadReportMetricsMap(report.utilization(), metric_name, kUtilizationFieldPrefix,
+                                   on_load_report_metric);
     } else if (absl::StartsWith(metric_name, kRequestCostFieldPrefix)) {
-      addOrcaNamedMetricToLoadMetricStats(report.request_cost(), metric_name,
-                                          kRequestCostFieldPrefix, stats);
+      scanOrcaLoadReportMetricsMap(report.request_cost(), metric_name, kRequestCostFieldPrefix,
+                                   on_load_report_metric);
     }
   }
 }
 
+} // namespace
+
+void addOrcaLoadReportToLoadMetricStats(const LrsReportMetricNames& metric_names,
+                                        const xds::data::orca::v3::OrcaLoadReport& report,
+                                        Upstream::LoadMetricStats& stats) {
+  scanOrcaLoadReport(metric_names, report,
+                     [&stats](absl::string_view metric_name, double metric_value) {
+                       stats.add(metric_name, metric_value);
+                     });
+}
+
+double getMaxUtilization(const LrsReportMetricNames& metric_names,
+                         const xds::data::orca::v3::OrcaLoadReport& report) {
+  double max_utilization = 0;
+  scanOrcaLoadReport(metric_names, report,
+                     [&max_utilization](absl::string_view, double metric_value) {
+                       max_utilization = std::max<double>(max_utilization, metric_value);
+                     });
+  return max_utilization;
+}
+
 } // namespace Orca
 } // namespace Envoy
diff --git a/source/common/orca/orca_load_metrics.h b/source/common/orca/orca_load_metrics.h
index 90c213ba1b..b7e139a256 100644
--- a/source/common/orca/orca_load_metrics.h
+++ b/source/common/orca/orca_load_metrics.h
@@ -10,9 +10,14 @@ namespace Orca {
 // List of metric names to report to the LRS.
 typedef std::vector<std::string> LrsReportMetricNames;
 
+// Adds metrics with `metric_names` from the `report` to the `stats`.
 void addOrcaLoadReportToLoadMetricStats(const LrsReportMetricNames& metric_names,
                                         const xds::data::orca::v3::OrcaLoadReport& report,
                                         Upstream::LoadMetricStats& stats);
 
+// Returns the maximum value of metrics with `metric_names` in the `report`.
+double getMaxUtilization(const LrsReportMetricNames& metric_names,
+                         const xds::data::orca::v3::OrcaLoadReport& report);
+
 } // namespace Orca
 } // namespace Envoy
diff --git a/source/common/protobuf/utility.h b/source/common/protobuf/utility.h
index 546fbcd227..2d427e7d9e 100644
--- a/source/common/protobuf/utility.h
+++ b/source/common/protobuf/utility.h
@@ -23,6 +23,12 @@
 #define PROTOBUF_GET_WRAPPED_OR_DEFAULT(message, field_name, default_value)                        \
   ((message).has_##field_name() ? (message).field_name().value() : (default_value))
 
+// Obtain the value of a wrapped field (e.g. google.protobuf.UInt32Value) if set. Otherwise, return
+// absl::nullopt.
+#define PROTOBUF_GET_OPTIONAL_WRAPPED(message, field_name)                                         \
+  ((message).has_##field_name() ? absl::make_optional((message).field_name().value())              \
+                                : absl::nullopt)
+
 // Obtain the value of a wrapped field (e.g. google.protobuf.UInt32Value) if set. Otherwise, throw
 // a EnvoyException.
 
@@ -772,10 +778,7 @@ class StructUtil {
 
 } // namespace Envoy
 
-namespace std {
-// Inject an implementation of std::hash for Envoy::HashedValue into the std namespace.
-template <> struct hash<Envoy::HashedValue> {
+// Specialize std::hash on Envoy::HashedValue.
+template <> struct std::hash<Envoy::HashedValue> {
   std::size_t operator()(Envoy::HashedValue const& v) const { return v.hash(); }
 };
-
-} // namespace std
diff --git a/source/common/quic/platform/BUILD b/source/common/quic/platform/BUILD
index 4852feee02..76f9fccfd0 100644
--- a/source/common/quic/platform/BUILD
+++ b/source/common/quic/platform/BUILD
@@ -85,7 +85,6 @@ envoy_quiche_platform_impl_cc_library(
     tags = ["nofips"],
     deps = [
         "//source/common/common:assert_lib",
-        "//source/common/common:stl_helpers",
         "//source/common/common:utility_lib",
     ],
 )
diff --git a/source/common/quic/platform/quiche_logging_impl.h b/source/common/quic/platform/quiche_logging_impl.h
index c7f75d91eb..92206f1039 100644
--- a/source/common/quic/platform/quiche_logging_impl.h
+++ b/source/common/quic/platform/quiche_logging_impl.h
@@ -14,7 +14,6 @@
 
 #include "source/common/common/assert.h"
 #include "source/common/common/logger.h"
-#include "source/common/common/stl_helpers.h"
 
 #include "absl/base/optimization.h"
 #include "absl/synchronization/mutex.h"
diff --git a/source/common/router/router.cc b/source/common/router/router.cc
index 6fab5c046a..3a8eeebc50 100644
--- a/source/common/router/router.cc
+++ b/source/common/router/router.cc
@@ -2123,7 +2123,7 @@ void Filter::maybeProcessOrcaLoadReport(const Envoy::Http::HeaderMap& headers_or
   auto host = upstream_request.upstreamHost();
   const bool need_to_send_load_report =
       (host != nullptr) && cluster_->lrsReportMetricNames().has_value();
-  if (!need_to_send_load_report && !orca_load_report_callbacks_.has_value()) {
+  if (!need_to_send_load_report && orca_load_report_callbacks_.expired()) {
     return;
   }
 
@@ -2144,8 +2144,8 @@ void Filter::maybeProcessOrcaLoadReport(const Envoy::Http::HeaderMap& headers_or
                                                     orca_load_report.value(),
                                                     host->loadMetricStats());
   }
-  if (orca_load_report_callbacks_.has_value()) {
-    const absl::Status status = orca_load_report_callbacks_->onOrcaLoadReport(*orca_load_report);
+  if (auto callbacks = orca_load_report_callbacks_.lock(); callbacks != nullptr) {
+    const absl::Status status = callbacks->onOrcaLoadReport(*orca_load_report, *host);
     if (!status.ok()) {
       ENVOY_STREAM_LOG(error, "Failed to invoke OrcaLoadReportCallbacks: {}", *callbacks_,
                        status.message());
diff --git a/source/common/router/router.h b/source/common/router/router.h
index cccab2700a..730c3a4068 100644
--- a/source/common/router/router.h
+++ b/source/common/router/router.h
@@ -424,7 +424,7 @@ class Filter : Logger::Loggable<Logger::Id::router>,
     return callbacks_->upstreamOverrideHost();
   }
 
-  void setOrcaLoadReportCallbacks(OrcaLoadReportCallbacks& callbacks) override {
+  void setOrcaLoadReportCallbacks(std::weak_ptr<OrcaLoadReportCallbacks> callbacks) override {
     orca_load_report_callbacks_ = callbacks;
   }
 
@@ -610,7 +610,7 @@ class Filter : Logger::Loggable<Logger::Id::router>,
   Http::Code timeout_response_code_ = Http::Code::GatewayTimeout;
   FilterUtility::HedgingParams hedging_params_;
   Http::StreamFilterSidestreamWatermarkCallbacks watermark_callbacks_;
-  OptRef<OrcaLoadReportCallbacks> orca_load_report_callbacks_;
+  std::weak_ptr<OrcaLoadReportCallbacks> orca_load_report_callbacks_;
   bool grpc_request_ : 1;
   bool exclude_http_code_stats_ : 1;
   bool downstream_response_started_ : 1;
diff --git a/source/common/router/upstream_codec_filter.cc b/source/common/router/upstream_codec_filter.cc
index 846645a5e0..9d61eae56c 100644
--- a/source/common/router/upstream_codec_filter.cc
+++ b/source/common/router/upstream_codec_filter.cc
@@ -64,14 +64,18 @@ Http::FilterHeadersStatus UpstreamCodecFilter::decodeHeaders(Http::RequestHeader
       callbacks_->upstreamCallbacks()->upstream()->encodeHeaders(headers, end_stream);
 
   calling_encode_headers_ = false;
-  if (!status.ok() || deferred_reset_) {
-    deferred_reset_ = false;
+  if (!status.ok() || !deferred_reset_status_.ok()) {
     // It is possible that encodeHeaders() fails. This can happen if filters or other extensions
     // erroneously remove required headers.
     callbacks_->streamInfo().setResponseFlag(StreamInfo::CoreResponseFlag::DownstreamProtocolError);
     const std::string details =
-        absl::StrCat(StreamInfo::ResponseCodeDetails::get().FilterRemovedRequiredRequestHeaders,
-                     "{", StringUtil::replaceAllEmptySpace(status.message()), "}");
+        deferred_reset_status_.ok()
+            ? absl::StrCat(
+                  StreamInfo::ResponseCodeDetails::get().FilterRemovedRequiredRequestHeaders, "{",
+                  StringUtil::replaceAllEmptySpace(status.message()), "}")
+            : absl::StrCat(StreamInfo::ResponseCodeDetails::get().EarlyUpstreamReset, "{",
+                           StringUtil::replaceAllEmptySpace(deferred_reset_status_.message()), "}");
+    deferred_reset_status_ = absl::OkStatus();
     callbacks_->sendLocalReply(Http::Code::ServiceUnavailable, status.message(), nullptr,
                                absl::nullopt, details);
     return Http::FilterHeadersStatus::StopIteration;
@@ -214,6 +218,33 @@ void UpstreamCodecFilter::CodecBridge::maybeEndDecode(bool end_stream) {
   }
 }
 
+void UpstreamCodecFilter::CodecBridge::onResetStream(Http::StreamResetReason reason,
+                                                     absl::string_view transport_failure_reason) {
+  if (filter_.calling_encode_headers_) {
+    // If called while still encoding errors, the reset reason won't be appended to the details
+    // string through the reset stream call, so append it here.
+    std::string failure_reason(Http::Utility::resetReasonToString(reason));
+    if (!transport_failure_reason.empty()) {
+      absl::StrAppend(&failure_reason, absl::StrCat("|", transport_failure_reason));
+    }
+    filter_.deferred_reset_status_ = absl::InternalError(failure_reason);
+    return;
+  }
+
+  std::string failure_reason(transport_failure_reason);
+  if (reason == Http::StreamResetReason::LocalReset) {
+    if (!Runtime::runtimeFeatureEnabled(
+            "envoy.reloadable_features.report_stream_reset_error_code")) {
+      ASSERT(transport_failure_reason.empty());
+      // Use this to communicate to the upstream request to not force-terminate.
+      failure_reason = "codec_error";
+    } else {
+      failure_reason = absl::StrCat(transport_failure_reason, "|codec_error");
+    }
+  }
+  filter_.callbacks_->resetStream(reason, failure_reason);
+}
+
 REGISTER_FACTORY(UpstreamCodecFilterFactory,
                  Server::Configuration::UpstreamHttpFilterConfigFactory);
 
diff --git a/source/common/router/upstream_codec_filter.h b/source/common/router/upstream_codec_filter.h
index dd99eb4b93..da9d2a1e6c 100644
--- a/source/common/router/upstream_codec_filter.h
+++ b/source/common/router/upstream_codec_filter.h
@@ -16,6 +16,8 @@
 #include "source/common/runtime/runtime_features.h"
 #include "source/extensions/filters/http/common/factory_base.h"
 
+#include "absl/status/status.h"
+
 namespace Envoy {
 namespace Router {
 
@@ -28,7 +30,8 @@ class UpstreamCodecFilter : public Http::StreamDecoderFilter,
                             public Http::DownstreamWatermarkCallbacks,
                             public Http::UpstreamCallbacks {
 public:
-  UpstreamCodecFilter() : bridge_(*this), calling_encode_headers_(false), deferred_reset_(false) {}
+  UpstreamCodecFilter()
+      : bridge_(*this), calling_encode_headers_(false), deferred_reset_status_(absl::OkStatus()) {}
 
   // Http::DownstreamWatermarkCallbacks
   void onBelowWriteBufferLowWatermark() override;
@@ -58,26 +61,9 @@ class UpstreamCodecFilter : public Http::StreamDecoderFilter,
     void decodeTrailers(Http::ResponseTrailerMapPtr&& trailers) override;
     void decodeMetadata(Http::MetadataMapPtr&&) override;
     void dumpState(std::ostream& os, int indent_level) const override;
-
     void onResetStream(Http::StreamResetReason reason,
-                       absl::string_view transport_failure_reason) override {
-      if (filter_.calling_encode_headers_) {
-        filter_.deferred_reset_ = true;
-        return;
-      }
-      std::string failure_reason(transport_failure_reason);
-      if (reason == Http::StreamResetReason::LocalReset) {
-        if (!Runtime::runtimeFeatureEnabled(
-                "envoy.reloadable_features.report_stream_reset_error_code")) {
-          ASSERT(transport_failure_reason.empty());
-          // Use this to communicate to the upstream request to not force-terminate.
-          failure_reason = "codec_error";
-        } else {
-          failure_reason = absl::StrCat(transport_failure_reason, "|codec_error");
-        }
-      }
-      filter_.callbacks_->resetStream(reason, failure_reason);
-    }
+                       absl::string_view transport_failure_reason) override;
+
     void onAboveWriteBufferHighWatermark() override {
       filter_.callbacks_->onDecoderFilterAboveWriteBufferHighWatermark();
     }
@@ -103,7 +89,7 @@ class UpstreamCodecFilter : public Http::StreamDecoderFilter,
   OptRef<Http::RequestHeaderMap> latched_headers_;
   // Keep small members (bools and enums) at the end of class, to reduce alignment overhead.
   bool calling_encode_headers_ : 1;
-  bool deferred_reset_ : 1;
+  absl::Status deferred_reset_status_;
   absl::optional<bool> latched_end_stream_;
 
 private:
diff --git a/source/common/runtime/runtime_features.cc b/source/common/runtime/runtime_features.cc
index 0d09985c93..6ec39cd77d 100644
--- a/source/common/runtime/runtime_features.cc
+++ b/source/common/runtime/runtime_features.cc
@@ -115,9 +115,6 @@ RUNTIME_GUARD(envoy_restart_features_use_fast_protobuf_hash);
 
 // Begin false flags. Most of them should come with a TODO to flip true.
 
-// Execution context is optional and must be enabled explicitly.
-// See https://github.com/envoyproxy/envoy/issues/32012.
-FALSE_RUNTIME_GUARD(envoy_restart_features_enable_execution_context);
 // Sentinel and test flag.
 FALSE_RUNTIME_GUARD(envoy_reloadable_features_test_feature_false);
 // TODO(paul-r-gall) Make this enabled by default after additional soak time.
@@ -162,6 +159,9 @@ FALSE_RUNTIME_GUARD(envoy_reloadable_features_explicit_internal_address_config);
 // compliance restrictions.
 FALSE_RUNTIME_GUARD(envoy_reloadable_features_google_grpc_disable_tls_13);
 
+// A flag to enable the usage of the latest JSON formatter for logging.
+// TODO(wbpcode): flip to true after Envoy v1.32.0 is released.
+FALSE_RUNTIME_GUARD(envoy_reloadable_features_logging_with_fast_json_formatter);
 // TODO(yanavlasov): Flip to true after prod testing.
 // Controls whether a stream stays open when HTTP/2 or HTTP/3 upstream half closes
 // before downstream.
diff --git a/source/common/upstream/BUILD b/source/common/upstream/BUILD
index f974321a7b..4b31db6348 100644
--- a/source/common/upstream/BUILD
+++ b/source/common/upstream/BUILD
@@ -78,6 +78,7 @@ envoy_cc_library(
     name = "cluster_manager_lib",
     srcs = ["cluster_manager_impl.cc"],
     hdrs = ["cluster_manager_impl.h"],
+    rbe_pool = "2core",
     deps = [
         ":cds_api_lib",
         ":cluster_discovery_manager_lib",
@@ -363,6 +364,7 @@ envoy_cc_library(
 envoy_cc_library(
     name = "upstream_lib",
     srcs = ["upstream_impl.cc"],
+    rbe_pool = "2core",
     deps = [
         ":cluster_factory_lib",
         ":default_local_address_selector_factory",
diff --git a/source/common/upstream/load_balancer_context_base.h b/source/common/upstream/load_balancer_context_base.h
index 8157897a48..4bb8602479 100644
--- a/source/common/upstream/load_balancer_context_base.h
+++ b/source/common/upstream/load_balancer_context_base.h
@@ -35,7 +35,7 @@ class LoadBalancerContextBase : public LoadBalancerContext {
 
   absl::optional<OverrideHost> overrideHostToSelect() const override { return {}; }
 
-  void setOrcaLoadReportCallbacks(OrcaLoadReportCallbacks&) override {}
+  void setOrcaLoadReportCallbacks(std::weak_ptr<OrcaLoadReportCallbacks>) override {}
 };
 
 } // namespace Upstream
diff --git a/source/common/upstream/upstream_impl.cc b/source/common/upstream/upstream_impl.cc
index bfee8e6b2b..195d2ba59a 100644
--- a/source/common/upstream/upstream_impl.cc
+++ b/source/common/upstream/upstream_impl.cc
@@ -1229,6 +1229,8 @@ ClusterInfoImpl::ClusterInfoImpl(
           http_protocol_options_->common_http_protocol_options_, max_headers_count,
           runtime_.snapshot().getInteger(Http::MaxResponseHeadersCountOverrideKey,
                                          Http::DEFAULT_MAX_HEADERS_COUNT))),
+      max_response_headers_kb_(PROTOBUF_GET_OPTIONAL_WRAPPED(
+          http_protocol_options_->common_http_protocol_options_, max_response_headers_kb)),
       type_(config.type()),
       drain_connections_on_host_removal_(config.ignore_health_on_host_removal()),
       connection_pool_per_downstream_connection_(
diff --git a/source/common/upstream/upstream_impl.h b/source/common/upstream/upstream_impl.h
index 47d3246857..b3c93e451b 100644
--- a/source/common/upstream/upstream_impl.h
+++ b/source/common/upstream/upstream_impl.h
@@ -421,7 +421,9 @@ class HostImplBase : public Host,
   void setLbPolicyData(HostLbPolicyDataPtr lb_policy_data) override {
     lb_policy_data_ = std::move(lb_policy_data);
   }
-  const HostLbPolicyDataPtr& lbPolicyData() const override { return lb_policy_data_; }
+  OptRef<HostLbPolicyData> lbPolicyData() const override {
+    return makeOptRefFromPtr(lb_policy_data_.get());
+  }
 
 protected:
   static CreateConnectionData
@@ -913,6 +915,9 @@ class ClusterInfoImpl : public ClusterInfo,
   bool maintenanceMode() const override;
   uint64_t maxRequestsPerConnection() const override { return max_requests_per_connection_; }
   uint32_t maxResponseHeadersCount() const override { return max_response_headers_count_; }
+  absl::optional<uint16_t> maxResponseHeadersKb() const override {
+    return max_response_headers_kb_;
+  }
   const std::string& name() const override { return name_; }
   const std::string& observabilityName() const override {
     if (observability_name_ != nullptr) {
@@ -1126,6 +1131,7 @@ class ClusterInfoImpl : public ClusterInfo,
   // overhead via alignment
   const uint32_t per_connection_buffer_limit_bytes_;
   const uint32_t max_response_headers_count_;
+  const absl::optional<uint16_t> max_response_headers_kb_;
   const envoy::config::cluster::v3::Cluster::DiscoveryType type_;
   const bool drain_connections_on_host_removal_ : 1;
   const bool connection_pool_per_downstream_connection_ : 1;
diff --git a/source/exe/BUILD b/source/exe/BUILD
index 0a6038e01f..bac08b4669 100644
--- a/source/exe/BUILD
+++ b/source/exe/BUILD
@@ -29,6 +29,7 @@ envoy_cc_binary(
         "//bazel:windows_opt_build": ["generate_pdb_file"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     stamped = True,
     deps = [":envoy_main_entry_lib"],
 )
@@ -57,6 +58,7 @@ envoy_cc_library(
 envoy_cc_library(
     name = "envoy_main_entry_lib",
     srcs = ["main.cc"],
+    rbe_pool = "2core",
     deps = [
         ":envoy_main_common_lib",
         ":platform_impl_lib",
@@ -70,6 +72,7 @@ envoy_cc_library(
     name = "stripped_main_base_lib",
     srcs = ["stripped_main_base.cc"],
     hdrs = ["stripped_main_base.h"],
+    rbe_pool = "2core",
     deps = [
         ":platform_impl_lib",
         ":process_wide_lib",
@@ -103,6 +106,7 @@ envoy_cc_library(
     hdrs = [
         "main_common.h",
     ],
+    rbe_pool = "2core",
     deps = envoy_select_admin_functionality([":admin_response_lib"]) + [
         ":platform_impl_lib",
         ":process_wide_lib",
diff --git a/source/extensions/extensions_build_config.bzl b/source/extensions/extensions_build_config.bzl
index e8ddaf2a8b..7d3cdbad71 100644
--- a/source/extensions/extensions_build_config.bzl
+++ b/source/extensions/extensions_build_config.bzl
@@ -496,6 +496,7 @@ EXTENSIONS = {
     "envoy.load_balancing_policies.ring_hash":         "//source/extensions/load_balancing_policies/ring_hash:config",
     "envoy.load_balancing_policies.subset":            "//source/extensions/load_balancing_policies/subset:config",
     "envoy.load_balancing_policies.cluster_provided":  "//source/extensions/load_balancing_policies/cluster_provided:config",
+    "envoy.load_balancing_policies.client_side_weighted_round_robin": "//source/extensions/load_balancing_policies/client_side_weighted_round_robin:config",
 
     #
     # HTTP Early Header Mutation
diff --git a/source/extensions/extensions_metadata.yaml b/source/extensions/extensions_metadata.yaml
index 0b20fe9edf..14bc8765b4 100644
--- a/source/extensions/extensions_metadata.yaml
+++ b/source/extensions/extensions_metadata.yaml
@@ -1674,6 +1674,13 @@ envoy.load_balancing_policies.cluster_provided:
   status: stable
   type_urls:
   - envoy.extensions.load_balancing_policies.cluster_provided.v3.ClusterProvided
+envoy.load_balancing_policies.client_side_weighted_round_robin:
+  categories:
+  - envoy.load_balancing_policies
+  security_posture: unknown
+  status: wip
+  type_urls:
+  - envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin
 envoy.http.early_header_mutation.header_mutation:
   categories:
   - envoy.http.early_header_mutation
diff --git a/source/extensions/filters/common/expr/context.cc b/source/extensions/filters/common/expr/context.cc
index cc30fb794a..10438dff4d 100644
--- a/source/extensions/filters/common/expr/context.cc
+++ b/source/extensions/filters/common/expr/context.cc
@@ -184,6 +184,15 @@ absl::optional<CelValue> ResponseWrapper::operator[](CelValue key) const {
       return CelValue::CreateString(&details.value());
     }
     return {};
+  } else if (value == BackendLatency) {
+    Envoy::StreamInfo::TimingUtility timing(info_);
+    const auto last_upstream_rx_byte_received = timing.lastUpstreamRxByteReceived();
+    const auto first_upstream_tx_byte_sent = timing.firstUpstreamTxByteSent();
+    if (last_upstream_rx_byte_received.has_value() && first_upstream_tx_byte_sent.has_value()) {
+      return CelValue::CreateDuration(absl::FromChrono(last_upstream_rx_byte_received.value() -
+                                                       first_upstream_tx_byte_sent.value()));
+    }
+    return {};
   }
   return {};
 }
diff --git a/source/extensions/filters/common/expr/context.h b/source/extensions/filters/common/expr/context.h
index 7e5f5d1def..867776641e 100644
--- a/source/extensions/filters/common/expr/context.h
+++ b/source/extensions/filters/common/expr/context.h
@@ -8,6 +8,7 @@
 #include "source/common/http/headers.h"
 #include "source/common/runtime/runtime_features.h"
 #include "source/common/singleton/const_singleton.h"
+#include "source/common/stream_info/utility.h"
 
 #include "eval/public/cel_value.h"
 #include "eval/public/containers/container_backed_list_impl.h"
@@ -47,6 +48,7 @@ constexpr absl::string_view CodeDetails = "code_details";
 constexpr absl::string_view Trailers = "trailers";
 constexpr absl::string_view Flags = "flags";
 constexpr absl::string_view GrpcStatus = "grpc_status";
+constexpr absl::string_view BackendLatency = "backend_latency";
 
 // Per-request or per-connection metadata
 constexpr absl::string_view Metadata = "metadata";
diff --git a/source/extensions/filters/http/ext_proc/client.h b/source/extensions/filters/http/ext_proc/client.h
index 54493c094f..413bbcac77 100644
--- a/source/extensions/filters/http/ext_proc/client.h
+++ b/source/extensions/filters/http/ext_proc/client.h
@@ -48,6 +48,8 @@ class ExternalProcessorClient {
         const Grpc::GrpcServiceConfigWithHashKey& config_with_hash_key,
         const Http::AsyncClient::StreamOptions& options,
         Http::StreamFilterSidestreamWatermarkCallbacks& sidestream_watermark_callbacks) PURE;
+  virtual ExternalProcessorStream* stream() PURE;
+  virtual void setStream(ExternalProcessorStream* stream) PURE;
 };
 
 using ExternalProcessorClientPtr = std::unique_ptr<ExternalProcessorClient>;
diff --git a/source/extensions/filters/http/ext_proc/client_impl.h b/source/extensions/filters/http/ext_proc/client_impl.h
index 745bd3f167..8ef177cda0 100644
--- a/source/extensions/filters/http/ext_proc/client_impl.h
+++ b/source/extensions/filters/http/ext_proc/client_impl.h
@@ -32,10 +32,15 @@ class ExternalProcessorClientImpl : public ExternalProcessorClient {
         const Grpc::GrpcServiceConfigWithHashKey& config_with_hash_key,
         const Http::AsyncClient::StreamOptions& options,
         Http::StreamFilterSidestreamWatermarkCallbacks& sidestream_watermark_callbacks) override;
+  ExternalProcessorStream* stream() override { return stream_; }
+  void setStream(ExternalProcessorStream* stream) override { stream_ = stream; }
 
 private:
   Grpc::AsyncClientManager& client_manager_;
   Stats::Scope& scope_;
+  // The gRPC stream to the external processor, which will be opened
+  // when it's time to send the first message.
+  ExternalProcessorStream* stream_ = nullptr;
 };
 
 class ExternalProcessorStreamImpl : public ExternalProcessorStream,
diff --git a/source/extensions/filters/http/ext_proc/ext_proc.cc b/source/extensions/filters/http/ext_proc/ext_proc.cc
index 83dde06362..160f51910f 100644
--- a/source/extensions/filters/http/ext_proc/ext_proc.cc
+++ b/source/extensions/filters/http/ext_proc/ext_proc.cc
@@ -189,6 +189,8 @@ FilterConfig::FilterConfig(
       deferred_close_timeout_(PROTOBUF_GET_MS_OR_DEFAULT(config, deferred_close_timeout,
                                                          DEFAULT_DEFERRED_CLOSE_TIMEOUT_MS)),
       message_timeout_(message_timeout), max_message_timeout_ms_(max_message_timeout_ms),
+      send_body_without_waiting_for_header_response_(
+          config.send_body_without_waiting_for_header_response()),
       stats_(generateStats(stats_prefix, config.stat_prefix(), scope)),
       processing_mode_(config.processing_mode()),
       mutation_checker_(config.mutation_rules(), context.regexEngine()),
@@ -339,7 +341,7 @@ Filter::StreamOpenState Filter::openStream() {
     ENVOY_LOG(debug, "External processing is completed when trying to open the gRPC stream");
     return StreamOpenState::IgnoreError;
   }
-  if (!stream_) {
+  if (!client_->stream()) {
     ENVOY_LOG(debug, "Opening gRPC stream to external processor");
 
     Http::AsyncClient::ParentContext grpc_context;
@@ -354,32 +356,33 @@ Filter::StreamOpenState Filter::openStream() {
 
     if (processing_complete_) {
       // Stream failed while starting and either onGrpcError or onGrpcClose was already called
-      // Asserts that `stream_` is nullptr since it is not valid to be used any further
+      // Asserts that `stream_object` is nullptr since it is not valid to be used any further
       // beyond this point.
       ASSERT(stream_object == nullptr);
       return sent_immediate_response_ ? StreamOpenState::Error : StreamOpenState::IgnoreError;
     }
     stats_.streams_started_.inc();
 
-    stream_ = config_->threadLocalStreamManager().store(std::move(stream_object), config_->stats(),
-                                                        config_->deferredCloseTimeout());
+    ExternalProcessorStream* stream = config_->threadLocalStreamManager().store(
+        std::move(stream_object), config_->stats(), config_->deferredCloseTimeout());
+    client_->setStream(stream);
     // For custom access logging purposes. Applicable only for Envoy gRPC as Google gRPC does not
     // have a proper implementation of streamInfo.
     if (grpc_service_.has_envoy_grpc() && logging_info_ != nullptr) {
-      logging_info_->setClusterInfo(stream_->streamInfo().upstreamClusterInfo());
+      logging_info_->setClusterInfo(client_->stream()->streamInfo().upstreamClusterInfo());
     }
   }
   return StreamOpenState::Ok;
 }
 
 void Filter::closeStream() {
-  if (stream_) {
+  if (client_->stream()) {
     ENVOY_LOG(debug, "Calling close on stream");
-    if (stream_->close()) {
+    if (client_->stream()->close()) {
       stats_.streams_closed_.inc();
     }
-    config_->threadLocalStreamManager().erase(stream_);
-    stream_ = nullptr;
+    config_->threadLocalStreamManager().erase(client_->stream());
+    client_->setStream(nullptr);
   } else {
     ENVOY_LOG(debug, "Stream already closed");
   }
@@ -387,7 +390,8 @@ void Filter::closeStream() {
 
 void Filter::deferredCloseStream() {
   ENVOY_LOG(debug, "Calling deferred close on stream");
-  config_->threadLocalStreamManager().deferredErase(stream_, filter_callbacks_->dispatcher());
+  config_->threadLocalStreamManager().deferredErase(client_->stream(),
+                                                    filter_callbacks_->dispatcher());
 }
 
 void Filter::onDestroy() {
@@ -405,8 +409,8 @@ void Filter::onDestroy() {
     // closure is deferred upon filter destruction with a timer.
 
     // First, release the referenced filter resource.
-    if (stream_ != nullptr) {
-      stream_->notifyFilterDestroy();
+    if (client_->stream() != nullptr) {
+      client_->stream()->notifyFilterDestroy();
     }
 
     // Second, perform stream deferred closure.
@@ -436,7 +440,7 @@ FilterHeadersStatus Filter::onHeaders(ProcessorState& state,
   state.onStartProcessorCall(std::bind(&Filter::onMessageTimeout, this), config_->messageTimeout(),
                              ProcessorState::CallbackState::HeadersCallback);
   ENVOY_LOG(debug, "Sending headers message");
-  stream_->send(std::move(req), false);
+  client_->stream()->send(std::move(req), false);
   stats_.stream_msgs_sent_.inc();
   state.setPaused(true);
   return FilterHeadersStatus::StopIteration;
@@ -493,16 +497,22 @@ FilterDataStatus Filter::onData(ProcessorState& state, Buffer::Instance& data, b
   }
 
   if (state.callbackState() == ProcessorState::CallbackState::HeadersCallback) {
-    ENVOY_LOG(trace, "Header processing still in progress -- holding body data");
-    // We don't know what to do with the body until the response comes back.
-    // We must buffer it in case we need it when that happens.
-    // Raise a watermark to prevent a buffer overflow until the response comes back.
-    // When end_stream is true, we need to StopIterationAndWatermark as well to stop the
-    // ActiveStream from returning error when the last chunk added to stream buffer exceeds the
-    // buffer limit.
-    state.setPaused(true);
-    state.requestWatermark();
-    return FilterDataStatus::StopIterationAndWatermark;
+    if (state.bodyMode() == ProcessingMode::STREAMED &&
+        config_->sendBodyWithoutWaitingForHeaderResponse()) {
+      ENVOY_LOG(trace, "Sending body data even header processing is still in progress as body mode "
+                       "is STREAMED and send_body_without_waiting_for_header_response is enabled");
+    } else {
+      ENVOY_LOG(trace, "Header processing still in progress -- holding body data");
+      // We don't know what to do with the body until the response comes back.
+      // We must buffer it in case we need it when that happens.
+      // Raise a watermark to prevent a buffer overflow until the response comes back.
+      // When end_stream is true, we need to StopIterationAndWatermark as well to stop the
+      // ActiveStream from returning error when the last chunk added to stream buffer exceeds the
+      // buffer limit.
+      state.setPaused(true);
+      state.requestWatermark();
+      return FilterDataStatus::StopIterationAndWatermark;
+    }
   }
 
   FilterDataStatus result;
@@ -564,11 +574,13 @@ FilterDataStatus Filter::onData(ProcessorState& state, Buffer::Instance& data, b
     // Need to first enqueue the data into the chunk queue before sending.
     auto req = setupBodyChunk(state, data, end_stream);
     state.enqueueStreamingChunk(data, end_stream);
-    sendBodyChunk(state, ProcessorState::CallbackState::StreamedBodyCallback, req);
-
-    // At this point we will continue, but with no data, because that will come later
-    if (end_stream) {
-      // But we need to stop iteration for the last chunk because it's our last chance to do stuff
+    // If the current state is HeadersCallback, stays in that state.
+    if (state.callbackState() == ProcessorState::CallbackState::HeadersCallback) {
+      sendBodyChunk(state, ProcessorState::CallbackState::HeadersCallback, req);
+    } else {
+      sendBodyChunk(state, ProcessorState::CallbackState::StreamedBodyCallback, req);
+    }
+    if (end_stream || state.callbackState() == ProcessorState::CallbackState::HeadersCallback) {
       state.setPaused(true);
       result = FilterDataStatus::StopIterationNoBuffer;
     } else {
@@ -661,7 +673,7 @@ Filter::sendHeadersInObservabilityMode(Http::RequestOrResponseHeaderMap& headers
   ProcessingRequest req =
       buildHeaderRequest(state, headers, end_stream, /*observability_mode=*/true);
   ENVOY_LOG(debug, "Sending headers message in observability mode");
-  stream_->send(std::move(req), false);
+  client_->stream()->send(std::move(req), false);
   stats_.stream_msgs_sent_.inc();
 
   return FilterHeadersStatus::Continue;
@@ -686,7 +698,7 @@ Http::FilterDataStatus Filter::sendDataInObservabilityMode(Buffer::Instance& dat
     // Set up the the body chunk and send.
     auto req = setupBodyChunk(state, data, end_stream);
     req.set_observability_mode(true);
-    stream_->send(std::move(req), false);
+    client_->stream()->send(std::move(req), false);
     stats_.stream_msgs_sent_.inc();
     ENVOY_LOG(debug, "Sending body message in ObservabilityMode");
   } else if (state.bodyMode() != ProcessingMode::NONE) {
@@ -878,7 +890,7 @@ void Filter::sendBodyChunk(ProcessorState& state, ProcessorState::CallbackState
                            ProcessingRequest& req) {
   state.onStartProcessorCall(std::bind(&Filter::onMessageTimeout, this), config_->messageTimeout(),
                              new_state);
-  stream_->send(std::move(req), false);
+  client_->stream()->send(std::move(req), false);
   stats_.stream_msgs_sent_.inc();
 }
 
@@ -894,20 +906,21 @@ void Filter::sendTrailers(ProcessorState& state, const Http::HeaderMap& trailers
   state.onStartProcessorCall(std::bind(&Filter::onMessageTimeout, this), config_->messageTimeout(),
                              ProcessorState::CallbackState::TrailersCallback);
   ENVOY_LOG(debug, "Sending trailers message");
-  stream_->send(std::move(req), false);
+  client_->stream()->send(std::move(req), false);
   stats_.stream_msgs_sent_.inc();
 }
 
 void Filter::logGrpcStreamInfo() {
-  if (stream_ != nullptr && logging_info_ != nullptr && grpc_service_.has_envoy_grpc()) {
-    const auto& upstream_meter = stream_->streamInfo().getUpstreamBytesMeter();
+  if (client_->stream() != nullptr && logging_info_ != nullptr && grpc_service_.has_envoy_grpc()) {
+    const auto& upstream_meter = client_->stream()->streamInfo().getUpstreamBytesMeter();
     if (upstream_meter != nullptr) {
       logging_info_->setBytesSent(upstream_meter->wireBytesSent());
       logging_info_->setBytesReceived(upstream_meter->wireBytesReceived());
     }
     // Only set upstream host in logging info once.
     if (logging_info_->upstreamHost() == nullptr) {
-      logging_info_->setUpstreamHost(stream_->streamInfo().upstreamInfo()->upstreamHost());
+      logging_info_->setUpstreamHost(
+          client_->stream()->streamInfo().upstreamInfo()->upstreamHost());
     }
   }
 }
@@ -1068,9 +1081,11 @@ void Filter::onReceiveMessage(std::unique_ptr<ProcessingResponse>&& r) {
   // Update processing mode now because filter callbacks check it
   // and the various "handle" methods below may result in callbacks
   // being invoked in line. This only happens when filter has allow_mode_override
-  // set to true and filter is waiting for header processing response.
+  // set to true, send_body_without_waiting_for_header_response set to false,
+  // and filter is waiting for header processing response.
   // Otherwise, the response mode_override proto field is ignored.
-  if (config_->allowModeOverride() && inHeaderProcessState() && response->has_mode_override()) {
+  if (config_->allowModeOverride() && !config_->sendBodyWithoutWaitingForHeaderResponse() &&
+      inHeaderProcessState() && response->has_mode_override()) {
     bool mode_override_allowed = true;
     const auto& mode_overide = response->mode_override();
     // First, check if mode override allow-list is configured
diff --git a/source/extensions/filters/http/ext_proc/ext_proc.h b/source/extensions/filters/http/ext_proc/ext_proc.h
index a908a1f6f7..ce5a9ed4b1 100644
--- a/source/extensions/filters/http/ext_proc/ext_proc.h
+++ b/source/extensions/filters/http/ext_proc/ext_proc.h
@@ -216,6 +216,10 @@ class FilterConfig {
 
   uint32_t maxMessageTimeout() const { return max_message_timeout_ms_; }
 
+  bool sendBodyWithoutWaitingForHeaderResponse() const {
+    return send_body_without_waiting_for_header_response_;
+  }
+
   const ExtProcFilterStats& stats() const { return stats_; }
 
   const envoy::extensions::filters::http::ext_proc::v3::ProcessingMode& processingMode() const {
@@ -283,6 +287,7 @@ class FilterConfig {
   const std::chrono::milliseconds deferred_close_timeout_;
   const std::chrono::milliseconds message_timeout_;
   const uint32_t max_message_timeout_ms_;
+  const bool send_body_without_waiting_for_header_response_;
 
   ExtProcFilterStats stats_;
   const envoy::extensions::filters::http::ext_proc::v3::ProcessingMode processing_mode_;
@@ -486,10 +491,6 @@ class Filter : public Logger::Loggable<Logger::Id::ext_proc>,
   DecodingProcessorState decoding_state_;
   EncodingProcessorState encoding_state_;
 
-  // The gRPC stream to the external processor, which will be opened
-  // when it's time to send the first message.
-  ExternalProcessorStream* stream_ = nullptr;
-
   // Set to true when no more messages need to be sent to the processor.
   // This happens when the processor has closed the stream, or when it has
   // failed.
diff --git a/source/extensions/filters/http/ext_proc/processor_state.cc b/source/extensions/filters/http/ext_proc/processor_state.cc
index 7b773d3915..b0c569c7d1 100644
--- a/source/extensions/filters/http/ext_proc/processor_state.cc
+++ b/source/extensions/filters/http/ext_proc/processor_state.cc
@@ -81,24 +81,57 @@ bool ProcessorState::restartMessageTimer(const uint32_t message_timeout_ms) {
   }
 }
 
+void ProcessorState::sendBufferedDataInStreamedMode(bool end_stream) {
+  // Process the data being buffered in streaming mode.
+  // Move the current buffer into the queue for remote processing and clear the buffered data.
+  if (hasBufferedData()) {
+    Buffer::OwnedImpl buffered_chunk;
+    modifyBufferedData([&buffered_chunk](Buffer::Instance& data) { buffered_chunk.move(data); });
+    ENVOY_LOG(debug, "Sending a chunk of buffered data ({})", buffered_chunk.length());
+    // Need to first enqueue the data into the chunk queue before sending.
+    auto req = filter_.setupBodyChunk(*this, buffered_chunk, end_stream);
+    enqueueStreamingChunk(buffered_chunk, end_stream);
+    filter_.sendBodyChunk(*this, ProcessorState::CallbackState::StreamedBodyCallback, req);
+  }
+  if (queueBelowLowLimit()) {
+    clearWatermark();
+  }
+}
+
+absl::Status ProcessorState::processHeaderMutation(const CommonResponse& common_response) {
+  ENVOY_LOG(debug, "Applying header mutations");
+  const auto mut_status = MutationUtils::applyHeaderMutations(
+      common_response.header_mutation(), *headers_,
+      common_response.status() == CommonResponse::CONTINUE_AND_REPLACE,
+      filter_.config().mutationChecker(), filter_.stats().rejected_header_mutations_,
+      shouldRemoveContentLength());
+  return mut_status;
+}
+
+ProcessorState::CallbackState
+ProcessorState::getCallbackStateAfterHeaderResp(const CommonResponse& common_response) const {
+  if (bodyMode() == ProcessingMode::STREAMED &&
+      filter_.config().sendBodyWithoutWaitingForHeaderResponse() && !chunk_queue_.empty() &&
+      (common_response.status() != CommonResponse::CONTINUE_AND_REPLACE)) {
+    return ProcessorState::CallbackState::StreamedBodyCallback;
+  }
+  return ProcessorState::CallbackState::Idle;
+}
+
 absl::Status ProcessorState::handleHeadersResponse(const HeadersResponse& response) {
   if (callback_state_ == CallbackState::HeadersCallback) {
     ENVOY_LOG(debug, "applying headers response. body mode = {}",
               ProcessingMode::BodySendMode_Name(body_mode_));
     const auto& common_response = response.response();
     if (common_response.has_header_mutation()) {
-      const auto mut_status = MutationUtils::applyHeaderMutations(
-          common_response.header_mutation(), *headers_,
-          common_response.status() == CommonResponse::CONTINUE_AND_REPLACE,
-          filter_.config().mutationChecker(), filter_.stats().rejected_header_mutations_,
-          shouldRemoveContentLength());
+      const auto mut_status = processHeaderMutation(common_response);
       if (!mut_status.ok()) {
         return mut_status;
       }
     }
 
     clearRouteCache(common_response);
-    onFinishProcessorCall(Grpc::Status::Ok);
+    onFinishProcessorCall(Grpc::Status::Ok, getCallbackStateAfterHeaderResp(common_response));
 
     if (common_response.status() == CommonResponse::CONTINUE_AND_REPLACE) {
       ENVOY_LOG(debug, "Replacing complete message");
@@ -119,6 +152,9 @@ absl::Status ProcessorState::handleHeadersResponse(const HeadersResponse& respon
           });
         }
       }
+
+      // In case any data left over in the chunk queue, clear them.
+      clearStreamingChunk();
       // Once this message is received, we won't send anything more on this request
       // or response to the processor. Clear flags to make sure.
       body_mode_ = ProcessingMode::NONE;
@@ -129,17 +165,26 @@ absl::Status ProcessorState::handleHeadersResponse(const HeadersResponse& respon
         // Fall through if there was never a body in the first place.
         ENVOY_LOG(debug, "The message had no body");
       } else if (complete_body_available_ && body_mode_ != ProcessingMode::NONE) {
-        // If we get here, then all the body data came in before the header message
-        // was complete, and the server wants the body. It doesn't matter whether the
-        // processing mode is buffered, streamed, or partially buffered.
-        if (bufferedData()) {
-          // Get here, no_body_ = false, and complete_body_available_ = true, the end_stream
-          // flag of decodeData() can be determined by whether the trailers are received.
-          // Also, bufferedData() is not nullptr means decodeData() is called, even though
-          // the data can be an empty chunk.
-          auto req = filter_.setupBodyChunk(*this, *bufferedData(), !trailers_available_);
-          filter_.sendBodyChunk(*this, ProcessorState::CallbackState::BufferedBodyCallback, req);
-          clearWatermark();
+        if (callback_state_ != CallbackState::StreamedBodyCallback) {
+          // If we get here, then all the body data came in before the header message
+          // was complete, and the server wants the body. It doesn't matter whether the
+          // processing mode is buffered, streamed, or partially buffered.
+          if (bufferedData()) {
+            // Get here, no_body_ = false, and complete_body_available_ = true, the end_stream
+            // flag of decodeData() can be determined by whether the trailers are received.
+            // Also, bufferedData() is not nullptr means decodeData() is called, even though
+            // the data can be an empty chunk.
+            auto req = filter_.setupBodyChunk(*this, *bufferedData(), !trailers_available_);
+            filter_.sendBodyChunk(*this, ProcessorState::CallbackState::BufferedBodyCallback, req);
+            clearWatermark();
+            return absl::OkStatus();
+          }
+        } else {
+          // StreamedBodyCallback state. There is pending body response.
+          // Check whether there is buffered data. If there is, send them.
+          // Do not continue filter chain here so the pending body response have chance to be
+          // served.
+          sendBufferedDataInStreamedMode(!trailers_available_);
           return absl::OkStatus();
         }
       } else if (body_mode_ == ProcessingMode::BUFFERED) {
@@ -149,22 +194,7 @@ absl::Status ProcessorState::handleHeadersResponse(const HeadersResponse& respon
         clearWatermark();
         return absl::OkStatus();
       } else if (body_mode_ == ProcessingMode::STREAMED) {
-        if (hasBufferedData()) {
-          // We now know that we need to process what we have buffered in streaming mode.
-          // Move the current buffer into the queue for remote processing and clear the
-          // buffered data.
-          Buffer::OwnedImpl buffered_chunk;
-          modifyBufferedData(
-              [&buffered_chunk](Buffer::Instance& data) { buffered_chunk.move(data); });
-          ENVOY_LOG(debug, "Sending first chunk using buffered data ({})", buffered_chunk.length());
-          // Need to first enqueue the data into the chunk queue before sending.
-          auto req = filter_.setupBodyChunk(*this, buffered_chunk, false);
-          enqueueStreamingChunk(buffered_chunk, false);
-          filter_.sendBodyChunk(*this, ProcessorState::CallbackState::StreamedBodyCallback, req);
-        }
-        if (queueBelowLowLimit()) {
-          clearWatermark();
-        }
+        sendBufferedDataInStreamedMode(false);
         continueIfNecessary();
         return absl::OkStatus();
       } else if (body_mode_ == ProcessingMode::BUFFERED_PARTIAL) {
@@ -226,12 +256,7 @@ absl::Status ProcessorState::handleBodyResponse(const BodyResponse& response) {
     if (callback_state_ == CallbackState::BufferedBodyCallback) {
       if (common_response.has_header_mutation()) {
         if (headers_ != nullptr) {
-          ENVOY_LOG(debug, "Applying header mutations to buffered body message");
-          const auto mut_status = MutationUtils::applyHeaderMutations(
-              common_response.header_mutation(), *headers_,
-              common_response.status() == CommonResponse::CONTINUE_AND_REPLACE,
-              filter_.config().mutationChecker(), filter_.stats().rejected_header_mutations_,
-              shouldRemoveContentLength());
+          const auto mut_status = processHeaderMutation(common_response);
           if (!mut_status.ok()) {
             return mut_status;
           }
@@ -291,12 +316,7 @@ absl::Status ProcessorState::handleBodyResponse(const BodyResponse& response) {
       ENVOY_BUG(chunk != nullptr, "Bad partial body callback state");
       if (common_response.has_header_mutation()) {
         if (headers_ != nullptr) {
-          ENVOY_LOG(debug, "Applying header mutations to buffered body message");
-          const auto mut_status = MutationUtils::applyHeaderMutations(
-              common_response.header_mutation(), *headers_,
-              common_response.status() == CommonResponse::CONTINUE_AND_REPLACE,
-              filter_.config().mutationChecker(), filter_.stats().rejected_header_mutations_,
-              shouldRemoveContentLength());
+          const auto mut_status = processHeaderMutation(common_response);
           if (!mut_status.ok()) {
             return mut_status;
           }
@@ -523,6 +543,13 @@ const QueuedChunk& ChunkQueue::consolidate() {
   return chunk;
 }
 
+void ChunkQueue::clear() {
+  if (queue_.size() > 1) {
+    received_data_.drain(received_data_.length());
+    queue_.clear();
+  }
+}
+
 } // namespace ExternalProcessing
 } // namespace HttpFilters
 } // namespace Extensions
diff --git a/source/extensions/filters/http/ext_proc/processor_state.h b/source/extensions/filters/http/ext_proc/processor_state.h
index 01e9bc57ae..51d8aa7918 100644
--- a/source/extensions/filters/http/ext_proc/processor_state.h
+++ b/source/extensions/filters/http/ext_proc/processor_state.h
@@ -40,6 +40,7 @@ class ChunkQueue {
   uint32_t bytesEnqueued() const { return bytes_enqueued_; }
   bool empty() const { return queue_.empty(); }
   void push(Buffer::Instance& data, bool end_stream);
+  void clear();
   QueuedChunkPtr pop(Buffer::OwnedImpl& out_data);
   const QueuedChunk& consolidate();
   Buffer::OwnedImpl& receivedData() { return received_data_; }
@@ -272,6 +273,12 @@ class ProcessorState : public Logger::Loggable<Logger::Id::ext_proc> {
 
 private:
   virtual void clearRouteCache(const envoy::service::ext_proc::v3::CommonResponse&) {}
+  void sendBufferedDataInStreamedMode(bool end_stream);
+  absl::Status
+  processHeaderMutation(const envoy::service::ext_proc::v3::CommonResponse& common_response);
+  void clearStreamingChunk() { chunk_queue_.clear(); }
+  CallbackState getCallbackStateAfterHeaderResp(
+      const envoy::service::ext_proc::v3::CommonResponse& common_response) const;
 };
 
 class DecodingProcessorState : public ProcessorState {
diff --git a/source/extensions/filters/network/http_connection_manager/config.cc b/source/extensions/filters/network/http_connection_manager/config.cc
index 563ece44c9..f038ce870a 100644
--- a/source/extensions/filters/network/http_connection_manager/config.cc
+++ b/source/extensions/filters/network/http_connection_manager/config.cc
@@ -77,10 +77,16 @@ std::unique_ptr<Http::InternalAddressConfig> createInternalAddressConfig(
     return std::make_unique<InternalAddressConfig>(config.internal_address_config(),
                                                    creation_status);
   }
-  ENVOY_LOG_ONCE_MISC(warn,
-                      "internal_address_config is not configured. The existing default behaviour "
-                      "will trust RFC1918 IP addresses, but this will be changed in next release. "
-                      "Please explictily config internal address config as the migration step.");
+
+  if (!Runtime::runtimeFeatureEnabled(
+          "envoy.reloadable_features.explicit_internal_address_config")) {
+    ENVOY_LOG_ONCE_MISC(
+        warn, "internal_address_config is not configured. The existing default behaviour "
+              "will trust RFC1918 IP addresses, but this will be changed in next release. "
+              "Please explictily config internal address config as the migration step or "
+              "config the envoy.reloadable_features.explicit_internal_address_config to "
+              "true to untrust all ips by default");
+  }
 
   return std::make_unique<Http::DefaultInternalAddressConfig>();
 }
@@ -443,6 +449,12 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
     idle_timeout_ = absl::nullopt;
   }
 
+  if (config.common_http_protocol_options().has_max_response_headers_kb()) {
+    creation_status = absl::InvalidArgumentError(
+        fmt::format("Error: max_response_headers_kb cannot be set on http_connection_manager."));
+    return;
+  }
+
   if (config.strip_any_host_port() && config.strip_matching_host_port()) {
     creation_status = absl::InvalidArgumentError(fmt::format(
         "Error: Only one of `strip_matching_host_port` or `strip_any_host_port` can be set."));
@@ -505,12 +517,13 @@ HttpConnectionManagerConfig::HttpConnectionManagerConfig(
     }
 
     auto extension = factory->createExtension(extension_config.typed_config(), context_);
-    if (!extension) {
+    SET_AND_RETURN_IF_NOT_OK(extension.status(), creation_status);
+    if (!*extension) {
       creation_status = absl::InvalidArgumentError(fmt::format(
           "Original IP detection extension could not be created: '{}'", extension_config.name()));
       return;
     }
-    original_ip_detection_extensions_.push_back(extension);
+    original_ip_detection_extensions_.push_back(*extension);
   }
 
   const auto& header_mutation_extensions = config.early_header_mutation_extensions();
diff --git a/source/extensions/http/original_ip_detection/custom_header/config.cc b/source/extensions/http/original_ip_detection/custom_header/config.cc
index d7df5dcdeb..f5395ba679 100644
--- a/source/extensions/http/original_ip_detection/custom_header/config.cc
+++ b/source/extensions/http/original_ip_detection/custom_header/config.cc
@@ -13,7 +13,7 @@ namespace Http {
 namespace OriginalIPDetection {
 namespace CustomHeader {
 
-Envoy::Http::OriginalIPDetectionSharedPtr
+absl::StatusOr<Envoy::Http::OriginalIPDetectionSharedPtr>
 CustomHeaderIPDetectionFactory::createExtension(const Protobuf::Message& message,
                                                 Server::Configuration::FactoryContext& context) {
   auto mptr = Envoy::Config::Utility::translateAnyToFactoryConfig(
diff --git a/source/extensions/http/original_ip_detection/custom_header/config.h b/source/extensions/http/original_ip_detection/custom_header/config.h
index 4c460c3a1c..7a54b674d1 100644
--- a/source/extensions/http/original_ip_detection/custom_header/config.h
+++ b/source/extensions/http/original_ip_detection/custom_header/config.h
@@ -18,7 +18,7 @@ namespace CustomHeader {
  */
 class CustomHeaderIPDetectionFactory : public Envoy::Http::OriginalIPDetectionFactory {
 public:
-  Envoy::Http::OriginalIPDetectionSharedPtr
+  absl::StatusOr<Envoy::Http::OriginalIPDetectionSharedPtr>
   createExtension(const Protobuf::Message& message,
                   Server::Configuration::FactoryContext& context) override;
 
diff --git a/source/extensions/http/original_ip_detection/xff/config.cc b/source/extensions/http/original_ip_detection/xff/config.cc
index 0f657239e3..3ebfa8deec 100644
--- a/source/extensions/http/original_ip_detection/xff/config.cc
+++ b/source/extensions/http/original_ip_detection/xff/config.cc
@@ -13,7 +13,7 @@ namespace Http {
 namespace OriginalIPDetection {
 namespace Xff {
 
-Envoy::Http::OriginalIPDetectionSharedPtr
+absl::StatusOr<Envoy::Http::OriginalIPDetectionSharedPtr>
 XffIPDetectionFactory::createExtension(const Protobuf::Message& message,
                                        Server::Configuration::FactoryContext& context) {
   auto mptr = Envoy::Config::Utility::translateAnyToFactoryConfig(
@@ -21,7 +21,7 @@ XffIPDetectionFactory::createExtension(const Protobuf::Message& message,
   const auto& proto_config = MessageUtil::downcastAndValidate<
       const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig&>(
       *mptr, context.messageValidationVisitor());
-  return std::make_shared<XffIPDetection>(proto_config);
+  return XffIPDetection::create(proto_config);
 }
 
 REGISTER_FACTORY(XffIPDetectionFactory, Envoy::Http::OriginalIPDetectionFactory);
diff --git a/source/extensions/http/original_ip_detection/xff/config.h b/source/extensions/http/original_ip_detection/xff/config.h
index ce04edbbc0..539013269f 100644
--- a/source/extensions/http/original_ip_detection/xff/config.h
+++ b/source/extensions/http/original_ip_detection/xff/config.h
@@ -18,7 +18,7 @@ namespace Xff {
  */
 class XffIPDetectionFactory : public Envoy::Http::OriginalIPDetectionFactory {
 public:
-  Envoy::Http::OriginalIPDetectionSharedPtr
+  absl::StatusOr<Envoy::Http::OriginalIPDetectionSharedPtr>
   createExtension(const Protobuf::Message& message,
                   Server::Configuration::FactoryContext& context) override;
 
diff --git a/source/extensions/http/original_ip_detection/xff/xff.cc b/source/extensions/http/original_ip_detection/xff/xff.cc
index b1c11cebab..3c3fdd60dd 100644
--- a/source/extensions/http/original_ip_detection/xff/xff.cc
+++ b/source/extensions/http/original_ip_detection/xff/xff.cc
@@ -9,13 +9,19 @@ namespace Http {
 namespace OriginalIPDetection {
 namespace Xff {
 
+absl::StatusOr<std::unique_ptr<XffIPDetection>> XffIPDetection::create(
+    const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig& config) {
+
+  if (config.has_xff_trusted_cidrs() && config.xff_num_trusted_hops() > 0) {
+    return absl::InvalidArgumentError("Cannot set both xff_num_trusted_hops and xff_trusted_cidrs");
+  }
+  return std::unique_ptr<XffIPDetection>(new XffIPDetection(config));
+}
+
 XffIPDetection::XffIPDetection(
     const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig& config)
     : xff_num_trusted_hops_(config.xff_num_trusted_hops()),
       skip_xff_append_(PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, skip_xff_append, true)) {
-  if (config.has_xff_trusted_cidrs() && config.xff_num_trusted_hops() > 0) {
-    throwEnvoyExceptionOrPanic("Cannot set both xff_num_trusted_hops and xff_trusted_cidrs");
-  }
   if (config.has_xff_trusted_cidrs()) {
     xff_trusted_cidrs_.reserve(config.xff_trusted_cidrs().cidrs().size());
     for (const envoy::config::core::v3::CidrRange& entry : config.xff_trusted_cidrs().cidrs()) {
diff --git a/source/extensions/http/original_ip_detection/xff/xff.h b/source/extensions/http/original_ip_detection/xff/xff.h
index d99388ea3b..5608842f2f 100644
--- a/source/extensions/http/original_ip_detection/xff/xff.h
+++ b/source/extensions/http/original_ip_detection/xff/xff.h
@@ -19,7 +19,9 @@ namespace Xff {
 class XffIPDetection : public Envoy::Http::OriginalIPDetection,
                        Logger::Loggable<Logger::Id::config> {
 public:
-  XffIPDetection(const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig& config);
+  static absl::StatusOr<std::unique_ptr<XffIPDetection>>
+  create(const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig& config);
+
   XffIPDetection(uint32_t xff_num_trusted_hops, bool skip_xff_append);
   XffIPDetection(const std::vector<Network::Address::CidrRange> xff_trusted_cidrs,
                  bool skip_xff_append);
@@ -27,7 +29,9 @@ class XffIPDetection : public Envoy::Http::OriginalIPDetection,
   Envoy::Http::OriginalIPDetectionResult
   detect(Envoy::Http::OriginalIPDetectionParams& params) override;
 
-private:
+protected:
+  XffIPDetection(const envoy::extensions::http::original_ip_detection::xff::v3::XffConfig& config);
+
   const uint32_t xff_num_trusted_hops_;
   std::vector<Network::Address::CidrRange> xff_trusted_cidrs_;
   const bool skip_xff_append_;
diff --git a/source/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD
new file mode 100644
index 0000000000..e858597367
--- /dev/null
+++ b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD
@@ -0,0 +1,36 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_cc_extension",
+    "envoy_cc_library",
+    "envoy_extension_package",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_extension_package()
+
+envoy_cc_extension(
+    name = "config",
+    srcs = ["config.cc"],
+    hdrs = ["config.h"],
+    deps = [
+        ":client_side_weighted_round_robin_lb_lib",
+        "//source/common/common:minimal_logger_lib",
+        "//source/common/upstream:load_balancer_context_base_lib",
+        "//source/extensions/load_balancing_policies/common:factory_base",
+        "@envoy_api//envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3:pkg_cc_proto",
+    ],
+)
+
+envoy_cc_library(
+    name = "client_side_weighted_round_robin_lb_lib",
+    srcs = ["client_side_weighted_round_robin_lb.cc"],
+    hdrs = ["client_side_weighted_round_robin_lb.h"],
+    deps = [
+        "//source/common/orca:orca_load_metrics_lib",
+        "//source/extensions/load_balancing_policies/common:load_balancer_lib",
+        "//source/extensions/load_balancing_policies/round_robin:round_robin_lb_lib",
+        "@com_github_cncf_xds//xds/data/orca/v3:pkg_cc_proto",
+        "@envoy_api//envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3:pkg_cc_proto",
+    ],
+)
diff --git a/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.cc b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.cc
new file mode 100644
index 0000000000..87226753f0
--- /dev/null
+++ b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.cc
@@ -0,0 +1,282 @@
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h"
+
+#include <sys/types.h>
+
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+
+#include "envoy/common/time.h"
+#include "envoy/upstream/upstream.h"
+
+#include "source/common/orca/orca_load_metrics.h"
+#include "source/common/protobuf/utility.h"
+#include "source/extensions/load_balancing_policies/common/load_balancer_impl.h"
+
+#include "absl/status/status.h"
+#include "xds/data/orca/v3/orca_load_report.pb.h"
+
+namespace Envoy {
+namespace Upstream {
+
+namespace {
+std::string getHostAddress(const Host* host) {
+  if (host == nullptr || host->address() == nullptr) {
+    return "unknown";
+  }
+  return host->address()->asString();
+}
+} // namespace
+
+ClientSideWeightedRoundRobinLbConfig::ClientSideWeightedRoundRobinLbConfig(
+    const ClientSideWeightedRoundRobinLbProto& lb_proto, Event::Dispatcher& main_thread_dispatcher)
+    : main_thread_dispatcher_(main_thread_dispatcher) {
+  ENVOY_LOG_MISC(trace, "ClientSideWeightedRoundRobinLbConfig config {}", lb_proto.DebugString());
+  metric_names_for_computing_utilization =
+      std::vector<std::string>(lb_proto.metric_names_for_computing_utilization().begin(),
+                               lb_proto.metric_names_for_computing_utilization().end());
+  error_utilization_penalty = lb_proto.error_utilization_penalty().value();
+  blackout_period =
+      std::chrono::milliseconds(PROTOBUF_GET_MS_OR_DEFAULT(lb_proto, blackout_period, 10000));
+  weight_expiration_period = std::chrono::milliseconds(
+      PROTOBUF_GET_MS_OR_DEFAULT(lb_proto, weight_expiration_period, 180000));
+  weight_update_period =
+      std::chrono::milliseconds(PROTOBUF_GET_MS_OR_DEFAULT(lb_proto, weight_update_period, 1000));
+}
+
+ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb::WorkerLocalLb(
+    const PrioritySet& priority_set, const PrioritySet* local_priority_set, ClusterLbStats& stats,
+    Runtime::Loader& runtime, Random::RandomGenerator& random,
+    const envoy::config::cluster::v3::Cluster::CommonLbConfig& common_config,
+    const ClientSideWeightedRoundRobinLbConfig& client_side_weighted_round_robin_config,
+    TimeSource& time_source)
+    : RoundRobinLoadBalancer(priority_set, local_priority_set, stats, runtime, random,
+                             common_config,
+                             /*round_robin_config=*/std::nullopt, time_source) {
+  orca_load_report_handler_ =
+      std::make_shared<OrcaLoadReportHandler>(client_side_weighted_round_robin_config, time_source);
+}
+
+HostConstSharedPtr
+ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb::chooseHost(LoadBalancerContext* context) {
+  HostConstSharedPtr host = RoundRobinLoadBalancer::chooseHost(context);
+  if (context != nullptr) {
+    // Configure callbacks to receive ORCA load report.
+    context->setOrcaLoadReportCallbacks(orca_load_report_handler_);
+  }
+  return host;
+}
+
+ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::OrcaLoadReportHandler(
+    const ClientSideWeightedRoundRobinLbConfig& lb_config, TimeSource& time_source)
+    : metric_names_for_computing_utilization_(lb_config.metric_names_for_computing_utilization),
+      error_utilization_penalty_(lb_config.error_utilization_penalty), time_source_(time_source) {}
+
+absl::Status ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::onOrcaLoadReport(
+    const OrcaLoadReportProto& orca_load_report, const HostDescription& host_description) {
+  const Host* host = dynamic_cast<const Host*>(&host_description);
+  ENVOY_BUG(host != nullptr, "Unable to cast HostDescription to Host.");
+  ENVOY_LOG(trace,
+            "LoadBalancerContext::OrcaLoadReportCb "
+            "orca_load_report for {} report = {}",
+            getHostAddress(host), orca_load_report.DebugString());
+  auto client_side_data = host->typedLbPolicyData<ClientSideHostLbPolicyData>();
+  if (!client_side_data.has_value()) {
+    return absl::NotFoundError("Host does not have ClientSideLbPolicyData");
+  }
+  return updateClientSideDataFromOrcaLoadReport(orca_load_report, *client_side_data);
+}
+
+void ClientSideWeightedRoundRobinLoadBalancer::initFromConfig(
+    const ClientSideWeightedRoundRobinLbConfig& lb_config) {
+  blackout_period_ = lb_config.blackout_period;
+  weight_expiration_period_ = lb_config.weight_expiration_period;
+  weight_update_period_ = lb_config.weight_update_period;
+}
+
+void ClientSideWeightedRoundRobinLoadBalancer::startWeightUpdatesOnMainThread(
+    Event::Dispatcher& main_thread_dispatcher) {
+  weight_calculation_timer_ = main_thread_dispatcher.createTimer([this]() -> void {
+    updateWeightsOnMainThread();
+    weight_calculation_timer_->enableTimer(weight_update_period_);
+  });
+  weight_calculation_timer_->enableTimer(weight_update_period_);
+}
+
+void ClientSideWeightedRoundRobinLoadBalancer::updateWeightsOnMainThread() {
+  ENVOY_LOG(trace, "updateWeightsOnMainThread");
+  for (const HostSetPtr& host_set : priority_set_.hostSetsPerPriority()) {
+    updateWeightsOnHosts(host_set->hosts());
+  }
+}
+
+void ClientSideWeightedRoundRobinLoadBalancer::updateWeightsOnHosts(const HostVector& hosts) {
+  std::vector<uint32_t> weights;
+  HostVector hosts_with_default_weight;
+  const MonotonicTime now = time_source_.monotonicTime();
+  // Weight is considered invalid (too recent) if it was first updated within `blackout_period_`.
+  const MonotonicTime max_non_empty_since = now - blackout_period_;
+  // Weight is considered invalid (too old) if it was last updated before
+  // `weight_expiration_period_`.
+  const MonotonicTime min_last_update_time = now - weight_expiration_period_;
+  weights.reserve(hosts.size());
+  hosts_with_default_weight.reserve(hosts.size());
+  ENVOY_LOG(trace, "updateWeights hosts.size() = {}, time since epoch = {}", hosts.size(),
+            now.time_since_epoch().count());
+  // Scan through all hosts and update their weights if they are valid.
+  for (const auto& host_ptr : hosts) {
+    // Get client side weight or `nullopt` if it is invalid (see above).
+    absl::optional<uint32_t> client_side_weight =
+        getClientSideWeightIfValidFromHost(*host_ptr, max_non_empty_since, min_last_update_time);
+    // If `client_side_weight` is valid, then set it as the host weight and store it in
+    // `weights` to calculate median valid weight across all hosts.
+    if (client_side_weight.has_value()) {
+      weights.push_back(*client_side_weight);
+      host_ptr->weight(*client_side_weight);
+      ENVOY_LOG(trace, "updateWeights hostWeight {} = {}", getHostAddress(host_ptr.get()),
+                host_ptr->weight());
+    } else {
+      // If `client_side_weight` is invalid, then set host to default (median) weight.
+      hosts_with_default_weight.push_back(host_ptr);
+    }
+  }
+  // Calculate the default weight as median of all valid weights.
+  uint32_t default_weight = 1;
+  if (!weights.empty()) {
+    auto median_it = weights.begin() + weights.size() / 2;
+    std::nth_element(weights.begin(), median_it, weights.end());
+    default_weight = *median_it;
+  }
+  // Update the hosts with default weight.
+  for (const auto& host_ptr : hosts_with_default_weight) {
+    host_ptr->weight(default_weight);
+    ENVOY_LOG(trace, "updateWeights default hostWeight {} = {}", getHostAddress(host_ptr.get()),
+              host_ptr->weight());
+  }
+}
+
+void ClientSideWeightedRoundRobinLoadBalancer::addClientSideLbPolicyDataToHosts(
+    const HostVector& hosts) {
+  for (const auto& host_ptr : hosts) {
+    if (!host_ptr->lbPolicyData().has_value()) {
+      ENVOY_LOG(trace, "Adding LB policy data to Host {}", getHostAddress(host_ptr.get()));
+      host_ptr->setLbPolicyData(std::make_unique<ClientSideHostLbPolicyData>());
+    }
+  }
+}
+
+absl::optional<uint32_t>
+ClientSideWeightedRoundRobinLoadBalancer::getClientSideWeightIfValidFromHost(
+    const Host& host, MonotonicTime max_non_empty_since, MonotonicTime min_last_update_time) {
+  auto client_side_data = host.typedLbPolicyData<ClientSideHostLbPolicyData>();
+  if (!client_side_data.has_value()) {
+    ENVOY_LOG(trace, "Host does not have ClientSideHostLbPolicyData {}", getHostAddress(&host));
+    return std::nullopt;
+  }
+  return client_side_data->getWeightIfValid(max_non_empty_since, min_last_update_time);
+}
+
+double
+ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::getUtilizationFromOrcaReport(
+    const OrcaLoadReportProto& orca_load_report,
+    const std::vector<std::string>& metric_names_for_computing_utilization) {
+  // If application_utilization is valid, use it as the utilization metric.
+  double utilization = orca_load_report.application_utilization();
+  if (utilization > 0) {
+    return utilization;
+  }
+  // Otherwise, find the most constrained utilization metric.
+  utilization =
+      Envoy::Orca::getMaxUtilization(metric_names_for_computing_utilization, orca_load_report);
+  if (utilization > 0) {
+    return utilization;
+  }
+  // If utilization is <= 0, use cpu_utilization.
+  return orca_load_report.cpu_utilization();
+}
+
+absl::StatusOr<uint32_t>
+ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::calculateWeightFromOrcaReport(
+    const OrcaLoadReportProto& orca_load_report,
+    const std::vector<std::string>& metric_names_for_computing_utilization,
+    double error_utilization_penalty) {
+  double qps = orca_load_report.rps_fractional();
+  if (qps <= 0) {
+    return absl::InvalidArgumentError("QPS must be positive");
+  }
+
+  double utilization =
+      getUtilizationFromOrcaReport(orca_load_report, metric_names_for_computing_utilization);
+  // If there are errors, then increase utilization to lower the weight.
+  utilization += error_utilization_penalty * orca_load_report.eps() / qps;
+
+  if (utilization <= 0) {
+    return absl::InvalidArgumentError("Utilization must be positive");
+  }
+
+  // Calculate the weight.
+  double weight = qps / utilization;
+
+  // Limit the weight to uint32_t max.
+  if (weight > std::numeric_limits<uint32_t>::max()) {
+    weight = std::numeric_limits<uint32_t>::max();
+  }
+  return weight;
+}
+
+absl::Status ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::
+    updateClientSideDataFromOrcaLoadReport(const OrcaLoadReportProto& orca_load_report,
+                                           ClientSideHostLbPolicyData& client_side_data) {
+  const absl::StatusOr<uint32_t> weight = calculateWeightFromOrcaReport(
+      orca_load_report, metric_names_for_computing_utilization_, error_utilization_penalty_);
+  if (!weight.ok()) {
+    return weight.status();
+  }
+
+  // Update client side data attached to the host.
+  client_side_data.updateWeightNow(weight.value(), time_source_.monotonicTime());
+  return absl::OkStatus();
+}
+
+Upstream::LoadBalancerPtr ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLbFactory::create(
+    Upstream::LoadBalancerParams params) {
+  const auto* typed_lb_config =
+      dynamic_cast<const ClientSideWeightedRoundRobinLbConfig*>(lb_config_.ptr());
+  ASSERT(typed_lb_config != nullptr);
+  return std::make_unique<Upstream::ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb>(
+      params.priority_set, params.local_priority_set, cluster_info_.lbStats(), runtime_, random_,
+      cluster_info_.lbConfig(), *typed_lb_config, time_source_);
+}
+
+ClientSideWeightedRoundRobinLoadBalancer::ClientSideWeightedRoundRobinLoadBalancer(
+    OptRef<const Upstream::LoadBalancerConfig> lb_config, const Upstream::ClusterInfo& cluster_info,
+    const Upstream::PrioritySet& priority_set, Runtime::Loader& runtime,
+    Envoy::Random::RandomGenerator& random, TimeSource& time_source)
+    : factory_(std::make_shared<WorkerLocalLbFactory>(lb_config, cluster_info, priority_set,
+                                                      runtime, random, time_source)),
+      lb_config_(lb_config), cluster_info_(cluster_info), priority_set_(priority_set),
+      runtime_(runtime), random_(random), time_source_(time_source) {}
+
+absl::Status ClientSideWeightedRoundRobinLoadBalancer::initialize() {
+  // Ensure that all hosts have client side lb policy data.
+  for (const HostSetPtr& host_set : priority_set_.hostSetsPerPriority()) {
+    addClientSideLbPolicyDataToHosts(host_set->hosts());
+  }
+  // Setup a callback to receive priority set updates.
+  priority_update_cb_ = priority_set_.addPriorityUpdateCb(
+      [](uint32_t, const HostVector& hosts_added, const HostVector&) -> absl::Status {
+        addClientSideLbPolicyDataToHosts(hosts_added);
+        return absl::OkStatus();
+      });
+
+  const auto* typed_lb_config =
+      dynamic_cast<const ClientSideWeightedRoundRobinLbConfig*>(lb_config_.ptr());
+  ASSERT(typed_lb_config != nullptr);
+  initFromConfig(*typed_lb_config);
+  startWeightUpdatesOnMainThread(typed_lb_config->main_thread_dispatcher_);
+  return absl::OkStatus();
+}
+
+} // namespace Upstream
+} // namespace Envoy
diff --git a/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h
new file mode 100644
index 0000000000..ddfa06cdf1
--- /dev/null
+++ b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h
@@ -0,0 +1,236 @@
+#pragma once
+
+#include "envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.pb.h"
+#include "envoy/upstream/upstream.h"
+
+#include "source/extensions/load_balancing_policies/common/load_balancer_impl.h"
+#include "source/extensions/load_balancing_policies/round_robin/round_robin_lb.h"
+
+#include "absl/status/status.h"
+
+namespace Envoy {
+namespace Upstream {
+
+using ClientSideWeightedRoundRobinLbProto = envoy::extensions::load_balancing_policies::
+    client_side_weighted_round_robin::v3::ClientSideWeightedRoundRobin;
+using OrcaLoadReportProto = xds::data::orca::v3::OrcaLoadReport;
+
+/**
+ * Load balancer config used to wrap the config proto.
+ */
+class ClientSideWeightedRoundRobinLbConfig : public Upstream::LoadBalancerConfig {
+public:
+  ClientSideWeightedRoundRobinLbConfig(const ClientSideWeightedRoundRobinLbProto& lb_proto,
+                                       Event::Dispatcher& main_thread_dispatcher);
+
+  // Parameters for weight calculation from Orca Load report.
+  std::vector<std::string> metric_names_for_computing_utilization;
+  double error_utilization_penalty;
+  // Timing parameters for the weight update.
+  std::chrono::milliseconds blackout_period;
+  std::chrono::milliseconds weight_expiration_period;
+  std::chrono::milliseconds weight_update_period;
+
+  Event::Dispatcher& main_thread_dispatcher_;
+};
+
+/**
+ * A client side weighted round robin load balancer. When in weighted mode, EDF
+ * scheduling is used. When in not weighted mode, simple RR index selection is
+ * used.
+ */
+class ClientSideWeightedRoundRobinLoadBalancer : public Upstream::ThreadAwareLoadBalancer,
+                                                 protected Logger::Loggable<Logger::Id::upstream> {
+public:
+  // This struct is used to store the client side data for the host. Hosts are
+  // not shared between different clusters, but are shared between load
+  // balancer instances on different threads.
+  struct ClientSideHostLbPolicyData : public Envoy::Upstream::Host::HostLbPolicyData {
+    ClientSideHostLbPolicyData() = default;
+    ClientSideHostLbPolicyData(uint32_t weight, MonotonicTime non_empty_since,
+                               MonotonicTime last_update_time)
+        : weight_(weight), non_empty_since_(non_empty_since), last_update_time_(last_update_time) {}
+    virtual ~ClientSideHostLbPolicyData() = default;
+    // Update the weight and timestamps for first and last update time.
+    void updateWeightNow(uint32_t weight, const MonotonicTime& now) {
+      weight_.store(weight);
+      last_update_time_.store(now);
+      if (non_empty_since_.load() == kDefaultNonEmptySince) {
+        non_empty_since_.store(now);
+      }
+    }
+
+    // Get the weight if it was updated between max_non_empty_since and min_last_update_time,
+    // otherwise return nullopt.
+    absl::optional<uint32_t> getWeightIfValid(MonotonicTime max_non_empty_since,
+                                              MonotonicTime min_last_update_time) {
+      // If non_empty_since_ is too recent, we should use the default weight.
+      if (max_non_empty_since < non_empty_since_.load()) {
+        return std::nullopt;
+      }
+      // If last update time is too old, we should use the default weight.
+      if (last_update_time_.load() < min_last_update_time) {
+        // Reset the non_empty_since_ time so the timer will start again.
+        non_empty_since_.store(ClientSideHostLbPolicyData::kDefaultNonEmptySince);
+        return std::nullopt;
+      }
+      return weight_;
+    }
+
+    // Weight as calculated from the last load report.
+    std::atomic<uint32_t> weight_ = 1;
+    // Time when the weight is first updated. The weight is invalid if it is within of
+    // `blackout_period_`.
+    std::atomic<MonotonicTime> non_empty_since_ = kDefaultNonEmptySince;
+    // Time when the weight is last updated. The weight is invalid if it is outside of
+    // `expiration_period_`.
+    std::atomic<MonotonicTime> last_update_time_ = kDefaultLastUpdateTime;
+
+    static constexpr MonotonicTime kDefaultNonEmptySince = MonotonicTime::max();
+    static constexpr MonotonicTime kDefaultLastUpdateTime = MonotonicTime::min();
+  };
+
+  // This class is used to handle ORCA load reports.
+  // It stores the config necessary to calculate host weight based on the report.
+  // The load balancer context stores a weak pointer to this handler,
+  // so it is NOT invoked if the load balancer is deleted.
+  class OrcaLoadReportHandler : public LoadBalancerContext::OrcaLoadReportCallbacks {
+  public:
+    OrcaLoadReportHandler(const ClientSideWeightedRoundRobinLbConfig& lb_config,
+                          TimeSource& time_source);
+    ~OrcaLoadReportHandler() override = default;
+
+  private:
+    friend class ClientSideWeightedRoundRobinLoadBalancerFriend;
+
+    // {LoadBalancerContext::OrcaLoadReportCallbacks} implementation.
+    absl::Status onOrcaLoadReport(const OrcaLoadReportProto& orca_load_report,
+                                  const HostDescription& host_description) override;
+
+    // Get utilization from `orca_load_report` using named metrics specified in
+    // `metric_names_for_computing_utilization`.
+    static double getUtilizationFromOrcaReport(
+        const OrcaLoadReportProto& orca_load_report,
+        const std::vector<std::string>& metric_names_for_computing_utilization);
+
+    // Calculate client side weight from `orca_load_report` using `getUtilizationFromOrcaReport()`,
+    // QPS, EPS and `error_utilization_penalty`.
+    static absl::StatusOr<uint32_t> calculateWeightFromOrcaReport(
+        const OrcaLoadReportProto& orca_load_report,
+        const std::vector<std::string>& metric_names_for_computing_utilization,
+        double error_utilization_penalty);
+
+    // Update client side data from `orca_load_report`. Invoked from `onOrcaLoadReport` callback on
+    // the worker thread.
+    absl::Status
+    updateClientSideDataFromOrcaLoadReport(const OrcaLoadReportProto& orca_load_report,
+                                           ClientSideHostLbPolicyData& client_side_data);
+
+    const std::vector<std::string> metric_names_for_computing_utilization_;
+    const double error_utilization_penalty_;
+    TimeSource& time_source_;
+  };
+
+  // This class is used to handle the load balancing on the worker thread.
+  class WorkerLocalLb : public RoundRobinLoadBalancer {
+  public:
+    WorkerLocalLb(
+        const PrioritySet& priority_set, const PrioritySet* local_priority_set,
+        ClusterLbStats& stats, Runtime::Loader& runtime, Random::RandomGenerator& random,
+        const envoy::config::cluster::v3::Cluster::CommonLbConfig& common_config,
+        const ClientSideWeightedRoundRobinLbConfig& client_side_weighted_round_robin_config,
+        TimeSource& time_source);
+
+  private:
+    friend class ClientSideWeightedRoundRobinLoadBalancerFriend;
+
+    HostConstSharedPtr chooseHost(LoadBalancerContext* context) override;
+    bool alwaysUseEdfScheduler() const override { return true; };
+
+    std::shared_ptr<OrcaLoadReportHandler> orca_load_report_handler_;
+  };
+
+  // Factory used to create worker-local load balancer on the worker thread.
+  class WorkerLocalLbFactory : public Upstream::LoadBalancerFactory {
+  public:
+    WorkerLocalLbFactory(OptRef<const Upstream::LoadBalancerConfig> lb_config,
+                         const Upstream::ClusterInfo& cluster_info,
+                         const Upstream::PrioritySet& priority_set, Runtime::Loader& runtime,
+                         Envoy::Random::RandomGenerator& random, TimeSource& time_source)
+        : lb_config_(lb_config), cluster_info_(cluster_info), priority_set_(priority_set),
+          runtime_(runtime), random_(random), time_source_(time_source) {}
+
+    Upstream::LoadBalancerPtr create(Upstream::LoadBalancerParams params) override;
+
+    bool recreateOnHostChange() const override { return false; }
+
+  protected:
+    OptRef<const Upstream::LoadBalancerConfig> lb_config_;
+
+    const Upstream::ClusterInfo& cluster_info_;
+    const Upstream::PrioritySet& priority_set_;
+    Runtime::Loader& runtime_;
+    Envoy::Random::RandomGenerator& random_;
+    TimeSource& time_source_;
+  };
+
+public:
+  ClientSideWeightedRoundRobinLoadBalancer(OptRef<const Upstream::LoadBalancerConfig> lb_config,
+                                           const Upstream::ClusterInfo& cluster_info,
+                                           const Upstream::PrioritySet& priority_set,
+                                           Runtime::Loader& runtime,
+                                           Envoy::Random::RandomGenerator& random,
+                                           TimeSource& time_source);
+
+private:
+  friend class ClientSideWeightedRoundRobinLoadBalancerFriend;
+
+  // {Upstream::ThreadAwareLoadBalancer} Interface implementation.
+  Upstream::LoadBalancerFactorySharedPtr factory() override { return factory_; }
+  absl::Status initialize() override;
+
+  // Initialize LB based on the config.
+  void initFromConfig(const ClientSideWeightedRoundRobinLbConfig& lb_config);
+
+  // Start weight updates on the main thread.
+  void startWeightUpdatesOnMainThread(Event::Dispatcher& main_thread_dispatcher);
+
+  // Update weights using client side host LB policy data for all priority sets.
+  // Executed on the main thread.
+  void updateWeightsOnMainThread();
+
+  // Update weights using client side host LB policy data for all `hosts`.
+  void updateWeightsOnHosts(const HostVector& hosts);
+
+  // Add client side host LB policy data to all `hosts`.
+  static void addClientSideLbPolicyDataToHosts(const HostVector& hosts);
+
+  // Get weight based on client side host LB policy data if it is valid (not
+  // empty at least since `max_non_empty_since` and updated no later than
+  // `min_last_update_time`), otherwise return std::nullopt.
+  static absl::optional<uint32_t>
+  getClientSideWeightIfValidFromHost(const Host& host, MonotonicTime max_non_empty_since,
+                                     MonotonicTime min_last_update_time);
+
+  // Factory used to create worker-local load balancers on the worker thread.
+  std::shared_ptr<WorkerLocalLbFactory> factory_;
+  // Data that is also passed to the worker-local load balancer via factory_.
+  OptRef<const Upstream::LoadBalancerConfig> lb_config_;
+  const Upstream::ClusterInfo& cluster_info_;
+  const Upstream::PrioritySet& priority_set_;
+  Runtime::Loader& runtime_;
+  Envoy::Random::RandomGenerator& random_;
+  TimeSource& time_source_;
+
+  // Timing parameters for the weight update.
+  std::chrono::milliseconds blackout_period_;
+  std::chrono::milliseconds weight_expiration_period_;
+  std::chrono::milliseconds weight_update_period_;
+
+  Event::TimerPtr weight_calculation_timer_;
+  // Callback for `priority_set_` updates.
+  Common::CallbackHandlePtr priority_update_cb_;
+};
+
+} // namespace Upstream
+} // namespace Envoy
diff --git a/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.cc b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.cc
new file mode 100644
index 0000000000..0f0c95ee82
--- /dev/null
+++ b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.cc
@@ -0,0 +1,18 @@
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.h"
+
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace LoadBalancingPolices {
+namespace ClientSideWeightedRoundRobin {
+
+/**
+ * Static registration for the Factory. @see RegisterFactory.
+ */
+REGISTER_FACTORY(Factory, Upstream::TypedLoadBalancerFactory);
+
+} // namespace ClientSideWeightedRoundRobin
+} // namespace LoadBalancingPolices
+} // namespace Extensions
+} // namespace Envoy
diff --git a/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.h b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.h
new file mode 100644
index 0000000000..220c6688a3
--- /dev/null
+++ b/source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.h
@@ -0,0 +1,50 @@
+#pragma once
+
+#include "envoy/event/dispatcher.h"
+#include "envoy/extensions/load_balancing_policies/client_side_weighted_round_robin/v3/client_side_weighted_round_robin.pb.h"
+#include "envoy/upstream/load_balancer.h"
+
+#include "source/common/common/logger.h"
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h"
+#include "source/extensions/load_balancing_policies/common/factory_base.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace LoadBalancingPolices {
+namespace ClientSideWeightedRoundRobin {
+
+using ClientSideWeightedRoundRobinLbProto = envoy::extensions::load_balancing_policies::
+    client_side_weighted_round_robin::v3::ClientSideWeightedRoundRobin;
+// using ClusterProto = envoy::config::cluster::v3::Cluster;
+
+class Factory : public Upstream::TypedLoadBalancerFactoryBase<ClientSideWeightedRoundRobinLbProto> {
+public:
+  Factory()
+      : Upstream::TypedLoadBalancerFactoryBase<ClientSideWeightedRoundRobinLbProto>(
+            "envoy.load_balancing_policies.client_side_weighted_round_robin") {}
+
+  Upstream::ThreadAwareLoadBalancerPtr create(OptRef<const Upstream::LoadBalancerConfig> lb_config,
+                                              const Upstream::ClusterInfo& cluster_info,
+                                              const Upstream::PrioritySet& priority_set,
+                                              Runtime::Loader& runtime,
+                                              Envoy::Random::RandomGenerator& random,
+                                              TimeSource& time_source) override {
+    return std::make_unique<Upstream::ClientSideWeightedRoundRobinLoadBalancer>(
+        lb_config, cluster_info, priority_set, runtime, random, time_source);
+  }
+
+  Upstream::LoadBalancerConfigPtr loadConfig(Upstream::LoadBalancerFactoryContext& context,
+                                             const Protobuf::Message& config,
+                                             ProtobufMessage::ValidationVisitor&) override {
+    const auto& lb_config = dynamic_cast<const ClientSideWeightedRoundRobinLbProto&>(config);
+    return Upstream::LoadBalancerConfigPtr{new Upstream::ClientSideWeightedRoundRobinLbConfig(
+        lb_config, context.mainThreadDispatcher())};
+  }
+};
+
+DECLARE_FACTORY(Factory);
+
+} // namespace ClientSideWeightedRoundRobin
+} // namespace LoadBalancingPolices
+} // namespace Extensions
+} // namespace Envoy
diff --git a/source/extensions/load_balancing_policies/common/load_balancer_impl.cc b/source/extensions/load_balancing_policies/common/load_balancer_impl.cc
index 96ef80bcd4..4232e8ef1e 100644
--- a/source/extensions/load_balancing_policies/common/load_balancer_impl.cc
+++ b/source/extensions/load_balancing_policies/common/load_balancer_impl.cc
@@ -917,7 +917,7 @@ void EdfLoadBalancerBase::refresh(uint32_t priority) {
     // case EDF creation is skipped. When all original weights are equal and no hosts are in slow
     // start mode we can rely on unweighted host pick to do optimal round robin and least-loaded
     // host selection with lower memory and CPU overhead.
-    if (hostWeightsAreEqual(hosts) && noHostsAreInSlowStart()) {
+    if (!alwaysUseEdfScheduler() && hostWeightsAreEqual(hosts) && noHostsAreInSlowStart()) {
       // Skip edf creation.
       return;
     }
@@ -991,6 +991,8 @@ void EdfLoadBalancerBase::refresh(uint32_t priority) {
   }
 }
 
+bool EdfLoadBalancerBase::alwaysUseEdfScheduler() const { return false; }
+
 bool EdfLoadBalancerBase::isSlowStartEnabled() const {
   return slow_start_window_ > std::chrono::milliseconds(0);
 }
diff --git a/source/extensions/load_balancing_policies/common/load_balancer_impl.h b/source/extensions/load_balancing_policies/common/load_balancer_impl.h
index d01e3f5512..7dce8d2b94 100644
--- a/source/extensions/load_balancing_policies/common/load_balancer_impl.h
+++ b/source/extensions/load_balancing_policies/common/load_balancer_impl.h
@@ -492,6 +492,10 @@ class EdfLoadBalancerBase : public ZoneAwareLoadBalancerBase {
 
   virtual void refresh(uint32_t priority);
 
+  // Return `true` if refresh() should always use EDF scheduler, even if host
+  // weights are all equal. Default to `false`.
+  virtual bool alwaysUseEdfScheduler() const;
+
   bool isSlowStartEnabled() const;
   bool noHostsAreInSlowStart() const;
 
diff --git a/source/extensions/load_balancing_policies/subset/subset_lb.h b/source/extensions/load_balancing_policies/subset/subset_lb.h
index d03296a9b3..18e8683fd6 100644
--- a/source/extensions/load_balancing_policies/subset/subset_lb.h
+++ b/source/extensions/load_balancing_policies/subset/subset_lb.h
@@ -200,7 +200,7 @@ class SubsetLoadBalancer : public LoadBalancer, Logger::Loggable<Logger::Id::ups
       return wrapped_->overrideHostToSelect();
     }
 
-    void setOrcaLoadReportCallbacks(OrcaLoadReportCallbacks& callbacks) override {
+    void setOrcaLoadReportCallbacks(std::weak_ptr<OrcaLoadReportCallbacks> callbacks) override {
       wrapped_->setOrcaLoadReportCallbacks(callbacks);
     }
 
diff --git a/source/extensions/tracers/opentelemetry/tracer.cc b/source/extensions/tracers/opentelemetry/tracer.cc
index 5c755bf873..446a66c3b9 100644
--- a/source/extensions/tracers/opentelemetry/tracer.cc
+++ b/source/extensions/tracers/opentelemetry/tracer.cc
@@ -122,8 +122,43 @@ void Span::setAttribute(absl::string_view name, const OTelAttribute& attribute_v
   *span_.add_attributes() = key_value;
 }
 
+::opentelemetry::proto::trace::v1::Status_StatusCode
+convertGrpcStatusToTraceStatusCode(::opentelemetry::proto::trace::v1::Span_SpanKind kind,
+                                   absl::string_view value) {
+  uint64_t grpc_status_code;
+  if (!absl::SimpleAtoi(value, &grpc_status_code)) {
+    // If the value is not a number, we can't map it to a status code.
+    // In this case, we should leave the status code unset.
+    return ::opentelemetry::proto::trace::v1::Status::STATUS_CODE_UNSET;
+  }
+
+  Grpc::Status::GrpcStatus grpc_status = static_cast<Grpc::Status::GrpcStatus>(grpc_status_code);
+  // Check mapping https://opentelemetry.io/docs/specs/semconv/rpc/grpc/#grpc-status
+  if (kind == ::opentelemetry::proto::trace::v1::Span::SPAN_KIND_CLIENT) {
+    if (grpc_status == Grpc::Status::WellKnownGrpcStatus::Ok) {
+      return ::opentelemetry::proto::trace::v1::Status::STATUS_CODE_UNSET;
+    }
+    return ::opentelemetry::proto::trace::v1::Status::STATUS_CODE_ERROR;
+  }
+
+  // SPAN_KIND_SERVER
+  switch (grpc_status) {
+  case Grpc::Status::WellKnownGrpcStatus::Unknown:
+  case Grpc::Status::WellKnownGrpcStatus::DeadlineExceeded:
+  case Grpc::Status::WellKnownGrpcStatus::Unimplemented:
+  case Grpc::Status::WellKnownGrpcStatus::Internal:
+  case Grpc::Status::WellKnownGrpcStatus::Unavailable:
+  case Grpc::Status::WellKnownGrpcStatus::DataLoss:
+    return ::opentelemetry::proto::trace::v1::Status::STATUS_CODE_ERROR;
+  default:
+    return ::opentelemetry::proto::trace::v1::Status::STATUS_CODE_UNSET;
+  }
+}
+
 void Span::setTag(absl::string_view name, absl::string_view value) {
-  if (name == Tracing::Tags::get().HttpStatusCode) {
+  if (name == Tracing::Tags::get().GrpcStatusCode) {
+    span_.mutable_status()->set_code(convertGrpcStatusToTraceStatusCode(span_.kind(), value));
+  } else if (name == Tracing::Tags::get().HttpStatusCode) {
     uint64_t status_code;
     // For HTTP status codes in the 5xx range, as well as any other code the client failed to
     // interpret, span status MUST be set to Error.
@@ -163,6 +198,10 @@ void Tracer::enableTimer() {
 }
 
 void Tracer::flushSpans() {
+  if (span_buffer_.empty()) {
+    return;
+  }
+
   ExportTraceServiceRequest request;
   // A request consists of ResourceSpans.
   ::opentelemetry::proto::trace::v1::ResourceSpans* resource_span = request.add_resource_spans();
diff --git a/source/server/BUILD b/source/server/BUILD
index 300b859024..6eb5005f62 100644
--- a/source/server/BUILD
+++ b/source/server/BUILD
@@ -406,6 +406,7 @@ envoy_cc_library(
     name = "server_base_lib",
     srcs = ["server.cc"],
     hdrs = ["server.h"],
+    rbe_pool = "2core",
     deps = [
         ":api_listener_lib",
         ":configuration_lib",
diff --git a/source/server/config_validation/BUILD b/source/server/config_validation/BUILD
index 2bc89abf8e..55da76e939 100644
--- a/source/server/config_validation/BUILD
+++ b/source/server/config_validation/BUILD
@@ -63,6 +63,7 @@ envoy_cc_library(
     name = "server_lib",
     srcs = ["server.cc"],
     hdrs = ["server.h"],
+    rbe_pool = "2core",
     deps = [
         ":admin_lib",
         ":api_lib",
diff --git a/test/common/access_log/BUILD b/test/common/access_log/BUILD
index e3461792bc..b048f85abe 100644
--- a/test/common/access_log/BUILD
+++ b/test/common/access_log/BUILD
@@ -17,6 +17,7 @@ envoy_cc_test(
             "-DUSE_CEL_PARSER",
         ],
     }),
+    rbe_pool = "2core",
     deps = [
         "//source/common/access_log:access_log_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -46,6 +47,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "access_log_manager_impl_test",
     srcs = ["access_log_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/access_log:access_log_manager_lib",
         "//source/common/stats:stats_lib",
diff --git a/test/common/api/BUILD b/test/common/api/BUILD
index d8d514ba3a..227b5c149f 100644
--- a/test/common/api/BUILD
+++ b/test/common/api/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "os_sys_calls_test",
     srcs = ["os_sys_calls_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:os_sys_calls_lib",
     ],
diff --git a/test/common/buffer/BUILD b/test/common/buffer/BUILD
index 027e7aaf6d..0251d751ab 100644
--- a/test/common/buffer/BUILD
+++ b/test/common/buffer/BUILD
@@ -31,6 +31,7 @@ envoy_cc_test_library(
     name = "buffer_fuzz_lib",
     srcs = ["buffer_fuzz.cc"],
     hdrs = ["buffer_fuzz.h"],
+    rbe_pool = "2core",
     deps = [
         ":buffer_fuzz_proto_cc_proto",
         "//source/common/buffer:buffer_lib",
@@ -44,12 +45,14 @@ envoy_cc_fuzz_test(
     name = "buffer_fuzz_test",
     srcs = ["buffer_fuzz_test.cc"],
     corpus = "buffer_corpus",
+    rbe_pool = "2core",
     deps = [":buffer_fuzz_lib"],
 )
 
 envoy_cc_test(
     name = "buffer_test",
     srcs = ["buffer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -61,6 +64,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "owned_impl_test",
     srcs = ["owned_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -74,6 +78,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "buffer_util_test",
     srcs = ["buffer_util_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -84,6 +89,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "watermark_buffer_test",
     srcs = ["watermark_buffer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -96,6 +102,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "buffer_memory_account_test",
     srcs = ["buffer_memory_account_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//test/integration:tracked_watermark_buffer_lib",
@@ -108,6 +115,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "zero_copy_input_stream_test",
     srcs = ["zero_copy_input_stream_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:zero_copy_input_stream_lib",
@@ -117,6 +125,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "buffer_speed_test",
     srcs = ["buffer_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/buffer:watermark_buffer_lib",
diff --git a/test/common/common/BUILD b/test/common/common/BUILD
index 96ad095dab..d15e11f00f 100644
--- a/test/common/common/BUILD
+++ b/test/common/common/BUILD
@@ -15,6 +15,7 @@ envoy_package()
 envoy_cc_test(
     name = "backoff_strategy_test",
     srcs = ["backoff_strategy_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:backoff_lib",
         "//test/mocks/runtime:runtime_mocks",
@@ -24,6 +25,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "assert_test",
     srcs = ["assert_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//test/test_common:logging_lib",
@@ -34,6 +36,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "containers_test",
     srcs = ["containers_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:containers_lib",
         "//test/test_common:logging_lib",
@@ -46,6 +49,7 @@ envoy_cc_test(
     name = "assert_enabled_in_release_test",
     srcs = ["assert_test.cc"],
     copts = ["-DENVOY_LOG_DEBUG_ASSERT_IN_RELEASE"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//test/test_common:logging_lib",
@@ -56,6 +60,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "assert2_test",
     srcs = ["assert2_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//test/test_common:logging_lib",
@@ -66,6 +71,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "base64_test",
     srcs = ["base64_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:base64_lib",
@@ -76,6 +82,7 @@ envoy_cc_fuzz_test(
     name = "base64_fuzz_test",
     srcs = ["base64_fuzz_test.cc"],
     corpus = "base64_corpus",
+    rbe_pool = "2core",
     # Fuzzer is stable, no bugs, simple test target; avoid emitting CO2.
     tags = ["no_fuzz"],
     deps = ["//source/common/common:base64_lib"],
@@ -85,6 +92,7 @@ envoy_cc_fuzz_test(
     name = "utility_fuzz_test",
     srcs = ["utility_fuzz_test.cc"],
     corpus = "utility_corpus",
+    rbe_pool = "2core",
     # Fuzzer is stable, no bugs, simple test target; avoid emitting CO2.
     tags = ["no_fuzz"],
     deps = ["//source/common/common:utility_lib"],
@@ -94,18 +102,21 @@ envoy_cc_fuzz_test(
     name = "hash_fuzz_test",
     srcs = ["hash_fuzz_test.cc"],
     corpus = "hash_corpus",
+    rbe_pool = "2core",
     deps = ["//source/common/common:hash_lib"],
 )
 
 envoy_cc_test(
     name = "cleanup_test",
     srcs = ["cleanup_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:cleanup_lib"],
 )
 
 envoy_cc_test(
     name = "dns_utils_test",
     srcs = ["dns_utils_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:dns_utils_lib",
         "//test/test_common:utility_lib",
@@ -115,24 +126,28 @@ envoy_cc_test(
 envoy_cc_test(
     name = "mem_block_builder_test",
     srcs = ["mem_block_builder_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:mem_block_builder_lib"],
 )
 
 envoy_cc_test(
     name = "safe_memcpy_test",
     srcs = ["safe_memcpy_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:safe_memcpy_lib"],
 )
 
 envoy_cc_test(
     name = "phantom_test",
     srcs = ["phantom_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:phantom"],
 )
 
 envoy_cc_test(
     name = "fmt_test",
     srcs = ["fmt_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:fmt_lib",
         "//source/common/common:minimal_logger_lib",
@@ -142,18 +157,21 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hash_test",
     srcs = ["hash_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:hash_lib"],
 )
 
 envoy_cc_test(
     name = "hex_test",
     srcs = ["hex_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:hex_lib"],
 )
 
 envoy_cc_test(
     name = "linked_object_test",
     srcs = ["linked_object_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:linked_object",
     ],
@@ -162,6 +180,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "log_macros_test",
     srcs = ["log_macros_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "//test/mocks/http:http_mocks",
@@ -175,6 +194,7 @@ envoy_cc_test(
     name = "log_verbosity_update_test",
     srcs = ["log_verbosity_update_test.cc"],
     args = ["--enable-fine-grain-logging"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "//test/test_common:logging_lib",
@@ -185,6 +205,7 @@ envoy_cc_test(
     name = "fine_grain_log_macros_test",
     srcs = ["log_macros_test.cc"],
     args = ["--enable-fine-grain-logging"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "//test/mocks/http:http_mocks",
@@ -197,6 +218,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "logger_speed_test",
     srcs = ["logger_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "@com_github_google_benchmark//:benchmark",
@@ -211,6 +233,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "logger_test",
     srcs = ["logger_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "//test/mocks/http:http_mocks",
@@ -222,6 +245,7 @@ envoy_cc_fuzz_test(
     name = "logger_fuzz_test",
     srcs = ["logger_fuzz_test.cc"],
     corpus = "logger_corpus",
+    rbe_pool = "2core",
     # TODO(github.com/envoyproxy/envoy#8893): Re-enable once more fuzz tests are added
     tags = ["no_fuzz"],
     deps = ["//source/common/common:minimal_logger_lib"],
@@ -230,6 +254,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "matchers_test",
     srcs = ["matchers_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:matchers_lib",
         "//source/common/config:metadata_lib",
@@ -245,6 +270,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "mutex_tracer_test",
     srcs = ["mutex_tracer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:mutex_tracer_lib",
         "//test/test_common:contention_lib",
@@ -255,11 +281,13 @@ envoy_cc_test(
 envoy_cc_test(
     name = "optref_test",
     srcs = ["optref_test.cc"],
+    rbe_pool = "2core",
 )
 
 envoy_cc_test(
     name = "random_generator_test",
     srcs = ["random_generator_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:interval_value",
         "//source/common/common:random_generator_lib",
@@ -271,12 +299,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "trie_lookup_table_test",
     srcs = ["trie_lookup_table_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:trie_lookup_table_lib"],
 )
 
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//test/common/memory:memory_test_utility_lib",
@@ -290,11 +320,13 @@ envoy_cc_test(
 envoy_cc_test(
     name = "compiled_string_map_test",
     srcs = ["compiled_string_map_test.cc"],
+    rbe_pool = "2core",
 )
 
 envoy_cc_test(
     name = "packed_struct_test",
     srcs = ["packed_struct_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:packed_struct_lib",
         "//test/common/memory:memory_test_utility_lib",
@@ -306,6 +338,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "regex_test",
     srcs = ["regex_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:regex_lib",
         "//test/test_common:logging_lib",
@@ -318,6 +351,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "perf_annotation_test",
     srcs = ["perf_annotation_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:perf_annotation_lib",
     ],
@@ -326,6 +360,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "perf_annotation_disabled_test",
     srcs = ["perf_annotation_disabled_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:perf_annotation_lib",
     ],
@@ -334,6 +369,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "basic_resource_impl_test",
     srcs = ["basic_resource_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:basic_resource_lib",
         "//test/mocks/runtime:runtime_mocks",
@@ -343,6 +379,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "token_bucket_impl_test",
     srcs = ["token_bucket_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:token_bucket_impl_lib",
         "//test/test_common:simulated_time_system_lib",
@@ -354,6 +391,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "shared_token_bucket_impl_test",
     srcs = ["shared_token_bucket_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:shared_token_bucket_impl_lib",
         "//test/test_common:simulated_time_system_lib",
@@ -364,6 +402,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "callback_impl_test",
     srcs = ["callback_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:callback_impl_lib",
         "//test/mocks/event:event_mocks",
@@ -384,6 +423,7 @@ envoy_cc_benchmark_binary(
 envoy_cc_benchmark_binary(
     name = "utility_speed_test",
     srcs = ["utility_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/common:utility_lib",
@@ -400,6 +440,7 @@ envoy_benchmark_test(
 envoy_cc_benchmark_binary(
     name = "trie_lookup_table_speed_test",
     srcs = ["trie_lookup_table_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:trie_lookup_table_lib",
         "@com_github_google_benchmark//:benchmark",
@@ -415,6 +456,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "lock_guard_test",
     srcs = ["lock_guard_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:lock_guard_lib",
         "//source/common/common:thread_lib",
@@ -424,6 +466,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "thread_id_test",
     srcs = ["thread_id_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:thread_lib",
         "//test/test_common:thread_factory_for_test_lib",
@@ -434,6 +477,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "thread_test",
     srcs = ["thread_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:thread_lib",
         "//source/common/common:thread_synchronizer_lib",
@@ -444,6 +488,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stl_helpers_test",
     srcs = ["stl_helpers_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:stl_helpers",
     ],
@@ -453,6 +498,7 @@ envoy_cc_test(
     name = "version_test",
     srcs = ["version_test.cc"],
     copts = envoy_select_boringssl(["-DENVOY_SSL_FIPS"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/version:version_lib",
         "@com_google_absl//absl/strings",
@@ -462,12 +508,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "api_version_test",
     srcs = ["api_version_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/version:api_version_lib"],
 )
 
 envoy_cc_test(
     name = "statusor_test",
     srcs = ["statusor_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:statusor_lib",
         "//source/common/http:status_lib",
@@ -477,12 +525,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "interval_value_test",
     srcs = ["interval_value_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:interval_value"],
 )
 
 envoy_cc_test(
     name = "scope_tracker_test",
     srcs = ["scope_tracker_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/common:scope_tracker",
@@ -495,6 +545,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "scope_tracked_object_stack_test",
     srcs = ["scope_tracked_object_stack_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:scope_tracked_object_stack",
         "//source/common/common:utility_lib",
@@ -504,6 +555,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "union_string_test",
     srcs = ["union_string_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:union_string",
     ],
@@ -512,6 +564,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "bit_array_test",
     srcs = ["bit_array_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:bit_array_lib",
         "//source/common/common:random_generator_lib",
@@ -521,12 +574,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "inline_map_test",
     srcs = ["inline_map_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/common:inline_map"],
 )
 
 envoy_cc_benchmark_binary(
     name = "inline_map_speed_test",
     srcs = ["inline_map_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:inline_map",
         "@com_github_google_benchmark//:benchmark",
@@ -541,7 +596,14 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "execution_context_test",
     srcs = ["execution_context_test.cc"],
+    copts = [
+        "-DENVOY_ENABLE_EXECUTION_CONTEXT",
+    ],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:execution_context",
+        "//source/common/api:api_lib",
+        "//test/mocks:common_lib",
+        "//test/mocks/stream_info:stream_info_mocks",
     ],
 )
diff --git a/test/common/common/execution_context_test.cc b/test/common/common/execution_context_test.cc
index 25d886314e..8aed2f00ea 100644
--- a/test/common/common/execution_context_test.cc
+++ b/test/common/common/execution_context_test.cc
@@ -1,5 +1,15 @@
+#include <memory>
+
 #include "envoy/common/execution_context.h"
 
+#include "source/common/api/api_impl.h"
+#include "source/common/common/scope_tracker.h"
+
+#include "test/mocks/common.h"
+#include "test/mocks/stream_info/mocks.h"
+#include "test/test_common/utility.h"
+
+#include "gmock/gmock.h"
 #include "gtest/gtest.h"
 
 namespace Envoy {
@@ -27,45 +37,104 @@ class TestExecutionContext : public ExecutionContext {
   int activation_generations_ = 0;
 };
 
-TEST(ExecutionContextTest, NullContext) {
-  ScopedExecutionContext scoped_context(nullptr);
-  EXPECT_TRUE(scoped_context.isNull());
+class ExecutionContextTest : public testing::Test {
+public:
+  ExecutionContextTest() {
+    ON_CALL(tracked_object_, trackedStream())
+        .WillByDefault(testing::Return(OptRef<const StreamInfo::StreamInfo>(stream_info_)));
+  }
 
-  ScopedExecutionContext scoped_context2;
-  EXPECT_TRUE(scoped_context2.isNull());
+  void setWithoutContext() {
+    context_ = nullptr;
+    stream_info_.filter_state_ = std::make_shared<StreamInfo::FilterStateImpl>(
+        StreamInfo::FilterState::LifeSpan::Connection);
+  }
+  void setWithContext() {
+    context_ = std::make_shared<TestExecutionContext>();
+    stream_info_.filter_state_ = std::make_shared<StreamInfo::FilterStateImpl>(
+        StreamInfo::FilterState::LifeSpan::Connection);
+    stream_info_.filter_state_->setData(kConnectionExecutionContextFilterStateName, context_,
+                                        StreamInfo::FilterState::StateType::ReadOnly,
+                                        StreamInfo::FilterState::LifeSpan::Connection);
+  }
+
+  testing::NiceMock<StreamInfo::MockStreamInfo> stream_info_;
+  testing::NiceMock<MockScopeTrackedObject> tracked_object_;
+  std::shared_ptr<TestExecutionContext> context_{};
+};
+
+TEST_F(ExecutionContextTest, NullContext) {
+  {
+    ScopedExecutionContext scoped_context(nullptr);
+    EXPECT_TRUE(scoped_context.isNull());
+  }
+  {
+    ScopedExecutionContext scoped_context;
+    EXPECT_TRUE(scoped_context.isNull());
+  }
+  {
+    setWithoutContext();
+    ScopedExecutionContext scoped_context(&tracked_object_);
+    EXPECT_TRUE(scoped_context.isNull());
+  }
 }
 
-TEST(ExecutionContextTest, NestedScopes) {
-  TestExecutionContext context;
-  EXPECT_EQ(context.activationDepth(), 0);
-  EXPECT_EQ(context.activationGenerations(), 0);
+TEST_F(ExecutionContextTest, NestedScopes) {
+  setWithContext();
+
+  EXPECT_EQ(context_->activationDepth(), 0);
+  EXPECT_EQ(context_->activationGenerations(), 0);
 
   {
-    ScopedExecutionContext scoped_context(&context);
-    EXPECT_EQ(context.activationDepth(), 1);
-    EXPECT_EQ(context.activationGenerations(), 1);
+    ScopedExecutionContext scoped_context(&tracked_object_);
+    EXPECT_EQ(context_->activationDepth(), 1);
+    EXPECT_EQ(context_->activationGenerations(), 1);
     {
-      ScopedExecutionContext nested_scoped_context(&context);
-      EXPECT_EQ(context.activationDepth(), 2);
-      EXPECT_EQ(context.activationGenerations(), 1);
+      ScopedExecutionContext nested_scoped_context(&tracked_object_);
+      EXPECT_EQ(context_->activationDepth(), 2);
+      EXPECT_EQ(context_->activationGenerations(), 1);
     }
-    EXPECT_EQ(context.activationDepth(), 1);
-    EXPECT_EQ(context.activationGenerations(), 1);
+    EXPECT_EQ(context_->activationDepth(), 1);
+    EXPECT_EQ(context_->activationGenerations(), 1);
   }
-  EXPECT_EQ(context.activationDepth(), 0);
-  EXPECT_EQ(context.activationGenerations(), 1);
+  EXPECT_EQ(context_->activationDepth(), 0);
+  EXPECT_EQ(context_->activationGenerations(), 1);
 }
 
-TEST(ExecutionContextTest, DisjointScopes) {
-  TestExecutionContext context;
+TEST_F(ExecutionContextTest, DisjointScopes) {
+  setWithContext();
 
   for (int i = 1; i < 5; i++) {
-    ScopedExecutionContext scoped_context(&context);
-    EXPECT_EQ(context.activationDepth(), 1);
-    EXPECT_EQ(context.activationGenerations(), i);
+    ScopedExecutionContext scoped_context(&tracked_object_);
+    EXPECT_EQ(context_->activationDepth(), 1);
+    EXPECT_EQ(context_->activationGenerations(), i);
+  }
+
+  EXPECT_EQ(context_->activationDepth(), 0);
+}
+
+TEST_F(ExecutionContextTest, InScopeTrackerScopeState) {
+
+  Api::ApiPtr api(Api::createApiForTest());
+  Event::DispatcherPtr dispatcher(api->allocateDispatcher("test_thread"));
+  EXPECT_CALL(tracked_object_, trackedStream())
+      .Times(2)
+      .WillRepeatedly(testing::Return(OptRef<const StreamInfo::StreamInfo>(stream_info_)));
+
+  setWithContext();
+  EXPECT_EQ(context_->activationDepth(), 0);
+  EXPECT_EQ(context_->activationGenerations(), 0);
+  {
+    ScopeTrackerScopeState scope(&tracked_object_, *dispatcher);
+    EXPECT_EQ(context_->activationDepth(), 1);
+    EXPECT_EQ(context_->activationGenerations(), 1);
   }
 
-  EXPECT_EQ(context.activationDepth(), 0);
+  EXPECT_EQ(context_->activationDepth(), 0);
+  EXPECT_EQ(context_->activationGenerations(), 1);
+
+  setWithoutContext();
+  { ScopeTrackerScopeState scope(&tracked_object_, *dispatcher); }
 }
 
 } // namespace Envoy
diff --git a/test/common/common/scope_tracker_test.cc b/test/common/common/scope_tracker_test.cc
index 7d928b1801..76722b08de 100644
--- a/test/common/common/scope_tracker_test.cc
+++ b/test/common/common/scope_tracker_test.cc
@@ -14,15 +14,7 @@ namespace Envoy {
 
 using testing::_;
 
-class ScopeTrackerScopeStateTest : public testing::Test {
-protected:
-  void setExecutionContextEnabled(bool enabled) {
-    ScopeTrackerScopeState::executionContextEnabled() = enabled;
-  }
-};
-
-TEST_F(ScopeTrackerScopeStateTest, ShouldManageTrackedObjectOnDispatcherStack) {
-  setExecutionContextEnabled(false);
+TEST(ScopeTrackerScopeStateTest, ShouldManageTrackedObjectOnDispatcherStack) {
   Api::ApiPtr api(Api::createApiForTest());
   Event::DispatcherPtr dispatcher(api->allocateDispatcher("test_thread"));
   MockScopeTrackedObject tracked_object;
@@ -40,13 +32,4 @@ TEST_F(ScopeTrackerScopeStateTest, ShouldManageTrackedObjectOnDispatcherStack) {
   static_cast<Event::DispatcherImpl*>(dispatcher.get())->onFatalError(std::cerr);
 }
 
-TEST_F(ScopeTrackerScopeStateTest, ExecutionContextEnabled) {
-  setExecutionContextEnabled(true);
-  Api::ApiPtr api(Api::createApiForTest());
-  Event::DispatcherPtr dispatcher(api->allocateDispatcher("test_thread"));
-  MockScopeTrackedObject tracked_object;
-  EXPECT_CALL(tracked_object, executionContext());
-  ScopeTrackerScopeState scope(&tracked_object, *dispatcher);
-}
-
 } // namespace Envoy
diff --git a/test/common/common/stl_helpers_test.cc b/test/common/common/stl_helpers_test.cc
index af98384ab3..034d3b0c9e 100644
--- a/test/common/common/stl_helpers_test.cc
+++ b/test/common/common/stl_helpers_test.cc
@@ -6,20 +6,6 @@
 
 namespace Envoy {
 
-TEST(StlHelpersTest, TestPairOutputToStreamOperator) {
-  std::stringstream os;
-  std::pair<int, std::string> v{10, "five"};
-  os << v;
-  EXPECT_EQ("pair(10, five)", os.str());
-}
-
-TEST(StlHelpersTest, TestVectorOutputToStreamOperator) {
-  std::stringstream os;
-  std::vector<int> v{1, 2, 3, 4, 5};
-  os << v;
-  EXPECT_EQ("vector { 1, 2, 3, 4, 5 }", os.str());
-}
-
 TEST(StlHelpersTest, AccumulateToString) {
   std::vector<int> numbers{1, 2, 3, 4};
 
diff --git a/test/common/config/BUILD b/test/common/config/BUILD
index 409bfc62f0..bc68571f94 100644
--- a/test/common/config/BUILD
+++ b/test/common/config/BUILD
@@ -13,6 +13,7 @@ envoy_package()
 envoy_cc_test(
     name = "decoded_resource_impl_test",
     srcs = ["decoded_resource_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:decoded_resource_lib",
         "//test/mocks/config:config_mocks",
@@ -23,6 +24,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "ttl_test",
     srcs = ["ttl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:ttl_lib",
         "//test/mocks/event:event_mocks",
@@ -34,6 +36,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "grpc_subscription_impl_test",
     srcs = ["grpc_subscription_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":grpc_subscription_test_harness",
         "//source/common/buffer:zero_copy_input_stream_lib",
@@ -67,6 +70,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "opaque_resource_decoder_impl_test",
     srcs = ["opaque_resource_decoder_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:opaque_resource_decoder_lib",
         "//source/common/protobuf:message_validator_lib",
@@ -88,6 +92,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "type_to_endpoint_test",
     srcs = ["type_to_endpoint_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:type_to_endpoint_lib",
         "//test/config:v2_link_hacks",
@@ -99,6 +104,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metadata_test",
     srcs = ["metadata_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:base_includes",
         "//source/common/config:metadata_lib",
@@ -113,6 +119,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "runtime_utility_test",
     srcs = ["runtime_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:runtime_utility_lib",
         "//test/test_common:utility_lib",
@@ -123,6 +130,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:api_version_lib",
         "//source/common/config:utility_lib",
@@ -152,6 +160,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "registry_test",
     srcs = ["registry_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:typed_config_interface",
         "//test/test_common:logging_lib",
@@ -167,6 +176,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "config_provider_impl_test",
     srcs = ["config_provider_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":dummy_config_proto_cc_proto",
         "//source/common/config:config_provider_lib",
@@ -181,6 +191,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "context_provider_impl_test",
     srcs = ["context_provider_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":xds_test_utility_lib",
         "//source/common/config:context_provider_lib",
@@ -191,6 +202,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "datasource_test",
     srcs = ["datasource_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:empty_string",
         "//source/common/config:datasource_lib",
@@ -210,6 +222,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "xds_context_params_test",
     srcs = ["xds_context_params_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":xds_test_utility_lib",
         "//source/common/config:xds_context_params_lib",
@@ -221,6 +234,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "xds_resource_test",
     srcs = ["xds_resource_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":xds_test_utility_lib",
         "//source/common/config:xds_resource_lib",
@@ -237,6 +251,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "watched_directory_test",
     srcs = ["watched_directory_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:watched_directory_lib",
         "//test/mocks/event:event_mocks",
@@ -247,6 +262,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "custom_config_validators_impl_test",
     srcs = ["custom_config_validators_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/protobuf:protobuf_mocks",
         "//test/mocks/server:instance_mocks",
diff --git a/test/common/conn_pool/BUILD b/test/common/conn_pool/BUILD
index 2bdc612768..ca5bcd4171 100644
--- a/test/common/conn_pool/BUILD
+++ b/test/common/conn_pool/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "conn_pool_base_test",
     srcs = ["conn_pool_base_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/conn_pool:conn_pool_base_lib",
         "//source/common/event:dispatcher_lib",
diff --git a/test/common/crypto/BUILD b/test/common/crypto/BUILD
index d85fe7c034..b0d6b628d1 100644
--- a/test/common/crypto/BUILD
+++ b/test/common/crypto/BUILD
@@ -16,6 +16,7 @@ envoy_cc_test(
         "utility_test.cc",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:hex_lib",
@@ -32,6 +33,7 @@ envoy_cc_fuzz_test(
     name = "get_sha_256_digest_fuzz_test",
     srcs = ["get_sha_256_digest_fuzz_test.cc"],
     corpus = "get_sha_256_digest_corpus",
+    rbe_pool = "2core",
     deps = ["//source/common/crypto:utility_lib"],
 )
 
@@ -40,6 +42,7 @@ envoy_cc_fuzz_test(
     srcs = ["verify_signature_fuzz_test.cc"],
     corpus = "verify_signature_corpus",
     dictionaries = ["verify_signature_fuzz_test.dict"],
+    rbe_pool = "2core",
     deps = [
         ":verify_signature_fuzz_proto_cc_proto",
         "//source/common/common:hex_lib",
diff --git a/test/common/event/BUILD b/test/common/event/BUILD
index 8b945fe028..08e489e0b8 100644
--- a/test/common/event/BUILD
+++ b/test/common/event/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "dispatcher_impl_test",
     srcs = ["dispatcher_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/event:deferred_task",
@@ -30,6 +31,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "file_event_impl_test",
     srcs = ["file_event_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:file_event_interface",
         "//source/common/event:dispatcher_includes",
@@ -45,6 +47,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "scaled_range_timer_manager_impl_test",
     srcs = ["scaled_range_timer_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:scaled_range_timer_manager_lib",
         "//test/mocks/event:wrapped_dispatcher",
diff --git a/test/common/filesystem/BUILD b/test/common/filesystem/BUILD
index 8de735cd12..cf9bb9f76c 100644
--- a/test/common/filesystem/BUILD
+++ b/test/common/filesystem/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "filesystem_impl_test",
     srcs = ["filesystem_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/filesystem:filesystem_lib",
         "//test/test_common:environment_lib",
@@ -20,6 +21,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "directory_test",
     srcs = ["directory_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/filesystem:directory_lib",
         "//test/test_common:environment_lib",
@@ -30,6 +32,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "watcher_impl_test",
     srcs = ["watcher_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/event:dispatcher_includes",
diff --git a/test/common/filter/BUILD b/test/common/filter/BUILD
index 8073cc14fd..0cf966a0ba 100644
--- a/test/common/filter/BUILD
+++ b/test/common/filter/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_discovery_impl_test",
     srcs = ["config_discovery_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/common/filter:config_discovery_lib",
diff --git a/test/common/formatter/BUILD b/test/common/formatter/BUILD
index 544346222f..d9850856a4 100644
--- a/test/common/formatter/BUILD
+++ b/test/common/formatter/BUILD
@@ -27,6 +27,7 @@ envoy_cc_fuzz_test(
         "substitution_formatter_fuzz_test.dict",
         "//test/fuzz:headers.dict",
     ],
+    rbe_pool = "2core",
     deps = [
         ":substitution_formatter_fuzz_proto_cc_proto",
         "//source/common/formatter:formatter_extension_lib",
@@ -48,6 +49,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "substitution_formatter_test",
     srcs = ["substitution_formatter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":command_extension_lib",
         "//source/common/common:utility_lib",
@@ -76,6 +78,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "substitution_format_string_test",
     srcs = ["substitution_format_string_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":command_extension_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -92,6 +95,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "substitution_formatter_speed_test",
     srcs = ["substitution_formatter_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/formatter:substitution_formatter_lib",
diff --git a/test/common/formatter/substitution_formatter_fuzz_test.cc b/test/common/formatter/substitution_formatter_fuzz_test.cc
index ed496d62a6..7540c37f93 100644
--- a/test/common/formatter/substitution_formatter_fuzz_test.cc
+++ b/test/common/formatter/substitution_formatter_fuzz_test.cc
@@ -1,3 +1,5 @@
+#include <memory>
+
 #include "source/common/formatter/substitution_formatter.h"
 
 #include "test/common/formatter/substitution_formatter_fuzz.pb.validate.h"
@@ -9,29 +11,86 @@ namespace Fuzz {
 namespace {
 
 DEFINE_PROTO_FUZZER(const test::common::substitution::TestCase& input) {
+  // Create formatter context.
+  Http::RequestHeaderMapPtr request_headers;
+  Http::ResponseHeaderMapPtr response_headers;
+  Http::ResponseTrailerMapPtr response_trailers;
+  std::unique_ptr<StreamInfo::StreamInfo> stream_info;
+  MockTimeSystem time_system;
+
   try {
     TestUtility::validate(input);
-    std::vector<Formatter::FormatterProviderPtr> formatters =
-        Formatter::SubstitutionFormatParser::parse(input.format());
-    const auto request_headers =
-        Fuzz::fromHeaders<Http::TestRequestHeaderMapImpl>(input.request_headers());
-    const auto response_headers =
-        Fuzz::fromHeaders<Http::TestResponseHeaderMapImpl>(input.response_headers());
-    const auto response_trailers =
-        Fuzz::fromHeaders<Http::TestResponseTrailerMapImpl>(input.response_trailers());
-    MockTimeSystem time_system;
-    const std::unique_ptr<TestStreamInfo> stream_info =
-        Fuzz::fromStreamInfo(input.stream_info(), time_system);
-
-    const Formatter::HttpFormatterContext formatter_context{&request_headers, &response_headers,
-                                                            &response_trailers};
-
-    for (const auto& it : formatters) {
-      it->formatWithContext(formatter_context, *stream_info);
-    }
-    ENVOY_LOG_MISC(trace, "Success");
+    request_headers = std::make_unique<Http::TestRequestHeaderMapImpl>(
+        Fuzz::fromHeaders<Http::TestRequestHeaderMapImpl>(input.request_headers()));
+    response_headers = std::make_unique<Http::TestResponseHeaderMapImpl>(
+        Fuzz::fromHeaders<Http::TestResponseHeaderMapImpl>(input.response_headers()));
+    response_trailers = std::make_unique<Http::TestResponseTrailerMapImpl>(
+        Fuzz::fromHeaders<Http::TestResponseTrailerMapImpl>(input.response_trailers()));
+    stream_info = Fuzz::fromStreamInfo(input.stream_info(), time_system);
   } catch (const EnvoyException& e) {
-    ENVOY_LOG_MISC(debug, "EnvoyException: {}", e.what());
+    ENVOY_LOG_MISC(debug, "Creating formatter context failed, EnvoyException: {}", e.what());
+    return;
+  }
+
+  const Formatter::HttpFormatterContext formatter_context{
+      request_headers.get(), response_headers.get(), response_trailers.get()};
+
+  // Text formatter.
+  {
+    Formatter::FormatterPtr formatter;
+    try {
+      formatter = std::make_unique<Formatter::FormatterImpl>(input.format());
+    } catch (const EnvoyException& e) {
+      ENVOY_LOG_MISC(debug, "TEXT formatter failed, EnvoyException: {}", e.what());
+      return;
+    }
+
+    // This should never throw.
+    formatter->formatWithContext(formatter_context, *stream_info);
+    ENVOY_LOG_MISC(trace, "TEXT formatter Success");
+  }
+
+  // JSON formatter.
+  {
+
+    Formatter::FormatterPtr formatter;
+    Formatter::FormatterPtr typed_formatter;
+
+    try {
+      // Create struct for JSON formatter.
+      ProtobufWkt::Struct struct_for_json_formatter;
+      TestUtility::loadFromYaml(fmt::format(R"EOF(
+      raw_bool_value: true
+      raw_nummber_value: 6
+      nested_list:
+        - 14
+        - "3.14"
+        - false
+        - "ok"
+        - '%REQ(key_1)%'
+        - '%REQ(error)%'
+        - {}
+      request_duration: '%REQUEST_DURATION%'
+      nested_level:
+        plain_string: plain_string_value
+        protocol: '%PROTOCOL%'
+        fuzz_format: {}
+      request_key: '%REQ(key_1)%_@!!!_"_%REQ(key_2)%'
+      )EOF",
+                                            input.format(), input.format()),
+                                struct_for_json_formatter);
+
+      // Create JSON formatter.
+      formatter = std::make_unique<Formatter::JsonFormatterImpl>(struct_for_json_formatter, false);
+    } catch (const EnvoyException& e) {
+      ENVOY_LOG_MISC(debug, "JSON formatter failed, EnvoyException: {}", e.what());
+      return;
+    }
+
+    // This should never throw.
+    formatter->formatWithContext(formatter_context, *stream_info);
+    typed_formatter->formatWithContext(formatter_context, *stream_info);
+    ENVOY_LOG_MISC(trace, "JSON formatter Success");
   }
 }
 
diff --git a/test/common/formatter/substitution_formatter_speed_test.cc b/test/common/formatter/substitution_formatter_speed_test.cc
index 30cfd83768..9e39bee306 100644
--- a/test/common/formatter/substitution_formatter_speed_test.cc
+++ b/test/common/formatter/substitution_formatter_speed_test.cc
@@ -11,7 +11,7 @@ namespace Envoy {
 
 namespace {
 
-std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> makeJsonFormatter(bool typed) {
+std::unique_ptr<Envoy::Formatter::LegacyJsonFormatterImpl> makeLegacyJsonFormatter(bool typed) {
   ProtobufWkt::Struct JsonLogFormat;
   const std::string format_yaml = R"EOF(
     remote_address: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
@@ -26,7 +26,26 @@ std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> makeJsonFormatter(bool type
     user-agent: '%REQ(USER-AGENT)%'
   )EOF";
   TestUtility::loadFromYaml(format_yaml, JsonLogFormat);
-  return std::make_unique<Envoy::Formatter::JsonFormatterImpl>(JsonLogFormat, typed, false, false);
+  return std::make_unique<Envoy::Formatter::LegacyJsonFormatterImpl>(JsonLogFormat, typed, false,
+                                                                     false);
+}
+
+std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> makeJsonFormatter() {
+  ProtobufWkt::Struct JsonLogFormat;
+  const std::string format_yaml = R"EOF(
+    remote_address: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
+    start_time: '%START_TIME(%Y/%m/%dT%H:%M:%S%z %s)%'
+    method: '%REQ(:METHOD)%'
+    url: '%REQ(X-FORWARDED-PROTO)%://%REQ(:AUTHORITY)%%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+    protocol: '%PROTOCOL%'
+    response_code: '%RESPONSE_CODE%'
+    bytes_sent: '%BYTES_SENT%'
+    duration: '%DURATION%'
+    referer: '%REQ(REFERER)%'
+    user-agent: '%REQ(USER-AGENT)%'
+  )EOF";
+  TestUtility::loadFromYaml(format_yaml, JsonLogFormat);
+  return std::make_unique<Envoy::Formatter::JsonFormatterImpl>(JsonLogFormat, false);
 }
 
 std::unique_ptr<Envoy::Formatter::StructFormatter> makeStructFormatter(bool typed) {
@@ -127,11 +146,24 @@ static void BM_TypedStructAccessLogFormatter(benchmark::State& state) {
 BENCHMARK(BM_TypedStructAccessLogFormatter);
 
 // NOLINTNEXTLINE(readability-identifier-naming)
-static void BM_JsonAccessLogFormatter(benchmark::State& state) {
+static void BM_LegacyJsonAccessLogFormatter(benchmark::State& state) {
   testing::NiceMock<MockTimeSystem> time_system;
+  std::unique_ptr<Envoy::TestStreamInfo> stream_info = makeStreamInfo(time_system);
+  auto json_formatter = makeLegacyJsonFormatter(false);
 
+  size_t output_bytes = 0;
+  for (auto _ : state) { // NOLINT: Silences warning about dead store
+    output_bytes += json_formatter->formatWithContext({}, *stream_info).length();
+  }
+  benchmark::DoNotOptimize(output_bytes);
+}
+BENCHMARK(BM_LegacyJsonAccessLogFormatter);
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+static void BM_LegacyTypedJsonAccessLogFormatter(benchmark::State& state) {
+  testing::NiceMock<MockTimeSystem> time_system;
   std::unique_ptr<Envoy::TestStreamInfo> stream_info = makeStreamInfo(time_system);
-  std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> json_formatter = makeJsonFormatter(false);
+  auto json_formatter = makeLegacyJsonFormatter(true);
 
   size_t output_bytes = 0;
   for (auto _ : state) { // NOLINT: Silences warning about dead store
@@ -139,23 +171,22 @@ static void BM_JsonAccessLogFormatter(benchmark::State& state) {
   }
   benchmark::DoNotOptimize(output_bytes);
 }
-BENCHMARK(BM_JsonAccessLogFormatter);
+BENCHMARK(BM_LegacyTypedJsonAccessLogFormatter);
 
 // NOLINTNEXTLINE(readability-identifier-naming)
-static void BM_TypedJsonAccessLogFormatter(benchmark::State& state) {
+static void BM_JsonAccessLogFormatter(benchmark::State& state) {
   testing::NiceMock<MockTimeSystem> time_system;
 
   std::unique_ptr<Envoy::TestStreamInfo> stream_info = makeStreamInfo(time_system);
-  std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> typed_json_formatter =
-      makeJsonFormatter(true);
+  std::unique_ptr<Envoy::Formatter::JsonFormatterImpl> json_formatter = makeJsonFormatter();
 
   size_t output_bytes = 0;
   for (auto _ : state) { // NOLINT: Silences warning about dead store
-    output_bytes += typed_json_formatter->formatWithContext({}, *stream_info).length();
+    output_bytes += json_formatter->formatWithContext({}, *stream_info).length();
   }
   benchmark::DoNotOptimize(output_bytes);
 }
-BENCHMARK(BM_TypedJsonAccessLogFormatter);
+BENCHMARK(BM_JsonAccessLogFormatter);
 
 // NOLINTNEXTLINE(readability-identifier-naming)
 static void BM_FormatterCommandParsing(benchmark::State& state) {
diff --git a/test/common/formatter/substitution_formatter_test.cc b/test/common/formatter/substitution_formatter_test.cc
index d7e1697ef5..41b3e2fcba 100644
--- a/test/common/formatter/substitution_formatter_test.cc
+++ b/test/common/formatter/substitution_formatter_test.cc
@@ -4441,7 +4441,8 @@ TEST(SubstitutionFormatterTest, StructFormatterTypedTest) {
 
 TEST(SubstitutionFormatterTest, JsonFormatterTest) {
   NiceMock<StreamInfo::MockStreamInfo> stream_info;
-  Http::TestRequestHeaderMapImpl request_header;
+  Http::TestRequestHeaderMapImpl request_header{{"key_1", "value_1"},
+                                                {"key_2", R"(value_with_quotes_"_)"}};
   Http::TestResponseHeaderMapImpl response_header;
   Http::TestResponseTrailerMapImpl response_trailer;
   std::string body;
@@ -4460,26 +4461,93 @@ TEST(SubstitutionFormatterTest, JsonFormatterTest) {
 
   ProtobufWkt::Struct key_mapping;
   TestUtility::loadFromYaml(R"EOF(
+    raw_bool_value: true
+    raw_nummber_value: 6
+    nested_list:
+      - 14
+      - "3.14"
+      - false
+      - "ok"
+      - '%REQ(key_1)%'
+      - '%REQ(error)%'
     request_duration: '%REQUEST_DURATION%'
     nested_level:
       plain_string: plain_string_value
       protocol: '%PROTOCOL%'
+    request_key: '%REQ(key_1)%_@!!!_"_%REQ(key_2)%'
   )EOF",
                             key_mapping);
-  JsonFormatterImpl formatter(key_mapping, false, false, false);
 
   const std::string expected = R"EOF({
-    "request_duration": "5",
+    "raw_bool_value": true,
+    "raw_nummber_value": 6,
+    "nested_list": [
+      14,
+      "3.14",
+      false,
+      "ok",
+      "value_1",
+      null
+    ],
+    "request_duration": 5,
     "nested_level": {
       "plain_string": "plain_string_value",
       "protocol": "HTTP/1.1"
-    }
+    },
+    "request_key": "value_1_@!!!_\"_value_with_quotes_\"_"
   })EOF";
 
+  JsonFormatterImpl formatter(key_mapping, false);
   const std::string out_json = formatter.formatWithContext(formatter_context, stream_info);
+  std::cout << out_json << std::endl;
   EXPECT_TRUE(TestUtility::jsonStringEqual(out_json, expected));
 }
 
+TEST(SubstitutionFormatterTest, LegacyJsonFormatterTest) {
+  NiceMock<StreamInfo::MockStreamInfo> stream_info;
+  Http::TestRequestHeaderMapImpl request_header{{"key_1", "value_1"},
+                                                {"key_2", R"(value_with_quotes_"_)"}};
+  Http::TestResponseHeaderMapImpl response_header;
+  Http::TestResponseTrailerMapImpl response_trailer;
+  std::string body;
+
+  HttpFormatterContext formatter_context(&request_header, &response_header, &response_trailer,
+                                         body);
+
+  envoy::config::core::v3::Metadata metadata;
+  populateMetadataTestData(metadata);
+  absl::optional<Http::Protocol> protocol = Http::Protocol::Http11;
+  EXPECT_CALL(stream_info, protocol()).WillRepeatedly(Return(protocol));
+  MockTimeSystem time_system;
+  EXPECT_CALL(time_system, monotonicTime)
+      .WillOnce(Return(MonotonicTime(std::chrono::nanoseconds(5000000))));
+  stream_info.downstream_timing_.onLastDownstreamRxByteReceived(time_system);
+
+  ProtobufWkt::Struct key_mapping;
+  TestUtility::loadFromYaml(R"EOF(
+    request_duration: '%REQUEST_DURATION%'
+    nested_level:
+      plain_string: plain_string_value
+      protocol: '%PROTOCOL%'
+    request_key: '%REQ(key_1)%_@!!!_"_%REQ(key_2)%'
+  )EOF",
+                            key_mapping);
+
+  const std::string expected = R"EOF({
+    "request_duration": "5",
+    "nested_level": {
+      "plain_string": "plain_string_value",
+      "protocol": "HTTP/1.1"
+    },
+    "request_key": "value_1_@!!!_\"_value_with_quotes_\"_"
+  })EOF";
+
+  LegacyJsonFormatterImpl legacy_formatter(key_mapping, false, false, false);
+  const std::string legacy_out_json =
+      legacy_formatter.formatWithContext(formatter_context, stream_info);
+  EXPECT_TRUE(TestUtility::jsonStringEqual(legacy_out_json, expected));
+}
+
 TEST(SubstitutionFormatterTest, JsonFormatterWithOrderedPropertiesTest) {
   NiceMock<StreamInfo::MockStreamInfo> stream_info;
   Http::TestRequestHeaderMapImpl request_header;
@@ -4510,17 +4578,28 @@ TEST(SubstitutionFormatterTest, JsonFormatterWithOrderedPropertiesTest) {
       protocol: '%PROTOCOL%'
   )EOF",
                             key_mapping);
-  JsonFormatterImpl formatter(key_mapping, false, false, true);
 
   const std::string expected =
       "{\"afield\":\"vala\",\"bfield\":\"valb\",\"nested_level\":"
       "{\"cfield\":\"valc\",\"plain_string\":\"plain_string_value\",\"protocol\":\"HTTP/1.1\"},"
-      "\"request_duration\":\"5\"}\n";
+      "\"request_duration\":5}\n";
 
+  // The formatter will always order the properties alphabetically.
+  JsonFormatterImpl formatter(key_mapping, false);
   const std::string out_json = formatter.formatWithContext(formatter_context, stream_info);
-
   // Check string equality to verify the order.
   EXPECT_EQ(out_json, expected);
+
+  const std::string legacy_expected =
+      "{\"afield\":\"vala\",\"bfield\":\"valb\",\"nested_level\":"
+      "{\"cfield\":\"valc\",\"plain_string\":\"plain_string_value\",\"protocol\":\"HTTP/1.1\"},"
+      "\"request_duration\":5.0}\n";
+
+  // The legacy formatter needs a flag to tell it to order the properties.
+  LegacyJsonFormatterImpl legacy_formatter(key_mapping, true, false, true);
+  const std::string legacy_out_json =
+      legacy_formatter.formatWithContext(formatter_context, stream_info);
+  EXPECT_EQ(legacy_out_json, legacy_expected);
 }
 
 TEST(SubstitutionFormatterTest, CompositeFormatterSuccess) {
diff --git a/test/common/grpc/BUILD b/test/common/grpc/BUILD
index 40934f3e5e..59c65484e5 100644
--- a/test/common/grpc/BUILD
+++ b/test/common/grpc/BUILD
@@ -16,6 +16,7 @@ envoy_package()
 envoy_cc_test(
     name = "async_client_impl_test",
     srcs = ["async_client_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -32,6 +33,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "async_client_manager_impl_test",
     srcs = ["async_client_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/grpc:async_client_manager_lib",
@@ -51,6 +53,7 @@ envoy_cc_fuzz_test(
     name = "codec_fuzz_test",
     srcs = ["codec_fuzz_test.cc"],
     corpus = "codec_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/grpc:codec_lib",
@@ -62,6 +65,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "codec_test",
     srcs = ["codec_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/grpc:codec_lib",
@@ -73,6 +77,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "common_test",
     srcs = ["common_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:common_lib",
         "//source/common/http:headers_lib",
@@ -85,6 +90,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "context_impl_test",
     srcs = ["context_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:common_lib",
         "//source/common/grpc:context_lib",
@@ -97,6 +103,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "google_grpc_utils_test",
     srcs = envoy_select_google_grpc(["google_grpc_utils_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:common_lib",
         "//source/common/http:headers_lib",
@@ -108,6 +115,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "google_async_client_impl_test",
     srcs = envoy_select_google_grpc(["google_async_client_impl_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/event:dispatcher_lib",
@@ -128,6 +136,7 @@ envoy_cc_test(
     name = "google_grpc_creds_test",
     srcs = envoy_select_google_grpc(["google_grpc_creds_test.cc"]),
     data = [":service_key.json"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//test/mocks/stats:stats_mocks",
@@ -179,6 +188,7 @@ envoy_cc_test(
     name = "grpc_client_integration_test",
     size = "large",
     srcs = ["grpc_client_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":grpc_client_integration_test_harness_lib",
         "//source/common/grpc:async_client_lib",
@@ -200,6 +210,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "buffered_async_client_test",
     srcs = ["buffered_async_client_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:async_client_lib",
         "//source/common/grpc:buffered_async_client_lib",
@@ -215,6 +226,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "buffered_message_ttl_manager_test",
     srcs = ["buffered_message_ttl_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/grpc:buffered_message_ttl_manager_lib",
@@ -225,6 +237,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "async_client_manager_benchmark",
     srcs = ["async_client_manager_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/grpc:async_client_manager_lib",
diff --git a/test/common/html/BUILD b/test/common/html/BUILD
index 378ddd98ed..368b2f36d2 100644
--- a/test/common/html/BUILD
+++ b/test/common/html/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/html:utility_lib",
     ],
diff --git a/test/common/http/BUILD b/test/common/http/BUILD
index 565dbfddf8..ceeae6156d 100644
--- a/test/common/http/BUILD
+++ b/test/common/http/BUILD
@@ -17,6 +17,7 @@ envoy_package()
 envoy_cc_test(
     name = "async_client_impl_test",
     srcs = ["async_client_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/buffer:buffer_lib",
@@ -43,6 +44,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "async_client_utility_test",
     srcs = ["async_client_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:async_client_utility_lib",
         "//test/mocks/http:http_mocks",
@@ -52,6 +54,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "character_set_validation_test",
     srcs = ["character_set_validation_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:character_set_validation_lib",
         "//test/test_common:utility_lib",
@@ -61,6 +64,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "codec_client_test",
     srcs = ["codec_client_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/buffer:buffer_lib",
@@ -102,6 +106,7 @@ envoy_proto_library(
         srcs = ["codec_impl_fuzz_test.cc"],
         corpus = "codec_impl_corpus",
         defines = ["FUZZ_PROTOCOL_%s" % http_protocol],
+        rbe_pool = "2core",
         deps = [
             ":codec_impl_fuzz_proto_cc_proto",
             "//source/common/http:conn_manager_lib",
@@ -127,6 +132,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "filter_manager_test",
     srcs = ["filter_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:filter_manager_lib",
         "//test/mocks/event:event_mocks",
@@ -141,6 +147,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "codec_wrappers_test",
     srcs = ["codec_wrappers_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:codec_wrappers_lib",
         "//test/mocks/http:http_mocks",
@@ -151,6 +158,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "codes_test",
     srcs = ["codes_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:empty_string",
         "//source/common/http:codes_lib",
@@ -164,6 +172,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "codes_speed_test",
     srcs = ["codes_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:codes_lib",
         "//source/common/stats:isolated_store_lib",
@@ -204,6 +213,7 @@ envoy_cc_fuzz_test(
     name = "conn_manager_impl_fuzz_test",
     srcs = ["conn_manager_impl_fuzz_test.cc"],
     corpus = "conn_manager_impl_corpus",
+    rbe_pool = "2core",
     deps = [
         ":conn_manager_impl_fuzz_proto_cc_proto",
         "//source/common/common:empty_string",
@@ -236,6 +246,7 @@ envoy_cc_test_library(
     name = "conn_manager_impl_test_base_lib",
     srcs = ["conn_manager_impl_test_base.cc"],
     hdrs = ["conn_manager_impl_test_base.h"],
+    rbe_pool = "2core",
     deps = [
         ":xff_extension_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -271,6 +282,7 @@ envoy_cc_test(
         "conn_manager_impl_test.cc",
         "conn_manager_impl_test_2.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":conn_manager_impl_test_base_lib",
         ":custom_header_extension_lib",
@@ -280,6 +292,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_manager_utility_test",
     srcs = ["conn_manager_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":custom_header_extension_lib",
         ":xff_extension_lib",
@@ -308,6 +321,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "date_provider_impl_test",
     srcs = ["date_provider_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:date_provider_lib",
         "//source/common/http:header_map_lib",
@@ -319,6 +333,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "header_map_impl_test",
     srcs = ["header_map_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_list_view_lib",
         "//source/common/http:header_map_lib",
@@ -331,6 +346,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "header_map_impl_speed_test",
     srcs = ["header_map_impl_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "@com_github_google_benchmark//:benchmark",
@@ -351,6 +367,7 @@ envoy_cc_fuzz_test(
     name = "header_map_impl_fuzz_test",
     srcs = ["header_map_impl_fuzz_test.cc"],
     corpus = "header_map_impl_corpus",
+    rbe_pool = "2core",
     deps = [
         ":header_map_impl_fuzz_proto_cc_proto",
         "//source/common/http:header_map_lib",
@@ -362,6 +379,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "inline_cookie_test",
     srcs = ["inline_cookie_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//test/mocks/runtime:runtime_mocks",
@@ -371,6 +389,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "header_utility_test",
     srcs = ["header_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_utility_lib",
         "//test/mocks/http:header_validator_mocks",
@@ -384,6 +403,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "user_agent_test",
     srcs = ["user_agent_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:user_agent_lib",
@@ -403,6 +423,7 @@ envoy_cc_fuzz_test(
     name = "utility_fuzz_test",
     srcs = ["utility_fuzz_test.cc"],
     corpus = "utility_corpus",
+    rbe_pool = "2core",
     deps = [
         ":utility_fuzz_proto_cc_proto",
         "//source/common/http:utility_lib",
@@ -414,6 +435,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:exception_lib",
         "//source/common/http:header_map_lib",
@@ -430,6 +452,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metadata_interface_test",
     srcs = ["metadata_interface_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:metadata_interface",
         "//source/common/http:utility_lib",
@@ -439,6 +462,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "path_utility_test",
     srcs = ["path_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:path_utility_lib",
@@ -448,6 +472,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "status_test",
     srcs = ["status_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:status_lib",
     ],
@@ -456,6 +481,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "mixed_conn_pool_test",
     srcs = ["mixed_conn_pool_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/http:mixed_conn_pool",
@@ -476,6 +502,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_pool_grid_test",
     srcs = envoy_select_enable_http3(["conn_pool_grid_test.cc"]),
+    rbe_pool = "2core",
     deps = envoy_select_enable_http3([
         ":common_lib",
         "//source/common/http:conn_pool_grid",
@@ -501,6 +528,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "http3_status_tracker_impl_test",
     srcs = ["http3_status_tracker_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/http:http3_status_tracker_impl_lib",
@@ -511,6 +539,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "http_server_properties_cache_impl_test",
     srcs = ["http_server_properties_cache_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/http:http_server_properties_cache",
@@ -522,6 +551,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "http_server_properties_cache_manager_test",
     srcs = ["http_server_properties_cache_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_lib",
         "//source/common/http:http_server_properties_cache",
@@ -545,6 +575,7 @@ envoy_cc_fuzz_test(
     name = "path_utility_fuzz_test",
     srcs = ["path_utility_fuzz_test.cc"],
     corpus = "path_utility_corpus",
+    rbe_pool = "2core",
     deps = [
         ":path_utility_fuzz_proto_cc_proto",
         "//source/common/http:header_map_lib",
@@ -574,6 +605,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "dependency_manager_test",
     srcs = ["dependency_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:dependency_manager",
     ],
@@ -582,6 +614,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "header_mutation_test",
     srcs = ["header_mutation_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/http:header_mutation_lib",
@@ -593,6 +626,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_chain_helper_test",
     srcs = ["filter_chain_helper_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:filter_chain_helper_lib",
         "//test/mocks:common_lib",
@@ -615,6 +649,7 @@ envoy_cc_fuzz_test(
     name = "hcm_router_fuzz_test",
     srcs = ["hcm_router_fuzz_test.cc"],
     corpus = "hcm_router_fuzz_corpus",
+    rbe_pool = "2core",
     deps = [
         ":conn_manager_impl_test_base_lib",
         ":hcm_router_fuzz_proto_cc_proto",
diff --git a/test/common/http/codec_impl_fuzz_test.cc b/test/common/http/codec_impl_fuzz_test.cc
index 8554be417b..bca32e8454 100644
--- a/test/common/http/codec_impl_fuzz_test.cc
+++ b/test/common/http/codec_impl_fuzz_test.cc
@@ -616,7 +616,7 @@ void codecFuzz(const test::common::http::CodecImplFuzzTestCase& input, HttpVersi
   } else {
     client = std::make_unique<Http1::ClientConnectionImpl>(
         client_connection, Http1::CodecStats::atomicGet(http1_stats, scope), client_callbacks,
-        client_http1settings, max_response_headers_count);
+        client_http1settings, max_request_headers_kb, max_response_headers_count);
   }
 
   if (http2) {
diff --git a/test/common/http/http1/BUILD b/test/common/http/http1/BUILD
index 13c2bfeec6..40ad8a0ccb 100644
--- a/test/common/http/http1/BUILD
+++ b/test/common/http/http1/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "header_formatter_test",
     srcs = ["header_formatter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/http1:header_formatter_lib",
     ],
@@ -20,6 +21,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "codec_impl_test",
     srcs = ["codec_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/buffer:buffer_interface",
         "//envoy/event:dispatcher_interface",
@@ -50,6 +52,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_pool_test",
     srcs = ["conn_pool_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_lib",
@@ -77,6 +80,7 @@ envoy_cc_fuzz_test(
     name = "http1_connection_fuzz_test",
     srcs = ["http1_connection_fuzz_test.cc"],
     corpus = "http1_connection_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:conn_manager_lib",
         "//source/common/http:header_map_lib",
diff --git a/test/common/http/http1/codec_impl_test.cc b/test/common/http/http1/codec_impl_test.cc
index 1fca99b17e..0dca1c8abc 100644
--- a/test/common/http/http1/codec_impl_test.cc
+++ b/test/common/http/http1/codec_impl_test.cc
@@ -2544,7 +2544,8 @@ class Http1ClientConnectionImplTest : public Http1CodecTestBase {
 public:
   void initialize() {
     codec_ = std::make_unique<Http1::ClientConnectionImpl>(
-        connection_, http1CodecStats(), callbacks_, codec_settings_, max_response_headers_count_,
+        connection_, http1CodecStats(), callbacks_, codec_settings_, max_response_headers_kb_,
+        max_response_headers_count_,
         /* passing_through_proxy=*/false);
   }
 
@@ -2564,6 +2565,7 @@ class Http1ClientConnectionImplTest : public Http1CodecTestBase {
 protected:
   Stats::TestUtil::TestStore store_;
   uint32_t max_response_headers_count_{Http::DEFAULT_MAX_HEADERS_COUNT};
+  uint32_t max_response_headers_kb_{Http::Http1::MAX_RESPONSE_HEADERS_KB};
 };
 
 void Http1ClientConnectionImplTest::testClientAllowChunkedContentLength(
@@ -2571,8 +2573,9 @@ void Http1ClientConnectionImplTest::testClientAllowChunkedContentLength(
 // Response validation is not implemented in UHV yet
 #ifndef ENVOY_ENABLE_UHV
   codec_settings_.allow_chunked_length_ = allow_chunked_length;
-  codec_ = std::make_unique<Http1::ClientConnectionImpl>(
-      connection_, http1CodecStats(), callbacks_, codec_settings_, max_response_headers_count_);
+  codec_ = std::make_unique<Http1::ClientConnectionImpl>(connection_, http1CodecStats(), callbacks_,
+                                                         codec_settings_, max_response_headers_kb_,
+                                                         max_response_headers_count_);
 
   NiceMock<MockResponseDecoder> response_decoder;
   Http::RequestEncoder& request_encoder = codec_->newStream(response_decoder);
@@ -3706,6 +3709,28 @@ TEST_P(Http1ClientConnectionImplTest, LargeResponseHeadersAccepted) {
   std::string long_header = "big: " + std::string(79 * 1024, 'q') + "\r\n";
   buffer = Buffer::OwnedImpl(long_header);
   status = codec_->dispatch(buffer);
+  EXPECT_TRUE(status.ok());
+}
+
+// Tests that the size of response headers for HTTP/1 can be configured higher than the default of
+// 80kB.
+TEST_P(Http1ClientConnectionImplTest, LargeResponseHeadersAcceptedConfigurable) {
+  constexpr uint32_t size_limit_kb = 85;
+  max_response_headers_kb_ = size_limit_kb;
+  initialize();
+
+  NiceMock<MockResponseDecoder> response_decoder;
+  Http::RequestEncoder& request_encoder = codec_->newStream(response_decoder);
+  TestRequestHeaderMapImpl headers{{":method", "GET"}, {":path", "/"}, {":authority", "host"}};
+  EXPECT_TRUE(request_encoder.encodeHeaders(headers, true).ok());
+
+  Buffer::OwnedImpl buffer("HTTP/1.1 200 OK\r\nContent-Length: 0\r\n");
+  auto status = codec_->dispatch(buffer);
+  EXPECT_TRUE(status.ok());
+  std::string long_header = "big: " + std::string((size_limit_kb - 1) * 1024, 'q') + "\r\n";
+  buffer = Buffer::OwnedImpl(long_header);
+  status = codec_->dispatch(buffer);
+  EXPECT_TRUE(status.ok());
 }
 
 // Regression test for CVE-2019-18801. Large method headers should not trigger
@@ -3792,6 +3817,7 @@ TEST_P(Http1ClientConnectionImplTest, ManyResponseHeadersAccepted) {
   // Response already contains one header.
   buffer = Buffer::OwnedImpl(createHeaderOrTrailerFragment(150) + "\r\n");
   status = codec_->dispatch(buffer);
+  EXPECT_TRUE(status.ok());
 }
 
 TEST_P(Http1ClientConnectionImplTest, TestResponseSplit0) {
@@ -3821,8 +3847,9 @@ TEST_P(Http1ClientConnectionImplTest, TestResponseSplitAllowChunkedLength100) {
 TEST_P(Http1ClientConnectionImplTest, VerifyResponseHeaderTrailerMapMaxLimits) {
   codec_settings_.allow_chunked_length_ = true;
   codec_settings_.enable_trailers_ = true;
-  codec_ = std::make_unique<Http1::ClientConnectionImpl>(
-      connection_, http1CodecStats(), callbacks_, codec_settings_, max_response_headers_count_);
+  codec_ = std::make_unique<Http1::ClientConnectionImpl>(connection_, http1CodecStats(), callbacks_,
+                                                         codec_settings_, max_response_headers_kb_,
+                                                         max_response_headers_count_);
 
   NiceMock<MockResponseDecoder> response_decoder;
   Http::RequestEncoder& request_encoder = codec_->newStream(response_decoder);
diff --git a/test/common/http/http1/http1_connection_fuzz_test.cc b/test/common/http/http1/http1_connection_fuzz_test.cc
index 9dae7af6c7..37eb6fc64e 100644
--- a/test/common/http/http1/http1_connection_fuzz_test.cc
+++ b/test/common/http/http1/http1_connection_fuzz_test.cc
@@ -45,7 +45,7 @@ class Http1Harness {
     client_ = std::make_unique<Http1::ClientConnectionImpl>(
         mock_client_connection_,
         Http1::CodecStats::atomicGet(http1_stats_, *stats_store_.rootScope()),
-        mock_client_callbacks_, client_settings_, Http::DEFAULT_MAX_HEADERS_COUNT);
+        mock_client_callbacks_, client_settings_, absl::nullopt, Http::DEFAULT_MAX_HEADERS_COUNT);
     Status status = client_->dispatch(payload);
   }
 
diff --git a/test/common/http/http2/BUILD b/test/common/http/http2/BUILD
index 04b9c8a8c2..2344052265 100644
--- a/test/common/http/http2/BUILD
+++ b/test/common/http/http2/BUILD
@@ -15,6 +15,7 @@ envoy_cc_test(
     name = "codec_impl_test",
     size = "large",
     srcs = ["codec_impl_test.cc"],
+    rbe_pool = "2core",
     shard_count = 5,
     deps = [
         ":codec_impl_test_util",
@@ -62,6 +63,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "conn_pool_test",
     srcs = ["conn_pool_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/http/http2:conn_pool_lib",
@@ -99,6 +101,7 @@ envoy_cc_test_library(
     name = "frame_replay_lib",
     srcs = ["frame_replay.cc"],
     hdrs = ["frame_replay.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:hex_lib",
         "//source/common/common:macros",
@@ -122,6 +125,7 @@ envoy_cc_test(
         "response_header_corpus/simple_example_huffman",
         "response_header_corpus/simple_example_plain",
     ],
+    rbe_pool = "2core",
     deps = [
         ":frame_replay_lib",
         "//test/common/http/http2:codec_impl_test_util",
@@ -131,6 +135,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metadata_encoder_test",
     srcs = ["metadata_encoder_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:random_generator_lib",
@@ -149,6 +154,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "http2_frame_test",
     srcs = ["http2_frame_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:metadata_interface",
         "//source/common/http/http2:metadata_encoder_lib",
@@ -159,6 +165,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "protocol_constraints_test",
     srcs = ["protocol_constraints_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/http2:protocol_constraints_lib",
         "//test/common/memory:memory_test_utility_lib",
@@ -171,6 +178,7 @@ envoy_cc_fuzz_test(
     name = "response_header_fuzz_test",
     srcs = ["response_header_fuzz_test.cc"],
     corpus = "response_header_corpus",
+    rbe_pool = "2core",
     deps = [
         ":frame_replay_lib",
         "//test/common/http/http2:codec_impl_test_util",
@@ -182,6 +190,7 @@ envoy_cc_fuzz_test(
     name = "request_header_fuzz_test",
     srcs = ["request_header_fuzz_test.cc"],
     corpus = "request_header_corpus",
+    rbe_pool = "2core",
     deps = [
         ":frame_replay_lib",
         "//test/common/http/http2:codec_impl_test_util",
@@ -200,6 +209,7 @@ envoy_cc_fuzz_test(
     srcs = ["hpack_fuzz_test.cc"],
     corpus = "hpack_corpus",
     external_deps = ["nghttp2"],
+    rbe_pool = "2core",
     deps = [
         ":hpack_fuzz_proto_cc_proto",
         "//test/test_common:utility_lib",
@@ -217,6 +227,7 @@ envoy_cc_fuzz_test(
     srcs = ["http2_connection_fuzz_test.cc"],
     corpus = "http2_connection_corpus",
     external_deps = ["nghttp2"],
+    rbe_pool = "2core",
     deps = [
         ":http2_connection_proto_cc_proto",
         "//source/common/http/http2:codec_lib",
diff --git a/test/common/http/http3/BUILD b/test/common/http/http3/BUILD
index 2a20dc642e..dd61fad8d2 100644
--- a/test/common/http/http3/BUILD
+++ b/test/common/http/http3/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "conn_pool_test",
     srcs = envoy_select_enable_http3(["conn_pool_test.cc"]),
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = envoy_select_enable_http3([
         "//source/common/event:dispatcher_lib",
diff --git a/test/common/http/matching/BUILD b/test/common/http/matching/BUILD
index 09200e98bc..0310d7f319 100644
--- a/test/common/http/matching/BUILD
+++ b/test/common/http/matching/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "inputs_test",
     srcs = ["inputs_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/matching:data_impl_lib",
         "//source/common/http/matching:inputs_lib",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "status_code_input_test",
     srcs = ["status_code_input_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/matching:data_impl_lib",
         "//source/common/http/matching:status_code_input_lib",
diff --git a/test/common/init/BUILD b/test/common/init/BUILD
index e2d1645763..2dd1393be9 100644
--- a/test/common/init/BUILD
+++ b/test/common/init/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "watcher_impl_test",
     srcs = ["watcher_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/init:init_mocks",
     ],
@@ -19,6 +20,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "target_impl_test",
     srcs = ["target_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/init:init_mocks",
     ],
@@ -27,6 +29,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "manager_impl_test",
     srcs = ["manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/init:manager_lib",
         "//test/mocks/init:init_mocks",
diff --git a/test/common/io/BUILD b/test/common/io/BUILD
index 2a51bf73c9..08af231c2f 100644
--- a/test/common/io/BUILD
+++ b/test/common/io/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "io_uring_impl_test",
     srcs = ["io_uring_impl_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "nocompdb",
         "skip_on_windows",
@@ -30,6 +31,7 @@ envoy_cc_test(
         "//bazel:linux": ["io_uring_worker_impl_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/event:event_mocks",
         "//test/mocks/io:io_mocks",
@@ -48,6 +50,7 @@ envoy_cc_test(
         "//bazel:linux": ["io_uring_worker_impl_integration_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//envoy/api:os_sys_calls_interface",
         "//source/common/api:os_sys_calls_lib",
@@ -66,6 +69,7 @@ envoy_cc_test(
         "//bazel:linux": ["io_uring_worker_factory_impl_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/server:server_mocks",
         "//test/test_common:environment_lib",
diff --git a/test/common/json/BUILD b/test/common/json/BUILD
index 042d825da6..91bf779da9 100644
--- a/test/common/json/BUILD
+++ b/test/common/json/BUILD
@@ -16,6 +16,7 @@ envoy_cc_fuzz_test(
     name = "json_fuzz_test",
     srcs = ["json_fuzz_test.cc"],
     corpus = "json_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
@@ -33,6 +34,7 @@ JSON_TEST_DEPS = [
 envoy_cc_test(
     name = "json_loader_test",
     srcs = ["json_loader_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/json:json_loader_lib",
         "//source/common/stats:isolated_store_lib",
@@ -44,6 +46,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "json_sanitizer_test",
     srcs = ["json_sanitizer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":json_sanitizer_test_util_lib",
         "//source/common/buffer:buffer_lib",
@@ -67,6 +70,7 @@ envoy_cc_fuzz_test(
     name = "json_sanitizer_fuzz_test",
     srcs = ["json_sanitizer_fuzz_test.cc"],
     corpus = "json_sanitizer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":json_sanitizer_test_util_lib",
         "//source/common/json:json_sanitizer_lib",
@@ -78,6 +82,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "json_streamer_test",
     srcs = ["json_streamer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/json:json_internal_lib",
@@ -116,5 +121,6 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "utf8_test",
     srcs = ["utf8_test.cc"],
+    rbe_pool = "2core",
     deps = [":utf8_lib"],
 )
diff --git a/test/common/listener_manager/BUILD b/test/common/listener_manager/BUILD
index 484a147a49..3baf56a8b4 100644
--- a/test/common/listener_manager/BUILD
+++ b/test/common/listener_manager/BUILD
@@ -24,6 +24,7 @@ envoy_cc_test(
         "internal_listener.yaml",
         "internal_listener_missing_bootstrap.yaml",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/bootstrap/internal_listener:config",
         "//source/extensions/filters/network/tcp_proxy:config",
@@ -71,6 +72,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "listener_manager_impl_test",
     srcs = ["listener_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":listener_manager_impl_test_lib",
         "//source/common/api:os_sys_calls_lib",
@@ -107,6 +109,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "listener_manager_impl_quic_only_test",
     srcs = ["listener_manager_impl_quic_only_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":listener_manager_impl_test_lib",
@@ -130,6 +133,7 @@ envoy_cc_test(
     name = "filter_chain_manager_impl_test",
     srcs = ["filter_chain_manager_impl_test.cc"],
     data = ["//test/common/tls/test_data:certs"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:os_sys_calls_lib",
         "//source/common/config:metadata_lib",
@@ -165,6 +169,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/listener_manager:lds_api_lib",
         "//source/common/protobuf:utility_lib",
@@ -184,6 +189,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "filter_chain_benchmark_test",
     srcs = ["filter_chain_benchmark_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/listener_manager:filter_chain_manager_lib",
         "//test/test_common:environment_lib",
diff --git a/test/common/listener_manager/listener_manager_impl_test.cc b/test/common/listener_manager/listener_manager_impl_test.cc
index 0755984a9a..d86093344f 100644
--- a/test/common/listener_manager/listener_manager_impl_test.cc
+++ b/test/common/listener_manager/listener_manager_impl_test.cc
@@ -8040,9 +8040,8 @@ TEST_P(ListenerManagerImplWithRealFiltersTest, InvalidExtendConnectionBalanceCon
   Network::Address::InstanceConstSharedPtr address(
       new Network::Address::Ipv4Instance("192.168.0.1", 80, nullptr));
   EXPECT_CALL(*socket_factory, localAddress()).WillOnce(ReturnRef(address));
-  EXPECT_THROW_WITH_MESSAGE(
-      listener_impl.addSocketFactory(std::move(socket_factory)), EnvoyException,
-      "Didn't find a registered implementation for type: 'google.protobuf.test'");
+  EXPECT_EQ(listener_impl.addSocketFactory(std::move(socket_factory)).message(),
+            "Didn't find a registered implementation for type: 'google.protobuf.test'");
 #endif
 }
 
@@ -8058,8 +8057,8 @@ TEST_P(ListenerManagerImplWithRealFiltersTest, EmptyConnectionBalanceConfig) {
   Network::Address::InstanceConstSharedPtr address(
       new Network::Address::Ipv4Instance("192.168.0.1", 80, nullptr));
   EXPECT_CALL(*socket_factory, localAddress()).WillOnce(ReturnRef(address));
-  EXPECT_THROW_WITH_MESSAGE(listener_impl.addSocketFactory(std::move(socket_factory)),
-                            EnvoyException, "No valid balance type for connection balance");
+  EXPECT_EQ(listener_impl.addSocketFactory(std::move(socket_factory)).message(),
+            "No valid balance type for connection balance");
 #endif
 }
 
diff --git a/test/common/local_info/BUILD b/test/common/local_info/BUILD
index 770ae9f63d..bbb81a7956 100644
--- a/test/common/local_info/BUILD
+++ b/test/common/local_info/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "local_info_impl_test",
     srcs = ["local_info_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/local_info:local_info_lib",
         "//test/common/stats:stat_test_utility_lib",
diff --git a/test/common/local_reply/BUILD b/test/common/local_reply/BUILD
index e13e46d723..237c565929 100644
--- a/test/common/local_reply/BUILD
+++ b/test/common/local_reply/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "local_reply_test",
     srcs = ["local_reply_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/local_reply:local_reply_lib",
diff --git a/test/common/matcher/BUILD b/test/common/matcher/BUILD
index b42b1d3877..2a4f04adfa 100644
--- a/test/common/matcher/BUILD
+++ b/test/common/matcher/BUILD
@@ -22,6 +22,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "list_matcher_test",
     srcs = ["list_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_utility_lib",
         "//source/common/matcher:list_matcher_lib",
@@ -32,6 +33,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "exact_map_matcher_test",
     srcs = ["exact_map_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_utility_lib",
         "//source/common/matcher:exact_map_matcher_lib",
@@ -42,6 +44,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "prefix_map_matcher_test",
     srcs = ["prefix_map_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_utility_lib",
         "//source/common/matcher:prefix_map_matcher_lib",
@@ -52,6 +55,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "field_matcher_test",
     srcs = ["field_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_utility_lib",
         "//source/common/matcher:field_matcher_lib",
@@ -63,6 +67,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "value_input_matcher_test",
     srcs = ["value_input_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/matcher:value_input_matcher_lib",
         "//test/mocks/server:server_factory_context_mocks",
@@ -73,6 +78,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_utility_lib",
         "//source/common/matcher:matcher_lib",
diff --git a/test/common/memory/BUILD b/test/common/memory/BUILD
index 7d74c12a13..e359c31297 100644
--- a/test/common/memory/BUILD
+++ b/test/common/memory/BUILD
@@ -12,12 +12,14 @@ envoy_package()
 envoy_cc_test(
     name = "debug_test",
     srcs = ["debug_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/common/memory:stats_lib"],
 )
 
 envoy_cc_test(
     name = "memory_release_test",
     srcs = ["memory_release_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/memory:stats_lib",
@@ -30,6 +32,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "heap_shrinker_test",
     srcs = ["heap_shrinker_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/memory:heap_shrinker_lib",
diff --git a/test/common/network/BUILD b/test/common/network/BUILD
index 036c23c15d..7b0a24d69f 100644
--- a/test/common/network/BUILD
+++ b/test/common/network/BUILD
@@ -36,6 +36,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "address_impl_test",
     srcs = ["address_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
@@ -50,6 +51,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "address_impl_speed_test",
     srcs = ["address_impl_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "@com_github_google_benchmark//:benchmark",
@@ -64,6 +66,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "cidr_range_test",
     srcs = ["cidr_range_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:cidr_range_lib",
@@ -73,12 +76,12 @@ envoy_cc_test(
 envoy_cc_test(
     name = "connection_impl_test",
     srcs = ["connection_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:empty_string",
         "//source/common/event:dispatcher_includes",
         "//source/common/event:dispatcher_lib",
-        "//source/common/network:common_connection_filter_states_lib",
         "//source/common/network:connection_lib",
         "//source/common/network:listen_socket_lib",
         "//source/common/network:utility_lib",
@@ -103,6 +106,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "happy_eyeballs_connection_provider_test",
     srcs = ["happy_eyeballs_connection_provider_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:happy_eyeballs_connection_impl_lib",
         "//test/test_common:utility_lib",
@@ -112,6 +116,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "multi_connection_base_impl_test",
     srcs = ["multi_connection_base_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:multi_connection_base_impl_lib",
         "//source/common/network:socket_option_lib",
@@ -123,6 +128,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_manager_impl_test",
     srcs = ["filter_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_lib",
@@ -149,6 +155,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "lc_trie_test",
     srcs = ["lc_trie_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/network:address_lib",
@@ -161,6 +168,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "listen_socket_impl_test",
     srcs = ["listen_socket_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:listen_socket_lib",
@@ -177,6 +185,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "listener_filter_buffer_impl_test",
     srcs = ["listener_filter_buffer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:listener_filter_buffer_lib",
         "//test/mocks/event:event_mocks",
@@ -187,6 +196,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "listener_impl_test",
     srcs = ["listener_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/network:address_lib",
@@ -208,6 +218,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "raw_buffer_socket_test",
     srcs = ["raw_buffer_socket_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:raw_buffer_socket_lib",
         "//source/common/network:transport_socket_options_lib",
@@ -238,6 +249,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "udp_listener_impl_test",
     srcs = ["udp_listener_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":udp_listener_impl_test_base_lib",
         "//source/common/event:dispatcher_lib",
@@ -262,6 +274,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "udp_listener_impl_batch_writer_test",
     srcs = ["udp_listener_impl_batch_writer_test.cc"],
+    rbe_pool = "2core",
     # Skipping as quiche quic_gso_batch_writer.h does not exist on Windows
     tags = [
         "nofips",
@@ -291,6 +304,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "resolver_test",
     srcs = ["resolver_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:resolver_lib",
@@ -320,6 +334,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "socket_option_impl_test",
     srcs = ["socket_option_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":socket_option_test",
         "//test/test_common:environment_lib",
@@ -330,6 +345,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "socket_option_factory_test",
     srcs = ["socket_option_factory_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:socket_option_factory_lib",
@@ -346,6 +362,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "addr_family_aware_socket_option_impl_test",
     srcs = ["addr_family_aware_socket_option_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":socket_option_test",
         "//source/common/network:addr_family_aware_socket_option_lib",
@@ -357,6 +374,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
@@ -369,9 +387,10 @@ envoy_cc_test(
 )
 
 envoy_cc_fuzz_test(
-    name = "udp_fuzz",
+    name = "udp_fuzz_test",
     srcs = ["udp_fuzz.cc"],
     corpus = "udp_corpus",
+    rbe_pool = "2core",
     deps = [
         "udp_listener_impl_test_base_lib",
         "//source/common/event:dispatcher_lib",
@@ -396,6 +415,7 @@ envoy_cc_fuzz_test(
     name = "utility_fuzz_test",
     srcs = ["utility_fuzz_test.cc"],
     corpus = "utility_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
@@ -406,6 +426,7 @@ envoy_cc_fuzz_test(
 envoy_cc_benchmark_binary(
     name = "lc_trie_speed_test",
     srcs = ["lc_trie_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:lc_trie_lib",
         "//source/common/network:utility_lib",
@@ -421,6 +442,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "io_socket_handle_impl_test",
     srcs = ["io_socket_handle_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/network:address_lib",
@@ -436,6 +458,7 @@ envoy_cc_test(
         "//bazel:linux": ["io_uring_socket_handle_impl_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//test/mocks/api:api_mocks",
         "//test/mocks/event:event_mocks",
@@ -450,6 +473,7 @@ envoy_cc_test(
         "//bazel:linux": ["io_uring_socket_handle_impl_integration_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:default_socket_interface_lib",
         "//source/common/thread_local:thread_local_lib",
@@ -464,6 +488,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "win32_socket_handle_impl_test",
     srcs = ["win32_socket_handle_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:utility_lib",
@@ -477,6 +502,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "io_socket_handle_impl_integration_test",
     srcs = ["io_socket_handle_impl_integration_test.cc"],
+    rbe_pool = "2core",
     tags = ["requires-network"],
     deps = [
         "//source/common/common:utility_lib",
@@ -488,6 +514,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "transport_socket_options_impl_test",
     srcs = ["transport_socket_options_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:transport_socket_options_lib",
@@ -498,6 +525,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "win32_redirect_records_option_test",
     srcs = ["win32_redirect_records_option_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":socket_option_test",
         "//source/common/network:address_lib",
@@ -508,6 +536,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_matcher_test",
     srcs = ["filter_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:filter_matcher_lib",
@@ -524,6 +553,7 @@ envoy_cc_fuzz_test(
     name = "listener_filter_buffer_fuzz_test",
     srcs = ["listener_filter_buffer_fuzz_test.cc"],
     corpus = "listener_filter_buffer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":listener_filter_buffer_fuzz_proto_cc_proto",
         "//source/common/network:listener_filter_buffer_lib",
diff --git a/test/common/network/cidr_range_test.cc b/test/common/network/cidr_range_test.cc
index 8c31dfd267..d34e0738ba 100644
--- a/test/common/network/cidr_range_test.cc
+++ b/test/common/network/cidr_range_test.cc
@@ -12,17 +12,7 @@
 
 #include "gtest/gtest.h"
 
-// We are adding things into the std namespace.
-// Note that this is technically undefined behavior!
-namespace std {
-
-// Pair
-template <typename First, typename Second>
-std::ostream& operator<<(std::ostream& out, const std::pair<First, Second>& p) {
-  return out << '(' << p.first << ", " << p.second << ')';
-}
-
-} // namespace std
+using ::testing::PrintToString;
 
 namespace Envoy {
 
@@ -78,12 +68,12 @@ TEST(TruncateIpAddressAndLength, Various) {
     int length_io = kv.first.second;
     InstanceConstSharedPtr outPtr = CidrRange::truncateIpAddressAndLength(inPtr, &length_io);
     if (kv.second.second == -1) {
-      EXPECT_EQ(outPtr, nullptr) << outPtr->asString() << "\n" << kv;
-      EXPECT_EQ(length_io, -1) << kv;
+      EXPECT_EQ(outPtr, nullptr) << outPtr->asString() << "\n" << PrintToString(kv);
+      EXPECT_EQ(length_io, -1) << PrintToString(kv);
     } else {
-      ASSERT_NE(outPtr, nullptr) << kv;
-      EXPECT_EQ(outPtr->ip()->addressAsString(), kv.second.first) << kv;
-      EXPECT_EQ(length_io, kv.second.second) << kv;
+      ASSERT_NE(outPtr, nullptr) << PrintToString(kv);
+      EXPECT_EQ(outPtr->ip()->addressAsString(), kv.second.first) << PrintToString(kv);
+      EXPECT_EQ(length_io, kv.second.second) << PrintToString(kv);
     }
   }
 }
diff --git a/test/common/network/connection_impl_test.cc b/test/common/network/connection_impl_test.cc
index 11c769ead5..f5cc602f07 100644
--- a/test/common/network/connection_impl_test.cc
+++ b/test/common/network/connection_impl_test.cc
@@ -15,7 +15,6 @@
 #include "source/common/common/utility.h"
 #include "source/common/event/dispatcher_impl.h"
 #include "source/common/network/address_impl.h"
-#include "source/common/network/common_connection_filter_states.h"
 #include "source/common/network/connection_impl.h"
 #include "source/common/network/io_socket_handle_impl.h"
 #include "source/common/network/listen_socket_impl.h"
@@ -68,16 +67,6 @@ class MockInternalListenerManager : public InternalListenerManager {
   MOCK_METHOD(InternalListenerOptRef, findByAddress, (const Address::InstanceConstSharedPtr&), ());
 };
 
-class NoopConnectionExecutionContext : public ExecutionContext {
-public:
-  NoopConnectionExecutionContext() = default;
-  ~NoopConnectionExecutionContext() override = default;
-
-protected:
-  void activate() override {}
-  void deactivate() override {}
-};
-
 TEST(RawBufferSocket, TestBasics) {
   TransportSocketPtr raw_buffer_socket(Network::Test::createRawBufferSocket());
   EXPECT_FALSE(raw_buffer_socket->ssl());
@@ -348,27 +337,6 @@ TEST_P(ConnectionImplTest, SetSslConnection) {
   disconnect(false);
 }
 
-TEST_P(ConnectionImplTest, SetGetExecutionContextFilterState) {
-  setUpBasicConnection();
-  connect();
-
-  EXPECT_EQ(getConnectionExecutionContext(*client_connection_), nullptr);
-
-  const StreamInfo::FilterStateSharedPtr& filter_state =
-      client_connection_->streamInfo().filterState();
-  auto connection_execution_context = std::make_unique<NoopConnectionExecutionContext>();
-  const NoopConnectionExecutionContext* context_pointer =
-      connection_execution_context.get(); // Not owned.
-  auto filter_state_object = std::make_shared<ConnectionExecutionContextFilterState>(
-      std::move(connection_execution_context));
-  filter_state->setData(kConnectionExecutionContextFilterStateName, filter_state_object,
-                        StreamInfo::FilterState::StateType::ReadOnly,
-                        StreamInfo::FilterState::LifeSpan::Connection);
-
-  EXPECT_EQ(getConnectionExecutionContext(*client_connection_), context_pointer);
-  disconnect(true);
-}
-
 TEST_P(ConnectionImplTest, GetCongestionWindow) {
   setUpBasicConnection();
   connect();
diff --git a/test/common/network/dns_resolver/BUILD b/test/common/network/dns_resolver/BUILD
index 32199b9fcf..b32394a80b 100644
--- a/test/common/network/dns_resolver/BUILD
+++ b/test/common/network/dns_resolver/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "dns_factory_test",
     srcs = ["dns_factory_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network/dns_resolver:dns_factory_util_lib",
         "//source/extensions/network/dns_resolver/cares:config",
diff --git a/test/common/orca/BUILD b/test/common/orca/BUILD
index 35e25fc6b3..d67b92bdad 100644
--- a/test/common/orca/BUILD
+++ b/test/common/orca/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "orca_load_metrics_test",
     srcs = ["orca_load_metrics_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/orca:orca_load_metrics_lib",
         "//source/common/upstream:upstream_lib",
@@ -26,6 +27,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "orca_parser_test",
     srcs = ["orca_parser_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:base64_lib",
         "//source/common/orca:orca_parser",
diff --git a/test/common/protobuf/BUILD b/test/common/protobuf/BUILD
index c1fe7afdeb..ce98888be8 100644
--- a/test/common/protobuf/BUILD
+++ b/test/common/protobuf/BUILD
@@ -15,6 +15,7 @@ envoy_package()
 envoy_cc_test(
     name = "message_validator_impl_test",
     srcs = ["message_validator_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf:message_validator_lib",
         "//test/common/stats:stat_test_utility_lib",
@@ -31,6 +32,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "deterministic_hash_test",
     srcs = ["deterministic_hash_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":deterministic_hash_test_proto_cc_proto",
         "//source/common/protobuf:deterministic_hash_lib",
@@ -53,6 +55,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_test_protos_cc_proto",
         "//source/common/config:api_version_lib",
@@ -82,6 +85,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "proto_descriptor_test",
     srcs = ["proto_descriptor_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "@envoy_api//bazel/cc_proto_descriptor_library:create_dynamic_message",
         "@envoy_api//bazel/cc_proto_descriptor_library:text_format_transcoder",
@@ -94,6 +98,7 @@ envoy_cc_fuzz_test(
     name = "value_util_fuzz_test",
     srcs = ["value_util_fuzz_test.cc"],
     corpus = "value_util_corpus",
+    rbe_pool = "2core",
     # Fuzzer is stable, no bugs, simple test target; avoid emitting CO2.
     tags = ["no_fuzz"],
     deps = ["//source/common/protobuf:utility_lib"],
@@ -102,6 +107,7 @@ envoy_cc_fuzz_test(
 envoy_cc_benchmark_binary(
     name = "utility_speed_test",
     srcs = ["utility_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":deterministic_hash_test_proto_cc_proto",
         "//source/common/protobuf:utility_lib",
diff --git a/test/common/quic/BUILD b/test/common/quic/BUILD
index 0a4e8ad774..2f1c560192 100644
--- a/test/common/quic/BUILD
+++ b/test/common/quic/BUILD
@@ -15,6 +15,7 @@ envoy_package()
 envoy_cc_test(
     name = "envoy_quic_alarm_test",
     srcs = ["envoy_quic_alarm_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:envoy_quic_alarm_factory_lib",
@@ -29,6 +30,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_clock_test",
     srcs = ["envoy_quic_clock_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:envoy_quic_clock_lib",
@@ -41,6 +43,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_writer_test",
     srcs = ["envoy_quic_writer_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/network:io_socket_error_lib",
@@ -56,6 +59,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_proof_source_test",
     srcs = ["envoy_quic_proof_source_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_utils_lib",
@@ -76,6 +80,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "quic_filter_manager_connection_impl_test",
     srcs = ["quic_filter_manager_connection_impl_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:quic_filter_manager_connection_lib",
@@ -89,6 +94,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "quic_stat_names_test",
     srcs = ["quic_stat_names_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:quic_stat_names_lib",
@@ -101,6 +107,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_proof_verifier_test",
     srcs = ["envoy_quic_proof_verifier_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_utils_lib",
@@ -119,6 +126,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_server_stream_test",
     srcs = ["envoy_quic_server_stream_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_utils_lib",
@@ -141,6 +149,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_client_stream_test",
     srcs = ["envoy_quic_client_stream_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_utils_lib",
@@ -161,6 +170,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_server_session_test",
     srcs = ["envoy_quic_server_session_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_proof_source_lib",
@@ -189,6 +199,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_client_session_test",
     srcs = ["envoy_quic_client_session_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_utils_lib",
@@ -216,6 +227,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "active_quic_listener_test",
     srcs = ["active_quic_listener_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_proof_source_lib",
@@ -243,6 +255,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_dispatcher_test",
     srcs = ["envoy_quic_dispatcher_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":test_proof_source_lib",
@@ -291,6 +304,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "client_connection_factory_impl_test",
     srcs = ["client_connection_factory_impl_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/event:dispatcher_lib",
@@ -315,6 +329,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "quic_io_handle_wrapper_test",
     srcs = ["quic_io_handle_wrapper_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:quic_io_handle_wrapper_lib",
@@ -328,6 +343,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_utils_test",
     srcs = ["envoy_quic_utils_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:envoy_quic_utils_lib",
@@ -340,6 +356,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "envoy_quic_simulated_watermark_buffer_test",
     srcs = ["envoy_quic_simulated_watermark_buffer_test.cc"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = ["//source/common/quic:envoy_quic_simulated_watermark_buffer_lib"],
 )
@@ -372,6 +389,7 @@ envoy_cc_test(
     data = [
         "//test/common/tls/test_data:certs",
     ],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/quic:quic_server_transport_socket_factory_lib",
@@ -387,6 +405,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "http_datagram_handler_test",
     srcs = envoy_select_enable_http_datagrams(["http_datagram_handler_test.cc"]),
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = envoy_select_enable_http_datagrams([
         "//source/common/quic:http_datagram_handler",
@@ -427,6 +446,7 @@ envoy_cc_fuzz_test(
     name = "envoy_quic_h3_fuzz_test",
     srcs = ["envoy_quic_h3_fuzz_test.cc"],
     corpus = "envoy_quic_h3_fuzz_test_corpus",
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":envoy_quic_h3_fuzz_helper_lib",
diff --git a/test/common/quic/platform/BUILD b/test/common/quic/platform/BUILD
index dca484cd50..31003df3c5 100644
--- a/test/common/quic/platform/BUILD
+++ b/test/common/quic/platform/BUILD
@@ -23,6 +23,7 @@ envoy_cc_test(
         "//conditions:default": ["-Wno-unused-parameter"],
     }),
     data = ["//test/common/tls/test_data:certs"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/common/memory:stats_lib",
diff --git a/test/common/rds/BUILD b/test/common/rds/BUILD
index ff7b8aad24..a3e1b8932d 100644
--- a/test/common/rds/BUILD
+++ b/test/common/rds/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "rds_test",
     srcs = ["rds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/rds:rds_lib",
         "//test/mocks/server:instance_mocks",
diff --git a/test/common/router/BUILD b/test/common/router/BUILD
index af12e529b7..a0a542c96a 100644
--- a/test/common/router/BUILD
+++ b/test/common/router/BUILD
@@ -17,12 +17,14 @@ envoy_package()
 
 envoy_cc_test(
     name = "config_impl_test",
+    rbe_pool = "2core",
     deps = [":config_impl_test_lib"],
 )
 
 envoy_cc_test_library(
     name = "config_impl_test_lib",
     srcs = ["config_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":route_fuzz_proto_cc_proto",
         "//envoy/common:hashable_interface",
@@ -53,6 +55,7 @@ envoy_cc_test(
     srcs = [
         "config_impl_integration_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/common/router:config_lib",
@@ -65,6 +68,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "config_impl_headermap_benchmark_test",
     srcs = ["config_impl_headermap_benchmark_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/router:config_lib",
@@ -88,6 +92,7 @@ envoy_cc_fuzz_test(
     name = "header_parser_fuzz_test",
     srcs = ["header_parser_fuzz_test.cc"],
     corpus = "header_parser_corpus",
+    rbe_pool = "2core",
     deps = [
         ":header_parser_fuzz_proto_cc_proto",
         "//source/common/http:header_map_lib",
@@ -99,6 +104,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "reset_header_parser_test",
     srcs = ["reset_header_parser_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_utility_lib",
         "//source/common/router:reset_header_parser_lib",
@@ -111,6 +117,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "rds_impl_test",
     srcs = ["rds_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/common/http:rds_lib",
@@ -135,6 +142,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "scoped_config_impl_test",
     srcs = ["scoped_config_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:scoped_config_lib",
         "//test/mocks/router:router_mocks",
@@ -148,6 +156,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "scoped_rds_test",
     srcs = ["scoped_rds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:subscription_interface",
         "//envoy/init:manager_interface",
@@ -180,6 +189,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "vhds_test",
     srcs = ["vhds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/common/protobuf",
@@ -200,6 +210,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "retry_state_impl_test",
     srcs = ["retry_state_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/router:reset_header_parser_lib",
@@ -229,6 +240,7 @@ envoy_proto_library(
 # envoy_cc_test_binary is generating mostly static binary regardless of config
 envoy_cc_test_binary(
     name = "config_impl_test_static",
+    rbe_pool = "2core",
     deps = [
         ":config_impl_test_lib",
         "//test:main",
@@ -252,6 +264,10 @@ envoy_directory_genrule(
         "$(location corpus_from_config_impl_sh)",
         "$(location //test/common/router:config_impl_test_static)",
     ]),
+    exec_properties = select({
+        "//bazel:engflow_rbe": {"Pool": "2core"},
+        "//conditions:default": {},
+    }),
     tools = [":corpus_from_config_impl_sh"],
 )
 
@@ -274,6 +290,7 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["route_fuzz_test.cc"],
     corpus = ":route_corpus",
+    rbe_pool = "2core",
     # The :config_impl_test_static target does not build with coverage
     tags = ["nocoverage"],
     deps = [
@@ -288,6 +305,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "router_ratelimit_test",
     srcs = ["router_ratelimit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/protobuf:utility_lib",
@@ -309,6 +327,7 @@ envoy_cc_test(
         "router_test.cc",
         "router_2_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":router_test_base_lib",
         "//source/common/buffer:buffer_lib",
@@ -349,6 +368,7 @@ envoy_cc_test_library(
     name = "router_test_base_lib",
     srcs = ["router_test_base.cc"],
     hdrs = ["router_test_base.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:context_lib",
@@ -381,6 +401,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "router_upstream_log_test",
     srcs = ["router_upstream_log_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -411,6 +432,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "router_upstream_filter_test",
     srcs = ["router_upstream_filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/network:utility_lib",
@@ -440,6 +462,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "shadow_writer_impl_test",
     srcs = ["shadow_writer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:headers_lib",
         "//source/common/http:message_lib",
@@ -451,6 +474,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "header_formatter_test",
     srcs = ["header_formatter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:metadata_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -476,6 +500,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "string_accessor_impl_test",
     srcs = ["string_accessor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
     ],
@@ -484,6 +509,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "upstream_request_test",
     srcs = ["upstream_request_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:router_lib",
         "//test/common/http:common_lib",
@@ -497,6 +523,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "delegating_route_impl_test",
     srcs = ["delegating_route_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:config_lib",
         "//source/common/router:delegating_route_lib",
@@ -517,6 +544,7 @@ envoy_proto_library(
 envoy_cc_benchmark_binary(
     name = "config_impl_speed_test",
     srcs = ["config_impl_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/router:config_lib",
@@ -536,6 +564,7 @@ envoy_benchmark_test(
 envoy_cc_benchmark_binary(
     name = "header_formatter_speed_test",
     srcs = ["header_formatter_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:router_lib",
         "//test/common/stream_info:test_util",
diff --git a/test/common/router/router_test.cc b/test/common/router/router_test.cc
index 66417b457c..247dd89bf3 100644
--- a/test/common/router/router_test.cc
+++ b/test/common/router/router_test.cc
@@ -1251,6 +1251,9 @@ TEST_F(RouterTest, ResetDuringEncodeHeaders) {
               putResult(Upstream::Outlier::Result::LocalOriginConnectFailed, _))
       .Times(0);
   // The reset will be converted into a local reply.
+  EXPECT_CALL(callbacks_, sendLocalReply(Http::Code::ServiceUnavailable, testing::Eq(""), _, _,
+                                         "upstream_reset_before_response_started{remote_reset}"))
+      .WillOnce(InvokeWithoutArgs([] {}));
   router_->decodeHeaders(headers, true);
   EXPECT_EQ(1U,
             callbacks_.route_->virtual_host_.virtual_cluster_.stats().upstream_rq_total_.value());
@@ -6795,7 +6798,9 @@ TEST_F(RouterTest, OrcaLoadReport_NoConfiguredMetricNames) {
 class TestOrcaLoadReportCallbacks : public Filter::OrcaLoadReportCallbacks {
 public:
   MOCK_METHOD(absl::Status, onOrcaLoadReport,
-              (const xds::data::orca::v3::OrcaLoadReport& orca_load_report), (override));
+              (const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+               const Upstream::HostDescription&),
+              (override));
 };
 
 TEST_F(RouterTest, OrcaLoadReportCallbacks) {
@@ -6812,10 +6817,11 @@ TEST_F(RouterTest, OrcaLoadReportCallbacks) {
   router_->decodeHeaders(headers, true);
 
   // Configure ORCA callbacks to receive the report.
-  TestOrcaLoadReportCallbacks callbacks;
+  auto callbacks = std::make_shared<TestOrcaLoadReportCallbacks>();
   xds::data::orca::v3::OrcaLoadReport received_orca_load_report;
-  EXPECT_CALL(callbacks, onOrcaLoadReport(_))
-      .WillOnce(Invoke([&](const xds::data::orca::v3::OrcaLoadReport& orca_load_report) {
+  EXPECT_CALL(*callbacks, onOrcaLoadReport(_, _))
+      .WillOnce(Invoke([&](const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+                           const Upstream::HostDescription&) {
         received_orca_load_report = orca_load_report;
         return absl::OkStatus();
       }));
@@ -6863,10 +6869,11 @@ TEST_F(RouterTest, OrcaLoadReportCallbackReturnsError) {
   router_->decodeHeaders(headers, true);
 
   // Configure ORCA callbacks to receive the report.
-  TestOrcaLoadReportCallbacks callbacks;
+  auto callbacks = std::make_shared<TestOrcaLoadReportCallbacks>();
   xds::data::orca::v3::OrcaLoadReport received_orca_load_report;
-  EXPECT_CALL(callbacks, onOrcaLoadReport(_))
-      .WillOnce(Invoke([&](const xds::data::orca::v3::OrcaLoadReport& orca_load_report) {
+  EXPECT_CALL(*callbacks, onOrcaLoadReport(_, _))
+      .WillOnce(Invoke([&](const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+                           const Upstream::HostDescription&) {
         received_orca_load_report = orca_load_report;
         // Return an error that gets logged by router filter.
         return absl::InvalidArgumentError("Unexpected ORCA load Report");
@@ -6901,8 +6908,8 @@ TEST_F(RouterTest, OrcaLoadReportInvalidHeaderValue) {
 
   // Configure ORCA callbacks to receive the report, but don't expect it to be
   // called for invalid orca header.
-  TestOrcaLoadReportCallbacks callbacks;
-  EXPECT_CALL(callbacks, onOrcaLoadReport(_)).Times(0);
+  auto callbacks = std::make_shared<TestOrcaLoadReportCallbacks>();
+  EXPECT_CALL(*callbacks, onOrcaLoadReport(_, _)).Times(0);
   router_->setOrcaLoadReportCallbacks(callbacks);
 
   // Send report with invalid ORCA proto.
diff --git a/test/common/runtime/BUILD b/test/common/runtime/BUILD
index 1ae7c0b4a9..02d659e114 100644
--- a/test/common/runtime/BUILD
+++ b/test/common/runtime/BUILD
@@ -19,6 +19,7 @@ filegroup(
 envoy_cc_test(
     name = "runtime_protos_test",
     srcs = ["runtime_protos_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/runtime:runtime_lib",
         "//test/mocks/runtime:runtime_mocks",
@@ -32,6 +33,7 @@ envoy_cc_test(
     name = "runtime_impl_test",
     srcs = ["runtime_impl_test.cc"],
     data = glob(["test_data/**"]) + ["filesystem_setup.sh"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:runtime_utility_lib",
         "//source/common/runtime:runtime_lib",
@@ -66,6 +68,7 @@ envoy_cc_test(
         "--runtime-feature-disable-for-tests=envoy.reloadable_features.test_feature_true",
     ],
     coverage = False,
+    rbe_pool = "2core",
     deps = [
         "//source/common/runtime:runtime_lib",
     ],
@@ -79,6 +82,7 @@ envoy_cc_test(
         "--runtime-feature-disable-for-tests=envoy.reloadable_features.test_feature_false",
     ],
     coverage = False,
+    rbe_pool = "2core",
     deps = [
         "//source/common/runtime:runtime_lib",
     ],
diff --git a/test/common/secret/BUILD b/test/common/secret/BUILD
index 1dc9ddf8bc..38f9cbda73 100644
--- a/test/common/secret/BUILD
+++ b/test/common/secret/BUILD
@@ -20,6 +20,7 @@ envoy_cc_test(
     data = [
         "//test/common/tls/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":private_key_provider_proto_cc_proto",
         "//source/common/secret:sds_api_lib",
@@ -47,6 +48,7 @@ envoy_cc_test(
     data = [
         "//test/common/tls/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/secret:sds_api_lib",
         "//source/common/ssl:certificate_validation_context_config_impl_lib",
diff --git a/test/common/shared_pool/BUILD b/test/common/shared_pool/BUILD
index f4eaecda80..a100079231 100644
--- a/test/common/shared_pool/BUILD
+++ b/test/common/shared_pool/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "shared_pool_test",
     srcs = ["shared_pool_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:timer_lib",
         "//source/common/shared_pool:shared_pool_lib",
diff --git a/test/common/signal/BUILD b/test/common/signal/BUILD
index 5bd423ea99..08830d2e22 100644
--- a/test/common/signal/BUILD
+++ b/test/common/signal/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "signals_test",
     srcs = ["signals_test.cc"],
+    rbe_pool = "2core",
     # Posix signal tests are irrelevant to Windows
     tags = [
         "backtrace",
@@ -27,6 +28,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "fatal_action_test",
     srcs = ["fatal_action_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/signal:fatal_error_handler_lib",
         "//test/mocks/server:instance_mocks",
diff --git a/test/common/singleton/BUILD b/test/common/singleton/BUILD
index cd5e582a5e..ec8ed5b701 100644
--- a/test/common/singleton/BUILD
+++ b/test/common/singleton/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "manager_impl_test",
     srcs = ["manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/singleton:manager_impl_lib",
         "//test/test_common:utility_lib",
@@ -20,6 +21,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "threadsafe_singleton_test",
     srcs = ["threadsafe_singleton_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:thread_lib",
         "//source/common/singleton:threadsafe_singleton",
diff --git a/test/common/ssl/matching/BUILD b/test/common/ssl/matching/BUILD
index da634091d2..06cd92a4cd 100644
--- a/test/common/ssl/matching/BUILD
+++ b/test/common/ssl/matching/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "inputs_test",
     srcs = ["inputs_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/matching:data_impl_lib",
         "//source/common/network:address_lib",
@@ -24,6 +25,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "inputs_integration_test",
     srcs = ["inputs_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/matching:data_impl_lib",
         "//source/common/network/matching:data_impl_lib",
diff --git a/test/common/stats/BUILD b/test/common/stats/BUILD
index 7218abb28a..d072c018d4 100644
--- a/test/common/stats/BUILD
+++ b/test/common/stats/BUILD
@@ -15,6 +15,7 @@ envoy_package()
 envoy_cc_test(
     name = "allocator_impl_test",
     srcs = ["allocator_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:allocator_lib",
         "//test/test_common:logging_lib",
@@ -25,6 +26,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "custom_stat_namespaces_impl_test",
     srcs = ["custom_stat_namespaces_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:custom_stat_namespaces_lib",
     ],
@@ -33,6 +35,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "isolated_store_impl_test",
     srcs = ["isolated_store_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
     ],
@@ -41,6 +44,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "histogram_impl_test",
     srcs = ["histogram_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:histogram_lib",
         "//test/mocks/server:server_factory_context_mocks",
@@ -51,6 +55,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metric_impl_test",
     srcs = ["metric_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:allocator_lib",
         "//source/common/stats:utility_lib",
@@ -61,6 +66,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "recent_lookups_test",
     srcs = ["recent_lookups_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/stats:recent_lookups_lib",
@@ -72,6 +78,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "recent_lookups_benchmark",
     srcs = ["recent_lookups_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:random_generator_lib",
         "//source/common/common:utility_lib",
@@ -89,6 +96,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "stat_merger_test",
     srcs = ["stat_merger_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/stats:isolated_store_lib",
@@ -128,6 +136,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "stat_test_utility_test",
     srcs = ["stat_test_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/stats:isolated_store_lib",
@@ -137,6 +146,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stats_matcher_impl_test",
     srcs = ["stats_matcher_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/memory:stats_lib",
         "//source/common/stats:stats_matcher_lib",
@@ -150,12 +160,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "refcount_ptr_test",
     srcs = ["refcount_ptr_test.cc"],
+    rbe_pool = "2core",
     deps = ["//envoy/stats:refcount_ptr_interface"],
 )
 
 envoy_cc_test(
     name = "symbol_table_impl_test",
     srcs = ["symbol_table_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/common:mutex_tracer_lib",
@@ -173,6 +185,7 @@ envoy_cc_fuzz_test(
     name = "stat_merger_fuzz_test",
     srcs = ["stat_merger_fuzz_test.cc"],
     corpus = "stat_merger_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/stats:symbol_table_lib",
@@ -184,6 +197,7 @@ envoy_cc_fuzz_test(
     name = "symbol_table_fuzz_test",
     srcs = ["symbol_table_fuzz_test.cc"],
     corpus = "symbol_table_corpus",
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -197,6 +211,7 @@ envoy_cc_fuzz_test(
     name = "utility_fuzz_test",
     srcs = ["utility_fuzz_test.cc"],
     corpus = "utility_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:utility_lib",
     ],
@@ -213,6 +228,7 @@ envoy_cc_benchmark_binary(
         "make_elements_helper.cc",
         "symbol_table_speed_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":make_elements_helper_lib",
         ":stat_test_utility_lib",
@@ -232,6 +248,7 @@ envoy_cc_benchmark_binary(
 envoy_cc_test(
     name = "deferred_creation_stats_test",
     srcs = ["deferred_creation_stats_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/stats:stats_interface",
         "//source/common/memory:stats_lib",
@@ -244,6 +261,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "deferred_creation_stats_benchmark",
     srcs = ["deferred_creation_stats_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":real_thread_test_base",
         "//source/common/common:random_generator_lib",
@@ -273,6 +291,7 @@ envoy_cc_benchmark_binary(
     srcs = [
         "stats_matcher_impl_speed_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/memory:stats_lib",
         "//source/common/stats:stats_matcher_lib",
@@ -294,6 +313,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "tag_extractor_impl_test",
     srcs = ["tag_extractor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:tag_extractor_lib",
         "//source/common/stats:tag_producer_lib",
@@ -305,6 +325,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "tag_producer_impl_test",
     srcs = ["tag_producer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:tag_producer_lib",
         "//test/test_common:utility_lib",
@@ -317,6 +338,7 @@ envoy_cc_benchmark_binary(
     srcs = [
         "tag_extractor_impl_speed_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:tag_producer_lib",
         "@com_github_google_benchmark//:benchmark",
@@ -332,6 +354,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "thread_local_store_test",
     srcs = ["thread_local_store_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":real_thread_test_base",
         ":stat_test_utility_lib",
@@ -356,6 +379,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "thread_local_store_speed_test",
     srcs = ["thread_local_store_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/common:thread_lib",
@@ -381,6 +405,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stat_test_utility_lib",
         "//source/common/stats:isolated_store_lib",
diff --git a/test/common/stream_info/BUILD b/test/common/stream_info/BUILD
index 89795b60e0..0f37c52e0e 100644
--- a/test/common/stream_info/BUILD
+++ b/test/common/stream_info/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "filter_state_impl_test",
     srcs = ["filter_state_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:filter_state_lib",
         "//test/test_common:utility_lib",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stream_info_impl_test",
     srcs = ["stream_info_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_int_accessor_lib",
         "//envoy/http:protocol_interface",
@@ -63,6 +65,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:utility_lib",
         "//test/mocks/stream_info:stream_info_mocks",
@@ -74,6 +77,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "uint32_accessor_impl_test",
     srcs = ["uint32_accessor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:uint32_accessor_lib",
     ],
@@ -82,6 +86,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "uint64_accessor_impl_test",
     srcs = ["uint64_accessor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:uint64_accessor_lib",
     ],
@@ -90,6 +95,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "bool_accessor_impl_test",
     srcs = ["bool_accessor_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:bool_accessor_lib",
     ],
diff --git a/test/common/tcp/BUILD b/test/common/tcp/BUILD
index e9aefe73fa..3da91d29ba 100644
--- a/test/common/tcp/BUILD
+++ b/test/common/tcp/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "conn_pool_test",
     srcs = ["conn_pool_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/network:utility_lib",
@@ -33,6 +34,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "async_tcp_client_impl_test",
     srcs = ["async_tcp_client_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:utility_lib",
         "//source/common/tcp:async_tcp_client_lib",
diff --git a/test/common/tcp_proxy/BUILD b/test/common/tcp_proxy/BUILD
index 74a766be73..060255c1fa 100644
--- a/test/common/tcp_proxy/BUILD
+++ b/test/common/tcp_proxy/BUILD
@@ -53,6 +53,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":tcp_proxy_test_base",
         "//envoy/common:hashable_interface",
@@ -64,6 +65,7 @@ envoy_cc_test(
     srcs = [
         "tcp_proxy_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":tcp_proxy_test_base",
         "@envoy_api//envoy/config/accesslog/v3:pkg_cc_proto",
@@ -77,6 +79,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "upstream_test",
     srcs = ["upstream_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/tcp_proxy",
diff --git a/test/common/thread_local/BUILD b/test/common/thread_local/BUILD
index 725568bc51..e42e5574ea 100644
--- a/test/common/thread_local/BUILD
+++ b/test/common/thread_local/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "thread_local_impl_test",
     srcs = ["thread_local_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/event:dispatcher_lib",
diff --git a/test/common/tls/BUILD b/test/common/tls/BUILD
index 6e2dc3207d..69b1bc9e60 100644
--- a/test/common/tls/BUILD
+++ b/test/common/tls/BUILD
@@ -30,6 +30,7 @@ envoy_cc_test(
         "//test/common/tls/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_certs_test_lib",
         ":test_private_key_method_provider_test_lib",
@@ -89,6 +90,7 @@ envoy_cc_test(
         "//test/common/tls/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_certs_test_lib",
         ":test_private_key_method_provider_test_lib",
@@ -143,6 +145,7 @@ envoy_cc_test(
         "//test/common/tls/ocsp/test_data:certs",
         "//test/common/tls/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "ssl_certs_test_lib",
         ":ssl_test_utils",
@@ -173,6 +176,7 @@ envoy_cc_test(
     name = "io_handle_bio_test",
     srcs = ["io_handle_bio_test.cc"],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_test_utils",
         "//source/common/tls:ssl_socket_lib",
@@ -189,6 +193,7 @@ envoy_cc_test(
         "//test/common/tls/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_test_utils",
         "//source/common/tls:utility_lib",
@@ -238,6 +243,7 @@ envoy_cc_test(
         "//test/common/tls/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_socket_test",
         ":ssl_test_utils",
@@ -256,6 +262,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "handshaker_factory_test",
     srcs = ["handshaker_factory_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":ssl_test_utils",
         "//source/common/stream_info:stream_info_lib",
@@ -283,6 +290,7 @@ envoy_cc_benchmark_binary(
         "//test/common/tls/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     # Uses raw POSIX syscalls, does not build on Windows.
     tags = ["skip_on_windows"],
     deps = [
diff --git a/test/common/tls/cert_validator/BUILD b/test/common/tls/cert_validator/BUILD
index 76c9d63dc8..9c63cf28a9 100644
--- a/test/common/tls/cert_validator/BUILD
+++ b/test/common/tls/cert_validator/BUILD
@@ -17,6 +17,7 @@ envoy_cc_test(
     data = [
         "//test/common/tls/test_data:certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tls/cert_validator:cert_validator_lib",
         "//test/common/tls:ssl_test_utils",
@@ -32,6 +33,7 @@ envoy_cc_test(
     srcs = [
         "factory_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tls/cert_validator:cert_validator_lib",
         "//test/common/tls/cert_validator:test_common",
@@ -54,6 +56,7 @@ envoy_cc_test(
     srcs = [
         "san_matcher_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf:utility_lib",
         "//source/common/tls/cert_validator:cert_validator_lib",
@@ -78,6 +81,7 @@ envoy_cc_test(
         "//test/common/tls/test_data:certs",
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":default_validator_integration_test_lib",
         "//test/integration:http_integration_lib",
diff --git a/test/common/tls/integration/BUILD b/test/common/tls/integration/BUILD
index 66ff5b4592..4514cd82f2 100644
--- a/test/common/tls/integration/BUILD
+++ b/test/common/tls/integration/BUILD
@@ -15,6 +15,7 @@ envoy_cc_test_library(
         "ssl_integration_test_base.cc",
     ],
     hdrs = ["ssl_integration_test_base.h"],
+    rbe_pool = "2core",
     deps = [
         "//test/common/config:dummy_config_proto_cc_proto",
         "//test/integration:http_integration_lib",
@@ -32,6 +33,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":sni_to_header_filter_lib",
         ":ssl_integration_test_lib",
diff --git a/test/common/tls/ocsp/BUILD b/test/common/tls/ocsp/BUILD
index 369cdbf86d..23a7393ed9 100644
--- a/test/common/tls/ocsp/BUILD
+++ b/test/common/tls/ocsp/BUILD
@@ -17,6 +17,7 @@ envoy_cc_test(
         "//test/common/tls/ocsp/test_data:certs",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/filesystem:filesystem_lib",
         "//source/common/tls:utility_lib",
@@ -35,6 +36,7 @@ envoy_cc_test(
         "asn1_utility_test.cc",
     ],
     external_deps = ["ssl"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tls/ocsp:asn1_utility_lib",
         "//test/common/tls:ssl_test_utils",
diff --git a/test/common/tracing/BUILD b/test/common/tracing/BUILD
index 84911ca506..6549c8e190 100644
--- a/test/common/tracing/BUILD
+++ b/test/common/tracing/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "http_tracer_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:base64_lib",
         "//source/common/http:header_map_lib",
@@ -41,6 +42,7 @@ envoy_cc_test(
     srcs = [
         "tracer_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/tracing:custom_tag_lib",
@@ -63,6 +65,7 @@ envoy_cc_test(
     srcs = [
         "tracer_manager_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tracing:tracer_config_lib",
         "//source/common/tracing:tracer_lib",
@@ -80,6 +83,7 @@ envoy_cc_test(
     srcs = [
         "tracer_config_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tracing:tracer_config_lib",
     ],
@@ -90,6 +94,7 @@ envoy_cc_test(
     srcs = [
         "trace_context_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tracing:http_tracer_lib",
         "//source/common/tracing:trace_context_lib",
diff --git a/test/common/upstream/BUILD b/test/common/upstream/BUILD
index 216aca1bac..a65b0d0c26 100644
--- a/test/common/upstream/BUILD
+++ b/test/common/upstream/BUILD
@@ -16,6 +16,7 @@ envoy_package()
 envoy_cc_test(
     name = "od_cds_api_impl_test",
     srcs = ["od_cds_api_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:subscription_interface",
         "//source/common/stats:isolated_store_lib",
@@ -30,6 +31,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "cds_api_impl_test",
     srcs = ["cds_api_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/config:utility_lib",
@@ -49,6 +51,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "cluster_discovery_manager_test",
     srcs = ["cluster_discovery_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:cluster_manager_interface",
         "//source/common/common:cleanup_lib",
@@ -60,6 +63,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "deferred_cluster_initialization_test",
     srcs = ["deferred_cluster_initialization_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_cluster_manager",
         "//envoy/upstream:cluster_manager_interface",
@@ -83,6 +87,7 @@ envoy_cc_test(
     name = "cluster_manager_impl_test",
     size = "large",
     srcs = ["cluster_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":test_cluster_manager",
         "//source/common/router:context_lib",
@@ -130,6 +135,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "cluster_update_tracker_test",
     srcs = ["cluster_update_tracker_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:cluster_update_tracker_lib",
         "//test/mocks/upstream:cluster_manager_mocks",
@@ -140,6 +146,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "conn_pool_map_impl_test",
     srcs = ["conn_pool_map_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:conn_pool_interface",
         "//source/common/upstream:conn_pool_map_impl_lib",
@@ -154,6 +161,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "wrsq_scheduler_test",
     srcs = ["wrsq_scheduler_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:scheduler_lib",
         "//test/mocks:common_lib",
@@ -163,6 +171,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "edf_scheduler_test",
     srcs = ["edf_scheduler_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:scheduler_lib",
         "//test/test_common:utility_lib",
@@ -177,6 +186,7 @@ envoy_cc_test_library(
     hdrs = [
         "health_check_fuzz_test_utils.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/extensions/health_checkers/grpc:health_checker_lib",
@@ -197,6 +207,7 @@ envoy_cc_test(
     srcs = [
         "health_checker_impl_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/buffer:buffer_lib",
@@ -239,6 +250,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "host_stats_test",
     srcs = ["host_stats_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:host_description_interface",
     ],
@@ -247,6 +259,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "host_utility_test",
     srcs = ["host_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/network:utility_lib",
@@ -264,6 +277,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "load_balancer_context_base_test",
     srcs = ["load_balancer_context_base_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:load_balancer_context_base_lib",
         "//test/mocks/upstream:host_mocks",
@@ -274,6 +288,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "load_balancer_simulation_test",
     srcs = ["load_balancer_simulation_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/common:random_generator_lib",
@@ -298,6 +313,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "load_stats_reporter_test",
     srcs = ["load_stats_reporter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:stats_lib",
         "//source/common/upstream:load_stats_reporter_lib",
@@ -317,6 +333,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hds_test",
     srcs = ["hds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/tls:context_lib",
         "//source/common/upstream:health_discovery_service_lib",
@@ -349,6 +366,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "outlier_detection_impl_test",
     srcs = ["outlier_detection_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//envoy/common:time_interface",
@@ -376,6 +394,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "priority_conn_pool_map_impl_test",
     srcs = ["priority_conn_pool_map_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:conn_pool_interface",
         "//source/common/upstream:priority_conn_pool_map_impl_lib",
@@ -390,6 +409,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "resource_manager_impl_test",
     srcs = ["resource_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:upstream_interface",
         "//source/common/upstream:resource_manager_lib",
@@ -401,6 +421,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "transport_socket_matcher_test",
     srcs = ["transport_socket_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/api:api_interface",
         "//source/common/config:metadata_lib",
@@ -421,6 +442,7 @@ envoy_cc_test(
     name = "upstream_impl_test",
     srcs = ["upstream_impl_test.cc"],
     data = ["//test/common/tls/test_data:certs"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         ":test_local_address_selector",
@@ -537,6 +559,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "cluster_factory_impl_test",
     srcs = ["cluster_factory_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//envoy/api:api_interface",
@@ -573,6 +596,7 @@ envoy_cc_test_library(
     name = "health_check_fuzz_lib",
     srcs = ["health_check_fuzz.cc"],
     hdrs = ["health_check_fuzz.h"],
+    rbe_pool = "2core",
     deps = [
         ":health_check_fuzz_proto_cc_proto",
         ":health_check_fuzz_utils_lib",
@@ -594,6 +618,7 @@ envoy_cc_fuzz_test(
     name = "health_check_fuzz_test",
     srcs = ["health_check_fuzz_test.cc"],
     corpus = "health_check_corpus",
+    rbe_pool = "2core",
     deps = [
         ":health_check_fuzz_lib",
         ":health_check_fuzz_proto_cc_proto",
@@ -615,6 +640,7 @@ envoy_cc_test(
     name = "default_local_address_selector_test",
     size = "small",
     srcs = ["default_local_address_selector_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:base_includes",
         "//envoy/network:socket_interface",
@@ -630,6 +656,7 @@ envoy_cc_test(
     name = "local_address_selector_integration_test",
     size = "large",
     srcs = ["local_address_selector_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "test_local_address_selector",
         "//source/extensions/load_balancing_policies/round_robin:config",
diff --git a/test/common/upstream/upstream_impl_test.cc b/test/common/upstream/upstream_impl_test.cc
index 034c6fdefa..38917ad1be 100644
--- a/test/common/upstream/upstream_impl_test.cc
+++ b/test/common/upstream/upstream_impl_test.cc
@@ -1629,17 +1629,17 @@ TEST_F(HostImplTest, Weight) {
 TEST_F(HostImplTest, HostLbPolicyData) {
   MockClusterMockPrioritySet cluster;
   HostSharedPtr host = makeTestHost(cluster.info_, "tcp://10.0.0.1:1234", simTime(), 1);
-  EXPECT_TRUE(host->lbPolicyData() == nullptr);
+  EXPECT_TRUE(!host->lbPolicyData().has_value());
 
   class TestLbPolicyData : public Host::HostLbPolicyData {
   public:
     int foo = 42;
   };
 
-  host->setLbPolicyData(std::make_shared<TestLbPolicyData>());
-  EXPECT_TRUE(host->lbPolicyData() != nullptr);
-  auto* test_policy_data = dynamic_cast<TestLbPolicyData*>(host->lbPolicyData().get());
-  EXPECT_TRUE(test_policy_data != nullptr);
+  host->setLbPolicyData(std::make_unique<TestLbPolicyData>());
+  EXPECT_TRUE(host->lbPolicyData().has_value());
+  auto test_policy_data = host->typedLbPolicyData<TestLbPolicyData>();
+  EXPECT_TRUE(test_policy_data.has_value());
   EXPECT_EQ(test_policy_data->foo, 42);
 }
 
diff --git a/test/common/watchdog/BUILD b/test/common/watchdog/BUILD
index aed829e57a..03137027cc 100644
--- a/test/common/watchdog/BUILD
+++ b/test/common/watchdog/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "abort_action_test",
     srcs = ["abort_action_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:time_interface",
         "//envoy/registry",
@@ -28,6 +29,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "abort_action_config_test",
     srcs = ["abort_action_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//envoy/server:guarddog_config_interface",
diff --git a/test/common/websocket/BUILD b/test/common/websocket/BUILD
index 9a70da66da..55734055f2 100644
--- a/test/common/websocket/BUILD
+++ b/test/common/websocket/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "codec_test",
     srcs = ["codec_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/websocket:codec_lib",
diff --git a/test/config_test/BUILD b/test/config_test/BUILD
index 451b352062..614f5e94df 100644
--- a/test/config_test/BUILD
+++ b/test/config_test/BUILD
@@ -40,6 +40,7 @@ envoy_cc_test(
         "EXAMPLE_CONFIGS_TAR_PATH": "envoy/configs/example_configs.tar",
         "GODEBUG": "cgocheck=0",
     },
+    rbe_pool = "2core",
     deps = [
         ":example_configs_test_lib",
     ],
@@ -49,6 +50,7 @@ envoy_cc_test_library(
     name = "config_test_lib",
     srcs = ["config_test.cc"],
     hdrs = ["config_test.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/protobuf:utility_lib",
diff --git a/test/dependencies/BUILD b/test/dependencies/BUILD
index 688fedc331..421e043078 100644
--- a/test/dependencies/BUILD
+++ b/test/dependencies/BUILD
@@ -12,4 +12,5 @@ envoy_cc_test(
     name = "curl_test",
     srcs = ["curl_test.cc"],
     external_deps = ["curl"],
+    rbe_pool = "2core",
 )
diff --git a/test/exe/BUILD b/test/exe/BUILD
index b95678f697..cd396dbf4f 100644
--- a/test/exe/BUILD
+++ b/test/exe/BUILD
@@ -68,6 +68,7 @@ envoy_cc_test_library(
     data = [
         "//test/config/integration:google_com_proxy_port_0",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/stats:isolated_store_lib",
@@ -87,6 +88,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration:google_com_proxy_port_0",
     ],
+    rbe_pool = "2core",
     deps = envoy_select_admin_functionality([":main_common_test_base_lib"]) + [
         "//source/common/api:api_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -105,6 +107,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration:google_com_proxy_port_0",
     ],
+    rbe_pool = "2core",
     deps = envoy_select_admin_functionality([":main_common_test_base_lib"]) + [
         "//source/common/api:api_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -121,6 +124,7 @@ envoy_cc_test(
     name = "extra_extensions_test",
     size = "large",
     srcs = ["extra_extensions_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/test_common:environment_lib",
     ] + select({
@@ -134,6 +138,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "terminate_handler_test",
     srcs = ["terminate_handler_test.cc"],
+    rbe_pool = "2core",
     tags = ["backtrace"],
     deps = [
         "//source/exe:terminate_handler_lib",
@@ -148,6 +153,7 @@ envoy_cc_test(
     data = [
         "//source/extensions:extensions_metadata.yaml",
     ],
+    rbe_pool = "2core",
     deps = [
         "//test/test_common:environment_lib",
     ] + select({
@@ -166,6 +172,7 @@ envoy_cc_test(
         "//source/exe:envoy-static",
         "//test/config/integration:google_com_proxy_port_0",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/exe:envoy_main_common_with_core_extensions_lib",
@@ -201,6 +208,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "platform_impl_test",
     srcs = ["platform_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/exe:platform_impl_lib",
         "//test/mocks/runtime:runtime_mocks",
diff --git a/test/extensions/access_loggers/common/BUILD b/test/extensions/access_loggers/common/BUILD
index f9e366e6d1..90f00365ad 100644
--- a/test/extensions/access_loggers/common/BUILD
+++ b/test/extensions/access_loggers/common/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "access_log_base_test",
     srcs = ["access_log_base_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/common:access_log_base",
         "//test/mocks/access_log:access_log_mocks",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "grpc_access_logger_test",
     srcs = ["grpc_access_logger_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/access_loggers/common:grpc_access_logger",
diff --git a/test/extensions/access_loggers/file/BUILD b/test/extensions/access_loggers/file/BUILD
index ddefcf35bb..5d49c6f0e1 100644
--- a/test/extensions/access_loggers/file/BUILD
+++ b/test/extensions/access_loggers/file/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.access_loggers.file"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/access_loggers/file:config",
diff --git a/test/extensions/access_loggers/fluentd/BUILD b/test/extensions/access_loggers/fluentd/BUILD
index a8a4d9acad..4d7c00e708 100644
--- a/test/extensions/access_loggers/fluentd/BUILD
+++ b/test/extensions/access_loggers/fluentd/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "fluentd_access_log_impl_test",
     srcs = ["fluentd_access_log_impl_test.cc"],
     extension_names = ["envoy.access_loggers.fluentd"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/fluentd:config",
         "//test/mocks/server:factory_context_mocks",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     name = "substitution_formatter_test",
     srcs = ["substitution_formatter_test.cc"],
     extension_names = ["envoy.access_loggers.fluentd"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/access_loggers/fluentd:substitution_formatter_lib",
@@ -44,6 +46,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["fluentd_access_log_integration_test.cc"],
     extension_names = ["envoy.access_loggers.fluentd"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/fluentd:config",
         "//source/extensions/filters/network/tcp_proxy:config",
diff --git a/test/extensions/access_loggers/grpc/BUILD b/test/extensions/access_loggers/grpc/BUILD
index c755d06998..395067adc6 100644
--- a/test/extensions/access_loggers/grpc/BUILD
+++ b/test/extensions/access_loggers/grpc/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "grpc_access_log_impl_test",
     srcs = ["grpc_access_log_impl_test.cc"],
     extension_names = ["envoy.access_loggers.http_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/extensions/access_loggers/grpc:http_grpc_access_log_lib",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.access_loggers.http_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/grpc:grpc_access_log_utils",
         "//test/mocks/local_info:local_info_mocks",
@@ -57,6 +59,7 @@ envoy_extension_cc_test(
     name = "http_grpc_access_log_impl_test",
     srcs = ["http_grpc_access_log_impl_test.cc"],
     extension_names = ["envoy.access_loggers.http_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/common/stream_info:uint32_accessor_lib",
@@ -76,6 +79,7 @@ envoy_extension_cc_test(
     name = "http_config_test",
     srcs = ["http_config_test.cc"],
     extension_names = ["envoy.access_loggers.http_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/grpc:http_config",
         "//test/mocks/server:factory_context_mocks",
@@ -89,6 +93,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["http_grpc_access_log_integration_test.cc"],
     extension_names = ["envoy.access_loggers.http_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/grpc:codec_lib",
@@ -108,6 +113,7 @@ envoy_extension_cc_test(
     name = "tcp_config_test",
     srcs = ["tcp_config_test.cc"],
     extension_names = ["envoy.access_loggers.tcp_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/grpc:tcp_config",
         "//test/mocks/server:factory_context_mocks",
@@ -127,6 +133,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.access_loggers.tcp_grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/grpc:codec_lib",
diff --git a/test/extensions/access_loggers/open_telemetry/BUILD b/test/extensions/access_loggers/open_telemetry/BUILD
index 0e7ddef73e..9aecc06273 100644
--- a/test/extensions/access_loggers/open_telemetry/BUILD
+++ b/test/extensions/access_loggers/open_telemetry/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "grpc_access_log_impl_test",
     srcs = ["grpc_access_log_impl_test.cc"],
     extension_names = ["envoy.access_loggers.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/protobuf",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
     name = "access_log_impl_test",
     srcs = ["access_log_impl_test.cc"],
     extension_names = ["envoy.access_loggers.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:time_interface",
         "//source/common/formatter:formatter_extension_lib",
@@ -59,6 +61,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.access_loggers.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/access_loggers/open_telemetry:access_log_lib",
@@ -74,6 +77,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["access_log_integration_test.cc"],
     extension_names = ["envoy.access_loggers.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -101,6 +105,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.access_loggers.open_telemetry"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/formatter:formatter_extension_lib",
@@ -130,6 +135,7 @@ envoy_extension_cc_test(
 envoy_cc_benchmark_binary(
     name = "substitution_formatter_speed_test",
     srcs = ["substitution_formatter_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/http:header_map_lib",
diff --git a/test/extensions/access_loggers/stream/BUILD b/test/extensions/access_loggers/stream/BUILD
index 723a21ce54..e3115e6248 100644
--- a/test/extensions/access_loggers/stream/BUILD
+++ b/test/extensions/access_loggers/stream/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "stdout_config_test",
     srcs = ["stdout_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stream_test_base",
         "//source/common/formatter:formatter_extension_lib",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stderr_config_test",
     srcs = ["stderr_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":stream_test_base",
         "//source/common/formatter:formatter_extension_lib",
diff --git a/test/extensions/access_loggers/wasm/BUILD b/test/extensions/access_loggers/wasm/BUILD
index bb463c360c..04f3c66840 100644
--- a/test/extensions/access_loggers/wasm/BUILD
+++ b/test/extensions/access_loggers/wasm/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
         "//test/extensions/access_loggers/wasm/test_data:test_cpp.wasm",
     ]),
     extension_names = ["envoy.access_loggers.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/access_loggers/wasm:config",
diff --git a/test/extensions/bootstrap/internal_listener/BUILD b/test/extensions/bootstrap/internal_listener/BUILD
index 0ddc7fec65..ce3e3d2d0f 100644
--- a/test/extensions/bootstrap/internal_listener/BUILD
+++ b/test/extensions/bootstrap/internal_listener/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "client_connection_factory_test",
     srcs = ["client_connection_factory_test.cc"],
     extension_names = ["envoy.bootstrap.internal_listener"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/network:address_lib",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["internal_listener_registry_test.cc"],
     extension_names = ["envoy.bootstrap.internal_listener"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/bootstrap/internal_listener:config",
         "//test/mocks/thread_local:thread_local_mocks",
@@ -43,6 +45,7 @@ envoy_extension_cc_test(
         "internal_listener_integration_test.cc",
     ],
     extension_names = ["envoy.bootstrap.internal_listener"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:api_version_lib",
         "//source/common/event:dispatcher_includes",
@@ -71,6 +74,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["active_internal_listener_test.cc"],
     extension_names = ["envoy.bootstrap.internal_listener"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/listener_manager:connection_handler_lib",
         "//source/common/network:address_lib",
diff --git a/test/extensions/bootstrap/wasm/BUILD b/test/extensions/bootstrap/wasm/BUILD
index 5efd44307b..29d0e7a1ee 100644
--- a/test/extensions/bootstrap/wasm/BUILD
+++ b/test/extensions/bootstrap/wasm/BUILD
@@ -31,6 +31,7 @@ envoy_extension_cc_test(
         "//test/extensions/bootstrap/wasm/test_data:logging_rust.wasm",
     ]),
     extension_names = ["envoy.bootstrap.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/event:dispatcher_lib",
@@ -56,6 +57,7 @@ envoy_extension_cc_test(
         "//test/extensions/bootstrap/wasm/test_data:http_cpp.wasm",
     ]),
     extension_names = ["envoy.bootstrap.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/bootstrap/wasm:config",
@@ -73,6 +75,7 @@ envoy_extension_cc_test(
         "//test/extensions/bootstrap/wasm/test_data:start_cpp.wasm",
     ]),
     extension_names = ["envoy.bootstrap.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//envoy/registry",
@@ -97,6 +100,7 @@ envoy_extension_cc_test_binary(
         "//test/extensions/bootstrap/wasm/test_data:speed_cpp.wasm",
     ]),
     extension_names = ["envoy.bootstrap.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/event:dispatcher_lib",
diff --git a/test/extensions/clusters/aggregate/BUILD b/test/extensions/clusters/aggregate/BUILD
index 3dd5655a73..7d8c739d35 100644
--- a/test/extensions/clusters/aggregate/BUILD
+++ b/test/extensions/clusters/aggregate/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "cluster_test",
     srcs = ["cluster_test.cc"],
     extension_names = ["envoy.clusters.aggregate"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/clusters/aggregate:cluster",
         "//source/extensions/load_balancing_policies/cluster_provided:config",
@@ -38,6 +39,7 @@ envoy_extension_cc_test(
     name = "cluster_update_test",
     srcs = ["cluster_update_test.cc"],
     extension_names = ["envoy.clusters.aggregate"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:context_lib",
         "//source/common/upstream:cluster_factory_lib",
@@ -65,6 +67,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["cluster_integration_test.cc"],
     extension_names = ["envoy.clusters.aggregate"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:protobuf_link_hacks",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/clusters/common/BUILD b/test/extensions/clusters/common/BUILD
index a23404c57d..65f9d13c76 100644
--- a/test/extensions/clusters/common/BUILD
+++ b/test/extensions/clusters/common/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "logical_host_test",
     srcs = ["logical_host_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/clusters/common:logical_host_lib",
         "//test/mocks/network:transport_socket_mocks",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "logical_host_integration_test",
     srcs = ["logical_host_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/extensions/clusters/common:logical_host_lib",
diff --git a/test/extensions/clusters/dynamic_forward_proxy/BUILD b/test/extensions/clusters/dynamic_forward_proxy/BUILD
index ea44e9c9c6..9d7d8cfff8 100644
--- a/test/extensions/clusters/dynamic_forward_proxy/BUILD
+++ b/test/extensions/clusters/dynamic_forward_proxy/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     srcs = ["cluster_test.cc"],
     data = ["//test/common/tls/test_data:certs"],
     extension_names = ["envoy.filters.http.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/extensions/clusters/dynamic_forward_proxy:cluster",
diff --git a/test/extensions/clusters/eds/BUILD b/test/extensions/clusters/eds/BUILD
index 90d2873959..b442a7ea05 100644
--- a/test/extensions/clusters/eds/BUILD
+++ b/test/extensions/clusters/eds/BUILD
@@ -13,6 +13,7 @@ envoy_package()
 envoy_cc_test(
     name = "eds_test",
     srcs = ["eds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/extensions/clusters/eds:eds_lib",
@@ -45,6 +46,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "eds_speed_test",
     srcs = ["eds_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:xds_resources_delegate_interface",
         "//source/common/config:protobuf_link_hacks",
@@ -82,6 +84,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "leds_test",
     srcs = ["leds_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:utility_lib",
         "//source/extensions/clusters/eds:leds_lib",
diff --git a/test/extensions/clusters/logical_dns/BUILD b/test/extensions/clusters/logical_dns/BUILD
index a2d92aa47e..37201c1b79 100644
--- a/test/extensions/clusters/logical_dns/BUILD
+++ b/test/extensions/clusters/logical_dns/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "logical_dns_cluster_test",
     srcs = ["logical_dns_cluster_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:random_generator_lib",
         "//source/common/event:dispatcher_lib",
diff --git a/test/extensions/clusters/original_dst/BUILD b/test/extensions/clusters/original_dst/BUILD
index 1b8d43c8ff..42db02dd22 100644
--- a/test/extensions/clusters/original_dst/BUILD
+++ b/test/extensions/clusters/original_dst/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "original_dst_cluster_test",
     srcs = ["original_dst_cluster_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/network:filter_state_dst_address_lib",
diff --git a/test/extensions/clusters/redis/BUILD b/test/extensions/clusters/redis/BUILD
index cf886383e7..6a03cb0540 100644
--- a/test/extensions/clusters/redis/BUILD
+++ b/test/extensions/clusters/redis/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "redis_cluster_test",
     srcs = ["redis_cluster_test.cc"],
     extension_names = ["envoy.clusters.redis"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/network:utility_lib",
@@ -58,6 +59,7 @@ envoy_extension_cc_test(
     name = "redis_cluster_lb_test",
     srcs = ["redis_cluster_lb_test.cc"],
     extension_names = ["envoy.clusters.redis"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:cluster_manager_interface",
         "//source/common/event:dispatcher_lib",
@@ -96,6 +98,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["redis_cluster_integration_test.cc"],
     extension_names = ["envoy.clusters.redis"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/clusters/redis:redis_cluster",
         "//source/extensions/clusters/redis:redis_cluster_lb",
@@ -125,5 +128,6 @@ envoy_cc_mock(
 envoy_cc_test(
     name = "crc16_test",
     srcs = ["crc16_test.cc"],
+    rbe_pool = "2core",
     deps = ["//source/extensions/clusters/redis:crc16_lib"],
 )
diff --git a/test/extensions/common/async_files/BUILD b/test/extensions/common/async_files/BUILD
index 20e577ad71..505f9a1251 100644
--- a/test/extensions/common/async_files/BUILD
+++ b/test/extensions/common/async_files/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "async_file_handle_thread_pool_test",
     srcs = ["async_file_handle_thread_pool_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/async_files",
@@ -28,6 +29,7 @@ envoy_cc_test(
         "async_file_manager_thread_pool_test.cc",
         "async_file_manager_thread_pool_with_mocks_test.cc",
     ],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/async_files",
@@ -43,6 +45,7 @@ envoy_cc_test(
     srcs = [
         "async_file_manager_factory_test.cc",
     ],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/async_files",
@@ -56,6 +59,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "status_after_file_error_test",
     srcs = ["status_after_file_error_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/async_files:status_after_file_error",
diff --git a/test/extensions/common/aws/BUILD b/test/extensions/common/aws/BUILD
index faaad6ff6e..ffd64da052 100644
--- a/test/extensions/common/aws/BUILD
+++ b/test/extensions/common/aws/BUILD
@@ -14,6 +14,7 @@ envoy_cc_mock(
     name = "aws_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:message_lib",
         "//source/extensions/common/aws:credentials_provider_interface",
@@ -26,6 +27,7 @@ envoy_cc_mock(
 envoy_cc_test(
     name = "sigv4_signer_impl_test",
     srcs = ["sigv4_signer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:message_lib",
@@ -40,6 +42,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "sigv4a_signer_impl_test",
     srcs = ["sigv4a_signer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:message_lib",
@@ -60,6 +63,7 @@ envoy_cc_test(
             "-DENVOY_SSL_FIPS",
         ],
     ),
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/aws:utility_lib",
         "//test/extensions/common/aws:aws_mocks",
@@ -71,6 +75,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "region_provider_impl_test",
     srcs = ["region_provider_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/aws:region_provider_impl_lib",
         "//test/test_common:environment_lib",
@@ -80,6 +85,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metadata_fetcher_test",
     srcs = ["metadata_fetcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/aws:metadata_fetcher_lib",
         "//test/extensions/common/aws:aws_mocks",
@@ -96,6 +102,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "credentials_provider_impl_test",
     srcs = ["credentials_provider_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/aws:credentials_provider_impl_lib",
         "//source/extensions/common/aws:metadata_fetcher_lib",
@@ -119,6 +126,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "credentials_provider_test",
     srcs = ["credentials_provider_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/aws:credentials_provider_interface",
     ],
@@ -130,6 +138,7 @@ envoy_cc_test(
     srcs = [
         "aws_metadata_fetcher_integration_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:fmt_lib",
         "//source/extensions/common/aws:utility_lib",
diff --git a/test/extensions/common/dubbo/BUILD b/test/extensions/common/dubbo/BUILD
index bd3c0a8acc..acba5b782e 100644
--- a/test/extensions/common/dubbo/BUILD
+++ b/test/extensions/common/dubbo/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "message_test",
     srcs = ["message_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/dubbo:message_lib",
         "//test/test_common:printers_lib",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "metadata_test",
     srcs = ["metadata_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/dubbo:metadata_lib",
         "//test/test_common:printers_lib",
@@ -32,6 +34,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hessian2_utils_test",
     srcs = ["hessian2_utils_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/dubbo:hessian2_utils_lib",
         "//test/test_common:printers_lib",
@@ -42,6 +45,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hessian2_serializer_impl_test",
     srcs = ["hessian2_serializer_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/dubbo:hessian2_serializer_lib",
         "//test/test_common:printers_lib",
@@ -61,6 +65,7 @@ envoy_cc_mock(
 envoy_cc_test(
     name = "codec_test",
     srcs = ["codec_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         "//source/extensions/common/dubbo:codec_lib",
diff --git a/test/extensions/common/dynamic_forward_proxy/BUILD b/test/extensions/common/dynamic_forward_proxy/BUILD
index 8625b7c3bb..2af4a0e81a 100644
--- a/test/extensions/common/dynamic_forward_proxy/BUILD
+++ b/test/extensions/common/dynamic_forward_proxy/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "dns_cache_impl_test",
     srcs = ["dns_cache_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/common/config:utility_lib",
@@ -35,6 +36,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "dns_cache_resource_manager_test",
     srcs = ["dns_cache_resource_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/common/config:utility_lib",
diff --git a/test/extensions/common/matcher/BUILD b/test/extensions/common/matcher/BUILD
index ebb7320c5e..d19ab97b4d 100644
--- a/test/extensions/common/matcher/BUILD
+++ b/test/extensions/common/matcher/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/matcher:matcher_lib",
         "//test/mocks/server:server_factory_context_mocks",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "trie_matcher_test",
     srcs = ["trie_matcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/matcher:matcher_lib",
         "//source/common/network:address_lib",
diff --git a/test/extensions/common/proxy_protocol/BUILD b/test/extensions/common/proxy_protocol/BUILD
index 42a3b20db3..a043c7ab0e 100644
--- a/test/extensions/common/proxy_protocol/BUILD
+++ b/test/extensions/common/proxy_protocol/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "proxy_protocol_header_test",
     srcs = ["proxy_protocol_header_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/common/proxy_protocol:proxy_protocol_header_lib",
@@ -22,6 +23,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "proxy_protocol_regression_test",
     srcs = ["proxy_protocol_regression_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_includes",
diff --git a/test/extensions/common/redis/BUILD b/test/extensions/common/redis/BUILD
index a227f36cf0..7c54f2c91b 100644
--- a/test/extensions/common/redis/BUILD
+++ b/test/extensions/common/redis/BUILD
@@ -25,7 +25,7 @@ envoy_extension_cc_test(
     name = "cluster_refresh_manager_test",
     srcs = ["cluster_refresh_manager_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
-    flaky = True,
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:lock_guard_lib",
         "//source/common/common:thread_lib",
diff --git a/test/extensions/common/tap/BUILD b/test/extensions/common/tap/BUILD
index dea02d4f72..fc28f125dd 100644
--- a/test/extensions/common/tap/BUILD
+++ b/test/extensions/common/tap/BUILD
@@ -24,6 +24,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "admin_test",
     srcs = envoy_select_admin_functionality(["admin_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/common/tap:admin",
         "//source/extensions/common/tap:tap_config_base",
@@ -39,6 +40,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "tap_config_base_test",
     srcs = ["tap_config_base_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/common/tap:tap_config_base",
diff --git a/test/extensions/common/wasm/BUILD b/test/extensions/common/wasm/BUILD
index 7d0cf2c213..8335f4a557 100644
--- a/test/extensions/common/wasm/BUILD
+++ b/test/extensions/common/wasm/BUILD
@@ -21,6 +21,7 @@ envoy_cc_test(
     data = envoy_select_wasm_rust_tests([
         "//test/extensions/common/wasm/test_data:test_rust.wasm",
     ]),
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/wasm:wasm_lib",
@@ -40,6 +41,7 @@ envoy_cc_test(
         "//test/extensions/common/wasm/test_data:test_cpp.wasm",
         "//test/extensions/common/wasm/test_data:test_restriction_cpp.wasm",
     ]),
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/common:hex_lib",
@@ -65,6 +67,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "plugin_test",
     srcs = ["plugin_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/wasm:wasm_lib",
@@ -75,6 +78,7 @@ envoy_cc_test(
 envoy_cc_test_binary(
     name = "wasm_speed_test",
     srcs = ["wasm_speed_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/event:dispatcher_lib",
@@ -104,6 +108,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "wasm_runtime_factory_test",
     srcs = ["wasm_runtime_factory_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//envoy/registry",
@@ -115,6 +120,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "context_test",
     srcs = ["context_test.cc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//envoy/common:base_includes",
@@ -134,6 +140,7 @@ envoy_cc_test(
             "-DWASM_USE_CEL_PARSER",
         ],
     }),
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/network:filter_state_dst_address_lib",
@@ -153,6 +160,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "remote_async_datasource_test",
     srcs = ["remote_async_datasource_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:empty_string",
         "//source/common/crypto:utility_lib",
diff --git a/test/extensions/compression/brotli/compressor/BUILD b/test/extensions/compression/brotli/compressor/BUILD
index 792aaa3fbe..53fefe7273 100644
--- a/test/extensions/compression/brotli/compressor/BUILD
+++ b/test/extensions/compression/brotli/compressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "compressor_test",
     srcs = ["brotli_compressor_impl_test.cc"],
     extension_names = ["envoy.compression.brotli.compressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/brotli/compressor:config",
         "//source/extensions/compression/brotli/decompressor:decompressor_lib",
diff --git a/test/extensions/compression/brotli/decompressor/BUILD b/test/extensions/compression/brotli/decompressor/BUILD
index bbac152b97..394abd604d 100644
--- a/test/extensions/compression/brotli/decompressor/BUILD
+++ b/test/extensions/compression/brotli/decompressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "brotli_decompressor_impl_test",
     srcs = ["brotli_decompressor_impl_test.cc"],
     extension_names = ["envoy.compression.brotli.decompressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/compression/brotli/compressor:compressor_lib",
diff --git a/test/extensions/compression/gzip/BUILD b/test/extensions/compression/gzip/BUILD
index 290209d3eb..3a568d7356 100644
--- a/test/extensions/compression/gzip/BUILD
+++ b/test/extensions/compression/gzip/BUILD
@@ -12,6 +12,7 @@ envoy_cc_fuzz_test(
     name = "compressor_fuzz_test",
     srcs = ["compressor_fuzz_test.cc"],
     corpus = "compressor_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:assert_lib",
diff --git a/test/extensions/compression/gzip/compressor/BUILD b/test/extensions/compression/gzip/compressor/BUILD
index b5a929515a..b226695927 100644
--- a/test/extensions/compression/gzip/compressor/BUILD
+++ b/test/extensions/compression/gzip/compressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "compressor_test",
     srcs = ["zlib_compressor_impl_test.cc"],
     extension_names = ["envoy.compression.gzip.compressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/common:hex_lib",
diff --git a/test/extensions/compression/gzip/decompressor/BUILD b/test/extensions/compression/gzip/decompressor/BUILD
index 712c857072..ed621da5ea 100644
--- a/test/extensions/compression/gzip/decompressor/BUILD
+++ b/test/extensions/compression/gzip/decompressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "zlib_decompressor_impl_test",
     srcs = ["zlib_decompressor_impl_test.cc"],
     extension_names = ["envoy.compression.gzip.decompressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:assert_lib",
         "//source/common/common:hex_lib",
diff --git a/test/extensions/compression/zstd/BUILD b/test/extensions/compression/zstd/BUILD
index c955bd9a61..098821e1b8 100644
--- a/test/extensions/compression/zstd/BUILD
+++ b/test/extensions/compression/zstd/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
         "envoy.compression.zstd.compressor",
         "envoy.compression.zstd.decompressor",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/zstd/compressor:config",
         "//source/extensions/compression/zstd/decompressor:config",
diff --git a/test/extensions/compression/zstd/compressor/BUILD b/test/extensions/compression/zstd/compressor/BUILD
index e22aa7d38c..70c995d0c5 100644
--- a/test/extensions/compression/zstd/compressor/BUILD
+++ b/test/extensions/compression/zstd/compressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "compressor_test",
     srcs = ["zstd_compressor_impl_test.cc"],
     extension_names = ["envoy.compression.zstd.compressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/zstd/compressor:config",
         "//source/extensions/compression/zstd/decompressor:decompressor_lib",
diff --git a/test/extensions/compression/zstd/decompressor/BUILD b/test/extensions/compression/zstd/decompressor/BUILD
index a84ac2e9bd..8f74ca4860 100644
--- a/test/extensions/compression/zstd/decompressor/BUILD
+++ b/test/extensions/compression/zstd/decompressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "decompressor_test",
     srcs = ["zstd_decompressor_impl_test.cc"],
     extension_names = ["envoy.compression.zstd.decompressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/compression/zstd/compressor:compressor_lib",
diff --git a/test/extensions/config/validators/minimum_clusters/BUILD b/test/extensions/config/validators/minimum_clusters/BUILD
index 2b4f4ccf48..bc6dc64ed0 100644
--- a/test/extensions/config/validators/minimum_clusters/BUILD
+++ b/test/extensions/config/validators/minimum_clusters/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.config.validators.minimum_clusters_validator"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/protobuf:message_validator_lib",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "minimum_clusters_validator_test",
     srcs = ["minimum_clusters_validator_test.cc"],
     extension_names = ["envoy.config.validators.minimum_clusters_validator"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:decoded_resource_lib",
         "//source/extensions/config/validators/minimum_clusters:minimum_clusters_validator",
@@ -40,6 +42,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["minimum_clusters_validator_integration_test.cc"],
     extension_names = ["envoy.config.validators.minimum_clusters_validator"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:protobuf_link_hacks",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/config_subscription/common/BUILD b/test/extensions/config_subscription/common/BUILD
index 183dd27d43..78c62f9a00 100644
--- a/test/extensions/config_subscription/common/BUILD
+++ b/test/extensions/config_subscription/common/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "subscription_factory_impl_test",
     srcs = ["subscription_factory_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:xds_config_tracker_interface",
         "//envoy/config:xds_resources_delegate_interface",
@@ -42,6 +43,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "subscription_impl_test",
     srcs = ["subscription_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/common/config:grpc_subscription_test_harness",
         "//test/common/config:subscription_test_harness",
diff --git a/test/extensions/config_subscription/filesystem/BUILD b/test/extensions/config_subscription/filesystem/BUILD
index 0b2d4f2cee..f92f11ec03 100644
--- a/test/extensions/config_subscription/filesystem/BUILD
+++ b/test/extensions/config_subscription/filesystem/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "filesystem_subscription_impl_test",
     srcs = ["filesystem_subscription_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":filesystem_subscription_test_harness",
         "//test/mocks/event:event_mocks",
diff --git a/test/extensions/config_subscription/grpc/BUILD b/test/extensions/config_subscription/grpc/BUILD
index 0474338885..b0f9ce75ed 100644
--- a/test/extensions/config_subscription/grpc/BUILD
+++ b/test/extensions/config_subscription/grpc/BUILD
@@ -13,6 +13,7 @@ envoy_package()
 envoy_cc_test(
     name = "new_grpc_mux_impl_test",
     srcs = ["new_grpc_mux_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:protobuf_link_hacks",
         "//source/common/protobuf",
@@ -41,6 +42,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "grpc_mux_impl_test",
     srcs = ["grpc_mux_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:xds_config_tracker_interface",
         "//envoy/config:xds_resources_delegate_interface",
@@ -72,6 +74,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "delta_subscription_impl_test",
     srcs = ["delta_subscription_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":delta_subscription_test_harness",
         "//envoy/config:xds_config_tracker_interface",
@@ -95,6 +98,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "delta_subscription_state_test",
     srcs = ["delta_subscription_state_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/config_subscription/grpc:delta_subscription_state_lib",
@@ -136,6 +140,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "sotw_subscription_state_test",
     srcs = ["sotw_subscription_state_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:resource_name_lib",
         "//source/common/stats:isolated_store_lib",
@@ -156,6 +161,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "xds_grpc_mux_impl_test",
     srcs = ["xds_grpc_mux_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:protobuf_link_hacks",
         "//source/common/config:resource_name_lib",
@@ -185,6 +191,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "grpc_stream_test",
     srcs = ["grpc_stream_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/config_subscription/grpc:grpc_stream_lib",
         "//test/common/stats:stat_test_utility_lib",
@@ -201,6 +208,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "pausable_ack_queue_test",
     srcs = ["pausable_ack_queue_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/config_subscription/grpc:pausable_ack_queue_lib",
     ],
@@ -209,6 +217,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "watch_map_test",
     srcs = ["watch_map_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:xds_config_tracker_interface",
         "//source/extensions/config_subscription/grpc:watch_map_lib",
@@ -224,6 +233,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "xds_source_id_test",
     srcs = ["xds_source_id_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/config_subscription/grpc:xds_source_id_lib",
     ],
@@ -232,6 +242,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "eds_resources_cache_impl_test",
     srcs = ["eds_resources_cache_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/config_subscription/grpc:eds_resources_cache_lib",
         "//test/mocks/event:event_mocks",
@@ -251,6 +262,7 @@ envoy_cc_mock(
 envoy_cc_test(
     name = "grpc_mux_failover_test",
     srcs = ["grpc_mux_failover_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":grpc_stream_mocks",
         "//source/extensions/config_subscription/grpc:grpc_mux_failover_lib",
@@ -266,6 +278,7 @@ envoy_cc_test(
     name = "xds_failover_integration_test",
     srcs =
         ["xds_failover_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:protobuf_link_hacks",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/config_subscription/rest/BUILD b/test/extensions/config_subscription/rest/BUILD
index b8ebd9f86b..f1c96653bc 100644
--- a/test/extensions/config_subscription/rest/BUILD
+++ b/test/extensions/config_subscription/rest/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "http_subscription_impl_test",
     srcs = ["http_subscription_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_subscription_test_harness",
     ],
diff --git a/test/extensions/dynamic_modules/BUILD b/test/extensions/dynamic_modules/BUILD
index f136dd1126..7d5406643d 100644
--- a/test/extensions/dynamic_modules/BUILD
+++ b/test/extensions/dynamic_modules/BUILD
@@ -21,6 +21,7 @@ envoy_cc_test(
         "//test/extensions/dynamic_modules/test_data/rust:no_program_init",
         "//test/extensions/dynamic_modules/test_data/rust:program_init_fail",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/dynamic_modules:dynamic_modules_lib",
         "//test/test_common:environment_lib",
@@ -34,6 +35,7 @@ envoy_cc_test(
     data = [
         "//source/extensions/dynamic_modules:abi.h",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:hex_lib",
         "//source/common/crypto:utility_lib",
diff --git a/test/extensions/filters/common/expr/BUILD b/test/extensions/filters/common/expr/BUILD
index 283778b264..2e0a58656f 100644
--- a/test/extensions/filters/common/expr/BUILD
+++ b/test/extensions/filters/common/expr/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "context_test",
     srcs = ["context_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/network:filter_state_dst_address_lib",
@@ -40,6 +41,7 @@ envoy_extension_cc_test(
     name = "evaluator_test",
     srcs = ["evaluator_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/common/expr:evaluator_lib",
@@ -62,6 +64,7 @@ envoy_cc_fuzz_test(
     name = "evaluator_fuzz_test",
     srcs = ["evaluator_fuzz_test.cc"],
     corpus = "evaluator_corpus",
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":evaluator_fuzz_proto_cc_proto",
diff --git a/test/extensions/filters/common/expr/context_test.cc b/test/extensions/filters/common/expr/context_test.cc
index 733c2413ce..c766d47e25 100644
--- a/test/extensions/filters/common/expr/context_test.cc
+++ b/test/extensions/filters/common/expr/context_test.cc
@@ -411,6 +411,14 @@ TEST(Context, ResponseAttributes) {
     EXPECT_FALSE(value.has_value());
   }
 
+  {
+    info.setUpstreamInfo(std::make_shared<StreamInfo::UpstreamInfoImpl>());
+    StreamInfo::UpstreamTiming& upstream_timing = info.upstreamInfo()->upstreamTiming();
+    upstream_timing.onFirstUpstreamTxByteSent(info.timeSource());
+    upstream_timing.onLastUpstreamRxByteReceived(info.timeSource());
+    EXPECT_TRUE(response[CelValue::CreateStringView(BackendLatency)].has_value());
+  }
+
   {
     Http::TestResponseHeaderMapImpl header_map{{header_name, "a"}, {grpc_status, "7"}};
     Http::TestResponseTrailerMapImpl trailer_map{{trailer_name, "b"}};
diff --git a/test/extensions/filters/common/ext_authz/BUILD b/test/extensions/filters/common/ext_authz/BUILD
index a9c84c57d3..556b64d44c 100644
--- a/test/extensions/filters/common/ext_authz/BUILD
+++ b/test/extensions/filters/common/ext_authz/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "check_request_utils_test",
     srcs = ["check_request_utils_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/protobuf",
@@ -32,6 +33,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "ext_authz_grpc_impl_test",
     srcs = ["ext_authz_grpc_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/common/ext_authz:ext_authz_grpc_lib",
         "//test/extensions/filters/common/ext_authz:ext_authz_test_common",
@@ -44,6 +46,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "ext_authz_http_impl_test",
     srcs = ["ext_authz_http_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/filters/common/ext_authz:ext_authz_http_lib",
diff --git a/test/extensions/filters/common/ext_authz/test_common.cc b/test/extensions/filters/common/ext_authz/test_common.cc
index 07044303ec..cd57fad20a 100644
--- a/test/extensions/filters/common/ext_authz/test_common.cc
+++ b/test/extensions/filters/common/ext_authz/test_common.cc
@@ -8,6 +8,8 @@
 
 #include "test/test_common/utility.h"
 
+using ::testing::PrintToString;
+
 namespace Envoy {
 namespace Extensions {
 namespace Filters {
@@ -26,14 +28,14 @@ void PrintTo(const ResponsePtr& ptr, std::ostream* os) {
 // NOLINTNEXTLINE(readability-identifier-naming)
 void PrintTo(const Response& response, std::ostream* os) {
   (*os) << "\n{\n  check_status: " << int(response.status)
-        << "\n  headers_to_append: " << response.headers_to_append
-        << "\n  headers_to_set: " << response.headers_to_set
-        << "\n  headers_to_add: " << response.headers_to_add
-        << "\n  response_headers_to_add: " << response.response_headers_to_add
-        << "\n  response_headers_to_set: " << response.response_headers_to_set
-        << "\n  headers_to_remove: " << response.headers_to_remove
-        << "\n  query_parameters_to_set: " << response.query_parameters_to_set
-        << "\n  query_parameters_to_remove: " << response.query_parameters_to_remove
+        << "\n  headers_to_append: " << PrintToString(response.headers_to_append)
+        << "\n  headers_to_set: " << PrintToString(response.headers_to_set)
+        << "\n  headers_to_add: " << PrintToString(response.headers_to_add)
+        << "\n  response_headers_to_add: " << PrintToString(response.response_headers_to_add)
+        << "\n  response_headers_to_set: " << PrintToString(response.response_headers_to_set)
+        << "\n  headers_to_remove: " << PrintToString(response.headers_to_remove)
+        << "\n  query_parameters_to_set: " << PrintToString(response.query_parameters_to_set)
+        << "\n  query_parameters_to_remove: " << PrintToString(response.query_parameters_to_remove)
         << "\n  body: " << response.body << "\n  status_code: " << int(response.status_code)
         << "\n  dynamic_metadata: " << response.dynamic_metadata.DebugString() << "\n}\n";
 }
diff --git a/test/extensions/filters/common/fault/BUILD b/test/extensions/filters/common/fault/BUILD
index da4af82caf..e73194fd04 100644
--- a/test/extensions/filters/common/fault/BUILD
+++ b/test/extensions/filters/common/fault/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "fault_config_test",
     srcs = ["fault_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/common/fault:fault_config_lib",
         "//test/test_common:utility_lib",
diff --git a/test/extensions/filters/common/local_ratelimit/BUILD b/test/extensions/filters/common/local_ratelimit/BUILD
index 85f2f74d5c..d86cf58975 100644
--- a/test/extensions/filters/common/local_ratelimit/BUILD
+++ b/test/extensions/filters/common/local_ratelimit/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "local_ratelimit_test",
     srcs = ["local_ratelimit_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/singleton:manager_impl_lib",
         "//source/extensions/filters/common/local_ratelimit:local_ratelimit_lib",
diff --git a/test/extensions/filters/common/lua/BUILD b/test/extensions/filters/common/lua/BUILD
index 339e181ff7..40f2d6baea 100644
--- a/test/extensions/filters/common/lua/BUILD
+++ b/test/extensions/filters/common/lua/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "lua_test",
     srcs = ["lua_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/thread_local:thread_local_lib",
         "//source/extensions/filters/common/lua:lua_lib",
@@ -24,6 +25,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "wrappers_test",
     srcs = ["wrappers_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":lua_wrappers_lib",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/common/mutation_rules/BUILD b/test/extensions/filters/common/mutation_rules/BUILD
index 9f85a3c06c..cb1e654226 100644
--- a/test/extensions/filters/common/mutation_rules/BUILD
+++ b/test/extensions/filters/common/mutation_rules/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "mutation_rules_test",
     srcs = ["mutation_rules_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/common/mutation_rules:mutation_rules_lib",
     ],
diff --git a/test/extensions/filters/common/original_src/BUILD b/test/extensions/filters/common/original_src/BUILD
index 1d3a5d2884..8af958d473 100644
--- a/test/extensions/filters/common/original_src/BUILD
+++ b/test/extensions/filters/common/original_src/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "original_src_socket_option_test",
     srcs = ["original_src_socket_option_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/extensions/filters/common/original_src:original_src_socket_option_lib",
diff --git a/test/extensions/filters/common/ratelimit/BUILD b/test/extensions/filters/common/ratelimit/BUILD
index ace59c86eb..b35a3c8ccf 100644
--- a/test/extensions/filters/common/ratelimit/BUILD
+++ b/test/extensions/filters/common/ratelimit/BUILD
@@ -13,6 +13,7 @@ envoy_package()
 envoy_cc_test(
     name = "ratelimit_impl_test",
     srcs = ["ratelimit_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
diff --git a/test/extensions/filters/common/rbac/BUILD b/test/extensions/filters/common/rbac/BUILD
index ca59ee1f59..b13ac82b87 100644
--- a/test/extensions/filters/common/rbac/BUILD
+++ b/test/extensions/filters/common/rbac/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "matchers_test",
     srcs = ["matchers_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/stream_info:filter_state_lib",
@@ -36,6 +37,7 @@ envoy_extension_cc_test(
     name = "engine_impl_test",
     srcs = ["engine_impl_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/common/rbac:engine_lib",
@@ -56,6 +58,7 @@ envoy_extension_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/common/rbac:utility_lib",
diff --git a/test/extensions/filters/common/set_filter_state/BUILD b/test/extensions/filters/common/set_filter_state/BUILD
index 1d6f2208bd..cc517db34e 100644
--- a/test/extensions/filters/common/set_filter_state/BUILD
+++ b/test/extensions/filters/common/set_filter_state/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "filter_config_test",
     srcs = ["filter_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/router:string_accessor_lib",
diff --git a/test/extensions/filters/http/adaptive_concurrency/BUILD b/test/extensions/filters/http/adaptive_concurrency/BUILD
index 287454b822..4b0ef3bf10 100644
--- a/test/extensions/filters/http/adaptive_concurrency/BUILD
+++ b/test/extensions/filters/http/adaptive_concurrency/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "adaptive_concurrency_filter_test",
     srcs = ["adaptive_concurrency_filter_test.cc"],
     extension_names = ["envoy.filters.http.adaptive_concurrency"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
@@ -40,6 +41,7 @@ envoy_extension_cc_test(
         "adaptive_concurrency_filter_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.adaptive_concurrency"],
+    rbe_pool = "2core",
     deps = [
         ":adaptive_concurrency_filter_integration_test_lib",
         "//source/extensions/filters/http/adaptive_concurrency:config",
diff --git a/test/extensions/filters/http/adaptive_concurrency/controller/BUILD b/test/extensions/filters/http/adaptive_concurrency/controller/BUILD
index 17e38ef2c4..00a2572715 100644
--- a/test/extensions/filters/http/adaptive_concurrency/controller/BUILD
+++ b/test/extensions/filters/http/adaptive_concurrency/controller/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "gradient_controller_test",
     srcs = ["gradient_controller_test.cc"],
     extension_names = ["envoy.filters.http.adaptive_concurrency"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/filters/http/adaptive_concurrency:adaptive_concurrency_filter_lib",
diff --git a/test/extensions/filters/http/admission_control/BUILD b/test/extensions/filters/http/admission_control/BUILD
index 75f829be3d..703674afc9 100644
--- a/test/extensions/filters/http/admission_control/BUILD
+++ b/test/extensions/filters/http/admission_control/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "admission_control_filter_test",
     srcs = ["admission_control_filter_test.cc"],
     extension_names = ["envoy.filters.http.admission_control"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:enum_to_int",
         "//source/common/http:header_map_lib",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.admission_control"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
@@ -51,6 +53,7 @@ envoy_extension_cc_test(
     name = "success_criteria_evaluator_test",
     srcs = ["success_criteria_evaluator_test.cc"],
     extension_names = ["envoy.filters.http.admission_control"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/admission_control:admission_control_filter_lib",
         "@envoy_api//envoy/extensions/filters/http/admission_control/v3:pkg_cc_proto",
@@ -62,6 +65,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["admission_control_integration_test.cc"],
     extension_names = ["envoy.filters.http.admission_control"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/admission_control:config",
         "//test/integration:http_integration_lib",
@@ -73,6 +77,7 @@ envoy_extension_cc_test(
     name = "admission_controller_test",
     srcs = ["controller_test.cc"],
     extension_names = ["envoy.filters.http.admission_control"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:headers_lib",
         "//source/extensions/filters/http/admission_control:admission_control_filter_lib",
diff --git a/test/extensions/filters/http/alternate_protocols_cache/BUILD b/test/extensions/filters/http/alternate_protocols_cache/BUILD
index 8b755a8641..4aefe5debb 100644
--- a/test/extensions/filters/http/alternate_protocols_cache/BUILD
+++ b/test/extensions/filters/http/alternate_protocols_cache/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.alternate_protocols_cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/alternate_protocols_cache:config",
         "//test/mocks/http:http_mocks",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.filters.http.alternate_protocols_cache"],
+    rbe_pool = "2core",
     shard_count = 2,
     tags = [
         "cpu:3",
diff --git a/test/extensions/filters/http/aws_lambda/BUILD b/test/extensions/filters/http/aws_lambda/BUILD
index ed21364762..6a7f07d481 100644
--- a/test/extensions/filters/http/aws_lambda/BUILD
+++ b/test/extensions/filters/http/aws_lambda/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "aws_lambda_filter_test",
     srcs = ["aws_lambda_filter_test.cc"],
     extension_names = ["envoy.filters.http.aws_lambda"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/aws_lambda:aws_lambda_filter_lib",
         "//test/extensions/common/aws:aws_mocks",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["aws_lambda_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.aws_lambda"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/aws_lambda:aws_lambda_filter_lib",
@@ -42,6 +44,7 @@ envoy_extension_cc_test(
     name = "arn_test",
     srcs = ["arn_test.cc"],
     extension_names = ["envoy.filters.http.aws_lambda"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/aws_lambda:aws_lambda_filter_lib",
         "//test/mocks/http:http_mocks",
@@ -52,6 +55,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.aws_lambda"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/aws_lambda:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/aws_request_signing/BUILD b/test/extensions/filters/http/aws_request_signing/BUILD
index 783f546a04..bb15efa6df 100644
--- a/test/extensions/filters/http/aws_request_signing/BUILD
+++ b/test/extensions/filters/http/aws_request_signing/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "aws_request_signing_filter_test",
     srcs = ["aws_request_signing_filter_test.cc"],
     extension_names = ["envoy.filters.http.aws_request_signing"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/aws_request_signing:aws_request_signing_filter_lib",
         "//test/extensions/common/aws:aws_mocks",
@@ -26,6 +27,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.aws_request_signing"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/aws_request_signing:config",
         "//test/mocks/server:factory_context_mocks",
@@ -37,6 +39,7 @@ envoy_extension_cc_test(
     name = "aws_request_signing_integration_test",
     srcs = ["aws_request_signing_integration_test.cc"],
     extension_names = ["envoy.filters.http.aws_request_signing"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
         "//source/extensions/filters/http/aws_request_signing:aws_request_signing_filter_lib",
diff --git a/test/extensions/filters/http/bandwidth_limit/BUILD b/test/extensions/filters/http/bandwidth_limit/BUILD
index c41fe5ca0f..93d1e94faf 100644
--- a/test/extensions/filters/http/bandwidth_limit/BUILD
+++ b/test/extensions/filters/http/bandwidth_limit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.bandwidth_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/http:header_utility_lib",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.bandwidth_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/bandwidth_limit:config",
         "//test/mocks/server:server_mocks",
diff --git a/test/extensions/filters/http/basic_auth/BUILD b/test/extensions/filters/http/basic_auth/BUILD
index 56348ac356..b2c5c3f7e1 100644
--- a/test/extensions/filters/http/basic_auth/BUILD
+++ b/test/extensions/filters/http/basic_auth/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.basic_auth"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/basic_auth:basic_auth_lib",
         "//test/mocks/server:server_mocks",
@@ -26,6 +27,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.basic_auth"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/basic_auth:config",
         "//test/mocks/server:server_mocks",
@@ -38,6 +40,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["basic_auth_integration_test.cc"],
     extension_names = ["envoy.filters.http.basic_auth"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/basic_auth:config",
         "//test/integration:http_protocol_integration_lib",
diff --git a/test/extensions/filters/http/buffer/BUILD b/test/extensions/filters/http/buffer/BUILD
index 31250dd10a..7510a282de 100644
--- a/test/extensions/filters/http/buffer/BUILD
+++ b/test/extensions/filters/http/buffer/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "buffer_filter_test",
     srcs = ["buffer_filter_test.cc"],
     extension_names = ["envoy.filters.http.buffer"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//source/common/http:header_map_lib",
@@ -37,6 +38,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["buffer_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.buffer"],
+    rbe_pool = "2core",
     shard_count = 4,
     deps = [
         "//source/extensions/filters/http/buffer:config",
@@ -51,6 +53,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.buffer"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/buffer:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/cache/BUILD b/test/extensions/filters/http/cache/BUILD
index 1d1f5f0ab2..1e9f5d6832 100644
--- a/test/extensions/filters/http/cache/BUILD
+++ b/test/extensions/filters/http/cache/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
     name = "cache_headers_utils_test",
     srcs = ["cache_headers_utils_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:header_map_interface",
         "//source/common/http:header_map_lib",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
     name = "cache_filter_logging_info_test",
     srcs = ["cache_filter_logging_info_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cache_filter_logging_info_lib",
     ],
@@ -44,6 +46,7 @@ envoy_extension_cc_test(
     name = "cache_entry_utils_test",
     srcs = ["cache_entry_utils_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cache_entry_utils_lib",
     ],
@@ -53,6 +56,7 @@ envoy_extension_cc_test(
     name = "http_cache_test",
     srcs = ["http_cache_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:http_cache_lib",
         "//source/extensions/http/cache/simple_http_cache:config",
@@ -68,6 +72,7 @@ envoy_extension_cc_test(
     name = "range_utils_test",
     srcs = ["range_utils_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:range_utils_lib",
         "//test/test_common:utility_lib",
@@ -78,6 +83,7 @@ envoy_extension_cc_test(
     name = "cache_filter_test",
     srcs = ["cache_filter_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/extensions/filters/http/cache:cache_filter_lib",
@@ -96,6 +102,7 @@ envoy_extension_cc_test(
     name = "cacheability_utils_test",
     srcs = ["cacheability_utils_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cacheability_utils_lib",
         "//test/mocks/server:server_factory_context_mocks",
@@ -107,6 +114,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:config",
         "//source/extensions/http/cache/simple_http_cache:config",
@@ -124,6 +132,7 @@ envoy_extension_cc_test(
         "cache_filter_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:config",
         "//source/extensions/filters/http/cache:http_cache_lib",
@@ -139,6 +148,7 @@ envoy_extension_cc_test(
         "cache_custom_headers_test.cc",
     ],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cache_custom_headers",
     ],
@@ -149,6 +159,7 @@ envoy_extension_cc_test_library(
     srcs = ["http_cache_implementation_test_common.cc"],
     hdrs = ["http_cache_implementation_test_common.h"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cache_headers_utils_lib",
         "//source/extensions/filters/http/cache:http_cache_lib",
diff --git a/test/extensions/filters/http/cdn_loop/BUILD b/test/extensions/filters/http/cdn_loop/BUILD
index eee4e6ac99..6cfb0ae405 100644
--- a/test/extensions/filters/http/cdn_loop/BUILD
+++ b/test/extensions/filters/http/cdn_loop/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.cdn_loop"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cdn_loop:config",
         "//test/mocks/http:http_mocks",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.cdn_loop"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cdn_loop:config",
         "//test/integration:http_protocol_integration_lib",
@@ -42,6 +44,7 @@ envoy_extension_cc_test(
 envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:codes_interface",
         "//envoy/http:filter_interface",
@@ -54,6 +57,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "parser_test",
     srcs = ["parser_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cdn_loop:parser_lib",
         "//test/test_common:status_utility_lib",
@@ -64,6 +68,7 @@ envoy_cc_fuzz_test(
     name = "parser_fuzz_test",
     srcs = ["parser_fuzz_test.cc"],
     corpus = "parser_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:statusor_lib",
         "//source/extensions/filters/http/cdn_loop:parser_lib",
@@ -74,6 +79,7 @@ envoy_cc_fuzz_test(
 envoy_cc_test(
     name = "utils_test",
     srcs = ["utils_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cdn_loop:utils_lib",
         "//test/test_common:status_utility_lib",
diff --git a/test/extensions/filters/http/common/BUILD b/test/extensions/filters/http/common/BUILD
index d414adf79d..d2e3760818 100644
--- a/test/extensions/filters/http/common/BUILD
+++ b/test/extensions/filters/http/common/BUILD
@@ -21,6 +21,7 @@ envoy_cc_test_library(
     hdrs = [
         "mock.h",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/common:jwks_fetcher_lib",
         "//test/mocks/upstream:upstream_mocks",
@@ -42,6 +43,7 @@ envoy_extension_cc_test(
         "jwks_fetcher_test.cc",
     ],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/common:jwks_fetcher_lib",
         "//test/extensions/filters/http/common:mock_lib",
@@ -55,6 +57,7 @@ envoy_extension_cc_test(
 envoy_cc_test(
     name = "stream_rate_limiter_test",
     srcs = ["stream_rate_limiter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/http/common/fuzz/BUILD b/test/extensions/filters/http/common/fuzz/BUILD
index d0b460b12c..734cec0871 100644
--- a/test/extensions/filters/http/common/fuzz/BUILD
+++ b/test/extensions/filters/http/common/fuzz/BUILD
@@ -42,6 +42,7 @@ envoy_cc_test_library(
         "uber_per_filter.cc",
     ],
     hdrs = ["uber_filter.h"],
+    rbe_pool = "2core",
     deps = [
         ":filter_fuzz_proto_cc_proto",
         ":http_filter_fuzzer_lib",
@@ -67,6 +68,7 @@ envoy_cc_fuzz_test(
     name = "filter_fuzz_test",
     srcs = ["filter_fuzz_test.cc"],
     corpus = "filter_corpus",
+    rbe_pool = "2core",
     # All Envoy extensions must be linked to the test in order for the fuzzer to pick
     # these up via the NamedHttpFilterConfigFactory.
     deps = [
diff --git a/test/extensions/filters/http/composite/BUILD b/test/extensions/filters/http/composite/BUILD
index dc9662b953..a3826537ae 100644
--- a/test/extensions/filters/http/composite/BUILD
+++ b/test/extensions/filters/http/composite/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.composite"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/composite:config",
@@ -34,6 +35,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["composite_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.composite"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/composite:config",
diff --git a/test/extensions/filters/http/compressor/BUILD b/test/extensions/filters/http/compressor/BUILD
index 001aaa5d9c..5e486bca3d 100644
--- a/test/extensions/filters/http/compressor/BUILD
+++ b/test/extensions/filters/http/compressor/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
         "compressor_filter_test.cc",
     ],
     extension_names = ["envoy.filters.http.compressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/gzip/compressor:config",
         "//source/extensions/filters/http/compressor:compressor_filter_lib",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
         "compressor_filter_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.compressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/gzip/compressor:config",
         "//source/extensions/compression/gzip/decompressor:config",
@@ -61,6 +63,7 @@ envoy_extension_cc_test(
         "config_test.cc",
     ],
     extension_names = ["envoy.filters.http.compressor"],
+    rbe_pool = "2core",
     deps = [
         ":mock_config_cc_proto",
         "//source/extensions/filters/http/compressor:config",
@@ -73,6 +76,7 @@ envoy_extension_cc_test(
 envoy_cc_benchmark_binary(
     name = "compressor_filter_speed_test",
     srcs = ["compressor_filter_speed_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/compression/compressor:compressor_factory_interface",
         "//source/common/protobuf:utility_lib",
@@ -96,6 +100,7 @@ envoy_cc_benchmark_binary(
 envoy_benchmark_test(
     name = "compressor_filter_speed_test_benchmark_test",
     benchmark_binary = "compressor_filter_speed_test",
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): diagnose clang-cl build test failure
     tags = ["fails_on_windows"],
 )
@@ -111,6 +116,7 @@ envoy_cc_test(
     srcs = [
         "compressor_integration_tests.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":compressor_integration_tests_lib",
         "//source/common/http:header_map_lib",
diff --git a/test/extensions/filters/http/connect_grpc_bridge/BUILD b/test/extensions/filters/http/connect_grpc_bridge/BUILD
index 0b8ab78d98..1607114d9b 100644
--- a/test/extensions/filters/http/connect_grpc_bridge/BUILD
+++ b/test/extensions/filters/http/connect_grpc_bridge/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.connect_grpc_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/connect_grpc_bridge:config",
         "//test/mocks/server:factory_context_mocks",
@@ -26,6 +27,7 @@ envoy_extension_cc_test(
     name = "connect_grpc_bridge_filter_test",
     srcs = ["connect_grpc_bridge_filter_test.cc"],
     extension_names = ["envoy.filters.http.connect_grpc_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -43,6 +45,7 @@ envoy_extension_cc_test(
         "connect_grpc_bridge_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.connect_grpc_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
@@ -57,6 +60,7 @@ envoy_extension_cc_test(
     name = "end_stream_response_test",
     srcs = ["end_stream_response_test.cc"],
     extension_names = ["envoy.filters.http.connect_grpc_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/connect_grpc_bridge:end_stream_response_lib",
         "//test/test_common:global_lib",
diff --git a/test/extensions/filters/http/cors/BUILD b/test/extensions/filters/http/cors/BUILD
index 6fccfa5b8b..7c24ffc44b 100644
--- a/test/extensions/filters/http/cors/BUILD
+++ b/test/extensions/filters/http/cors/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "cors_filter_test",
     srcs = ["cors_filter_test.cc"],
     extension_names = ["envoy.filters.http.cors"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/cors:config",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["cors_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.cors"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
diff --git a/test/extensions/filters/http/credential_injector/BUILD b/test/extensions/filters/http/credential_injector/BUILD
index 62106aef75..cfeaa16df7 100644
--- a/test/extensions/filters/http/credential_injector/BUILD
+++ b/test/extensions/filters/http/credential_injector/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/credential_injector:credential_injector_lib",
         "//source/extensions/http/injected_credentials/generic:generic_lib",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         ":mock_credentail_cc_proto",
         "//source/extensions/filters/http/credential_injector:config",
diff --git a/test/extensions/filters/http/csrf/BUILD b/test/extensions/filters/http/csrf/BUILD
index 5a958bce60..a7e15d8094 100644
--- a/test/extensions/filters/http/csrf/BUILD
+++ b/test/extensions/filters/http/csrf/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "csrf_filter_test",
     srcs = ["csrf_filter_test.cc"],
     extension_names = ["envoy.filters.http.csrf"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/filters/http/csrf:config",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["csrf_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.csrf"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/csrf:config",
         "//test/config:utility_lib",
diff --git a/test/extensions/filters/http/custom_response/BUILD b/test/extensions/filters/http/custom_response/BUILD
index 704c20d197..ec9a452539 100644
--- a/test/extensions/filters/http/custom_response/BUILD
+++ b/test/extensions/filters/http/custom_response/BUILD
@@ -36,6 +36,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.custom_response"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/http:message_lib",
@@ -55,6 +56,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["custom_response_filter_test.cc"],
     extension_names = ["envoy.filters.http.custom_response"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/http:message_lib",
@@ -81,6 +83,7 @@ envoy_extension_cc_test(
         "custom_response_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.custom_response"],
+    rbe_pool = "2core",
     shard_count = 2,
     tags = [
         "cpu:3",
diff --git a/test/extensions/filters/http/decompressor/BUILD b/test/extensions/filters/http/decompressor/BUILD
index 3513f11dc8..07117fbb29 100644
--- a/test/extensions/filters/http/decompressor/BUILD
+++ b/test/extensions/filters/http/decompressor/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "decompressor_filter_test",
     srcs = ["decompressor_filter_test.cc"],
     extension_names = ["envoy.filters.http.decompressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:headers_lib",
         "//source/common/protobuf:utility_lib",
@@ -36,6 +37,7 @@ envoy_extension_cc_test(
         "decompressor_filter_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.decompressor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/compression/gzip/compressor:config",
         "//source/extensions/compression/gzip/decompressor:config",
diff --git a/test/extensions/filters/http/dynamic_forward_proxy/BUILD b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
index c62c88bb38..7362dfbb01 100644
--- a/test/extensions/filters/http/dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/http/dynamic_forward_proxy/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/dynamic_forward_proxy:config",
         "//test/mocks/server:factory_context_mocks",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "proxy_filter_test",
     srcs = ["proxy_filter_test.cc"],
     extension_names = ["envoy.filters.http.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/common/dynamic_forward_proxy:dns_cache_impl",
@@ -72,6 +74,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.filters.http.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): Diagnose failure shown on clang-cl build, see:
     #   https://gist.github.com/wrowe/a152cb1d12c2f751916122aed39d8517
     tags = ["fails_on_clang_cl"],
diff --git a/test/extensions/filters/http/ext_authz/BUILD b/test/extensions/filters/http/ext_authz/BUILD
index f3436633bf..5e10990b04 100644
--- a/test/extensions/filters/http/ext_authz/BUILD
+++ b/test/extensions/filters/http/ext_authz/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
     name = "ext_authz_test",
     srcs = ["ext_authz_test.cc"],
     extension_names = ["envoy.filters.http.ext_authz"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:codes_interface",
         "//source/common/buffer:buffer_lib",
@@ -51,6 +52,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.ext_authz"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:async_client_manager_lib",
         "//source/common/network:address_lib",
@@ -73,6 +75,7 @@ envoy_extension_cc_test(
         "ext_authz.yaml",
     ],
     extension_names = ["envoy.filters.http.ext_authz"],
+    rbe_pool = "2core",
     deps = [
         ":ext_authz_fuzz_proto_cc_proto",
         ":logging_test_filter_lib",
@@ -106,6 +109,7 @@ envoy_cc_fuzz_test(
     name = "ext_authz_grpc_fuzz_test",
     srcs = ["ext_authz_grpc_fuzz_test.cc"],
     corpus = "ext_authz_grpc_corpus",
+    rbe_pool = "2core",
     deps = [
         ":ext_authz_fuzz_lib",
         ":ext_authz_fuzz_proto_cc_proto",
@@ -123,6 +127,7 @@ envoy_cc_fuzz_test(
     name = "ext_authz_http_fuzz_test",
     srcs = ["ext_authz_http_fuzz_test.cc"],
     corpus = "ext_authz_http_corpus",
+    rbe_pool = "2core",
     deps = [
         ":ext_authz_fuzz_lib",
         ":ext_authz_fuzz_proto_cc_proto",
@@ -142,6 +147,7 @@ envoy_cc_test_library(
     name = "ext_authz_fuzz_lib",
     srcs = ["ext_authz_fuzz_lib.cc"],
     hdrs = ["ext_authz_fuzz_lib.h"],
+    rbe_pool = "2core",
     deps = [
         ":ext_authz_fuzz_proto_cc_proto",
         "//source/common/http:context_lib",
diff --git a/test/extensions/filters/http/ext_proc/BUILD b/test/extensions/filters/http/ext_proc/BUILD
index b2dcff8c17..21a1f5678a 100644
--- a/test/extensions/filters/http/ext_proc/BUILD
+++ b/test/extensions/filters/http/ext_proc/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/ext_proc:config",
@@ -37,6 +38,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":mock_server_lib",
@@ -68,6 +70,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["state_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/ext_proc",
@@ -79,6 +82,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["ordering_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":mock_server_lib",
@@ -97,6 +101,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["client_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/http:header_map_lib",
@@ -120,6 +125,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":utils_lib",
@@ -136,6 +142,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["mutation_utils_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":utils_lib",
@@ -163,6 +170,7 @@ envoy_extension_cc_test(
         # TODO(jbohanon) use a test filter here instead of production filter
         "envoy.filters.http.set_metadata",
     ],
+    rbe_pool = "2core",
     shard_count = 8,
     tags = [
         "cpu:3",
@@ -202,6 +210,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
         "skip_on_windows",
@@ -309,15 +318,17 @@ envoy_cc_fuzz_test(
     srcs = ["ext_proc_grpc_fuzz.cc"],
     hdrs = ["ext_proc_grpc_fuzz.h"],
     corpus = "ext_proc_grpc_corpus",
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = EXT_PROC_GRPC_FUZZ_TEST_DEPS,
 )
 
 envoy_cc_fuzz_test(
-    name = "ext_proc_grpc_fuzz_test_persistent",
+    name = "ext_proc_grpc_persistent_fuzz_test",
     srcs = ["ext_proc_grpc_fuzz_persistent.cc"],
     hdrs = ["ext_proc_grpc_fuzz.h"],
     corpus = "ext_proc_grpc_corpus",
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = EXT_PROC_GRPC_FUZZ_TEST_DEPS,
 )
@@ -326,6 +337,7 @@ envoy_extension_cc_test(
     name = "ext_proc_benchmark_test",
     srcs = ["ext_proc_benchmark_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":test_processor_lib",
diff --git a/test/extensions/filters/http/ext_proc/ext_proc_integration_test.cc b/test/extensions/filters/http/ext_proc/ext_proc_integration_test.cc
index 697a773a1e..e229fc88b8 100644
--- a/test/extensions/filters/http/ext_proc/ext_proc_integration_test.cc
+++ b/test/extensions/filters/http/ext_proc/ext_proc_integration_test.cc
@@ -4652,6 +4652,174 @@ TEST_P(ExtProcIntegrationTest, SidestreamPushbackUpstreamObservabilityMode) {
   verifyDownstreamResponse(*response, 200);
 }
 
+TEST_P(ExtProcIntegrationTest, SendBodyBeforeHeaderRespStreamedBasicTest) {
+  proto_config_.mutable_processing_mode()->set_request_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_request_body_mode(ProcessingMode::STREAMED);
+  proto_config_.mutable_processing_mode()->set_response_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_response_body_mode(ProcessingMode::STREAMED);
+  proto_config_.set_send_body_without_waiting_for_header_response(true);
+  initializeConfig();
+  HttpIntegrationTest::initialize();
+  auto response = sendDownstreamRequestWithBody("hello world", [](Http::HeaderMap& headers) {
+    headers.addCopy(LowerCaseString("x-remove-this"), "yes");
+  });
+  processRequestHeadersMessage(
+      *grpc_upstreams_[0], true, [](const HttpHeaders& headers, HeadersResponse& headers_resp) {
+        Http::TestRequestHeaderMapImpl expected_request_headers{
+            {":scheme", "http"}, {":method", "POST"},      {"host", "host"},
+            {":path", "/"},      {"x-remove-this", "yes"}, {"x-forwarded-proto", "http"}};
+        EXPECT_THAT(headers.headers(), HeaderProtosEqual(expected_request_headers));
+
+        auto response_header_mutation = headers_resp.mutable_response()->mutable_header_mutation();
+        auto* mut1 = response_header_mutation->add_set_headers();
+        mut1->mutable_header()->set_key("x-new-header");
+        mut1->mutable_header()->set_raw_value("new");
+        response_header_mutation->add_remove_headers("x-remove-this");
+        return true;
+      });
+  processRequestBodyMessage(
+      *grpc_upstreams_[0], false, [](const HttpBody& body, BodyResponse& body_resp) {
+        EXPECT_TRUE(body.end_of_stream());
+        EXPECT_EQ(body.body(), "hello world");
+        auto* body_mut = body_resp.mutable_response()->mutable_body_mutation();
+        body_mut->set_body("replaced body");
+        return true;
+      });
+
+  ASSERT_TRUE(fake_upstreams_[0]->waitForHttpConnection(*dispatcher_, fake_upstream_connection_));
+  ASSERT_TRUE(fake_upstream_connection_->waitForNewStream(*dispatcher_, upstream_request_));
+  ASSERT_TRUE(upstream_request_->waitForEndStream(*dispatcher_));
+  EXPECT_THAT(upstream_request_->headers(), HasNoHeader("x-remove-this"));
+  EXPECT_THAT(upstream_request_->headers(), SingleHeaderValueIs("x-new-header", "new"));
+  EXPECT_EQ(upstream_request_->body().toString(), "replaced body");
+  upstream_request_->encodeHeaders(Http::TestResponseHeaderMapImpl{{":status", "200"}}, false);
+  upstream_request_->encodeData(100, true);
+  processResponseHeadersMessage(
+      *grpc_upstreams_[0], false, [](const HttpHeaders& headers, HeadersResponse&) {
+        Http::TestRequestHeaderMapImpl expected_response_headers{{":status", "200"}};
+        EXPECT_THAT(headers.headers(), HeaderProtosEqual(expected_response_headers));
+        return true;
+      });
+  processResponseBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  verifyDownstreamResponse(*response, 200);
+}
+
+TEST_P(ExtProcIntegrationTest, SendBodyAndTrailerBeforeHeaderRespStreamedMoreDataTest) {
+  proto_config_.mutable_processing_mode()->set_request_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_request_body_mode(ProcessingMode::STREAMED);
+  proto_config_.mutable_processing_mode()->set_response_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_response_body_mode(ProcessingMode::STREAMED);
+  proto_config_.mutable_processing_mode()->set_response_trailer_mode(ProcessingMode::SEND);
+  proto_config_.set_send_body_without_waiting_for_header_response(true);
+
+  initializeConfig();
+  HttpIntegrationTest::initialize();
+  codec_client_ = makeHttpConnection(lookupPort("http"));
+  Http::TestRequestHeaderMapImpl headers;
+  HttpTestUtility::addDefaultHeaders(headers);
+
+  auto encoder_decoder = codec_client_->startRequest(headers);
+  request_encoder_ = &encoder_decoder.first;
+  auto response = std::move(encoder_decoder.second);
+  codec_client_->sendData(*request_encoder_, "hello world", false);
+  processRequestHeadersMessage(*grpc_upstreams_[0], true, absl::nullopt);
+  processRequestBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  codec_client_->sendData(*request_encoder_, "foo-bar", true);
+  processRequestBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+
+  handleUpstreamRequestWithTrailer();
+  processResponseHeadersMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  processResponseBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  processResponseTrailersMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  verifyDownstreamResponse(*response, 200);
+}
+
+TEST_P(ExtProcIntegrationTest, ServerWaitForBodyBeforeSendsHeaderRespStreamedTest) {
+  config_helper_.setBufferLimits(1024, 1024);
+  proto_config_.mutable_processing_mode()->set_request_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_request_body_mode(ProcessingMode::STREAMED);
+  proto_config_.mutable_processing_mode()->set_response_header_mode(ProcessingMode::SKIP);
+  proto_config_.set_send_body_without_waiting_for_header_response(true);
+
+  initializeConfig();
+  HttpIntegrationTest::initialize();
+  codec_client_ = makeHttpConnection(lookupPort("http"));
+  Http::TestRequestHeaderMapImpl default_headers;
+  HttpTestUtility::addDefaultHeaders(default_headers);
+
+  auto encoder_decoder = codec_client_->startRequest(default_headers);
+  request_encoder_ = &encoder_decoder.first;
+  auto response = std::move(encoder_decoder.second);
+  // Downstream client sending 16k data.
+  const std::string body_sent(16 * 1024, 's');
+  codec_client_->sendData(*request_encoder_, body_sent, true);
+
+  // The ext_proc server receives the headers.
+  ProcessingRequest header_request;
+  ASSERT_TRUE(grpc_upstreams_[0]->waitForHttpConnection(*dispatcher_, processor_connection_));
+  ASSERT_TRUE(processor_connection_->waitForNewStream(*dispatcher_, processor_stream_));
+  ASSERT_TRUE(processor_stream_->waitForGrpcMessage(*dispatcher_, header_request));
+  ASSERT_TRUE(header_request.has_request_headers());
+
+  // The ext_proc server receives 16 chunks of body, each chunk size is 1k.
+  std::string body_received;
+  bool end_stream = false;
+  uint32_t total_body_msg_count = 0;
+  while (!end_stream) {
+    ProcessingRequest body_request;
+    ASSERT_TRUE(processor_stream_->waitForGrpcMessage(*dispatcher_, body_request));
+    ASSERT_TRUE(body_request.has_request_body());
+    body_received = absl::StrCat(body_received, body_request.request_body().body());
+    end_stream = body_request.request_body().end_of_stream();
+    total_body_msg_count++;
+  }
+  EXPECT_TRUE(end_stream);
+  EXPECT_EQ(body_received, body_sent);
+
+  // The ext_proc server sends back the header response.
+  processor_stream_->startGrpcStream();
+  ProcessingResponse response_header;
+  auto* header_resp = response_header.mutable_request_headers();
+  auto header_mutation = header_resp->mutable_response()->mutable_header_mutation();
+  auto* mut = header_mutation->add_set_headers();
+  mut->mutable_header()->set_key("x-new-header");
+  mut->mutable_header()->set_raw_value("new");
+  processor_stream_->sendGrpcMessage(response_header);
+
+  // The ext_proc server sends back the body response.
+  const std::string body_upstream(total_body_msg_count, 'r');
+  while (total_body_msg_count) {
+    ProcessingResponse response_body;
+    auto* body_resp = response_body.mutable_request_body();
+    auto* body_mut = body_resp->mutable_response()->mutable_body_mutation();
+    body_mut->set_body("r");
+    processor_stream_->sendGrpcMessage(response_body);
+    total_body_msg_count--;
+  }
+
+  handleUpstreamRequest();
+  EXPECT_THAT(upstream_request_->headers(), SingleHeaderValueIs("x-new-header", "new"));
+  EXPECT_EQ(upstream_request_->body().toString(), body_upstream);
+  verifyDownstreamResponse(*response, 200);
+}
+
+TEST_P(ExtProcIntegrationTest, SendBodyBeforeHeaderRespStreamedNotSendTrailerTest) {
+  proto_config_.mutable_processing_mode()->set_request_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_request_body_mode(ProcessingMode::STREAMED);
+  proto_config_.mutable_processing_mode()->set_response_header_mode(ProcessingMode::SEND);
+  proto_config_.mutable_processing_mode()->set_response_body_mode(ProcessingMode::STREAMED);
+  proto_config_.set_send_body_without_waiting_for_header_response(true);
+  initializeConfig();
+  HttpIntegrationTest::initialize();
+  auto response = sendDownstreamRequestWithBodyAndTrailer("hello world");
+  processRequestHeadersMessage(*grpc_upstreams_[0], true, absl::nullopt);
+  processRequestBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  handleUpstreamRequest(100);
+  processResponseHeadersMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  processResponseBodyMessage(*grpc_upstreams_[0], false, absl::nullopt);
+  verifyDownstreamResponse(*response, 200);
+}
+
 TEST_P(ExtProcIntegrationTest, SendHeaderBodyNotSendTrailerTest) {
   proto_config_.mutable_processing_mode()->set_request_header_mode(ProcessingMode::SEND);
   proto_config_.mutable_processing_mode()->set_request_body_mode(ProcessingMode::STREAMED);
diff --git a/test/extensions/filters/http/ext_proc/filter_test.cc b/test/extensions/filters/http/ext_proc/filter_test.cc
index 008974567e..edb3c2b664 100644
--- a/test/extensions/filters/http/ext_proc/filter_test.cc
+++ b/test/extensions/filters/http/ext_proc/filter_test.cc
@@ -2567,6 +2567,51 @@ TEST_F(HttpFilterTest, ProcessingModeOverrideResponseHeaders) {
   EXPECT_EQ(1, config_->stats().streams_closed_.value());
 }
 
+// Set allow_mode_override in filter config to be true.
+// Set send_body_without_waiting_for_header_response to be true
+// In such case, the mode_override in the response will be ignored.
+TEST_F(HttpFilterTest, DisableResponseModeOverrideBySendBodyFlag) {
+  initialize(R"EOF(
+  grpc_service:
+    envoy_grpc:
+      cluster_name: "ext_proc_server"
+  processing_mode:
+    request_header_mode: "SEND"
+    response_header_mode: "SEND"
+  allow_mode_override: true
+  send_body_without_waiting_for_header_response: true
+  )EOF");
+
+  EXPECT_EQ(filter_->config().allowModeOverride(), true);
+  EXPECT_EQ(filter_->config().sendBodyWithoutWaitingForHeaderResponse(), true);
+  EXPECT_EQ(filter_->config().processingMode().response_header_mode(), ProcessingMode::SEND);
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->decodeHeaders(request_headers_, true));
+
+  // When ext_proc server sends back the request header response, it contains the
+  // mode_override for the response_header_mode to be SKIP.
+  processRequestHeaders(
+      false, [](const HttpHeaders&, ProcessingResponse& response, HeadersResponse&) {
+        response.mutable_mode_override()->set_response_header_mode(ProcessingMode::SKIP);
+      });
+
+  response_headers_.addCopy(LowerCaseString(":status"), "200");
+  response_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->encodeHeaders(response_headers_, true));
+
+  // Verify such mode_override is ignored. The response header is still sent to the ext_proc server.
+  processResponseHeaders(false, [](const HttpHeaders& header_resp, ProcessingResponse&,
+                                   HeadersResponse&) {
+    EXPECT_TRUE(header_resp.end_of_stream());
+    TestRequestHeaderMapImpl expected_response{{":status", "200"}, {"content-type", "text/plain"}};
+    EXPECT_THAT(header_resp.headers(), HeaderProtosEqual(expected_response));
+  });
+
+  TestRequestHeaderMapImpl final_expected_response{{":status", "200"},
+                                                   {"content-type", "text/plain"}};
+  EXPECT_THAT(&response_headers_, HeaderMapEqualIgnoreOrder(&final_expected_response));
+  filter_->onDestroy();
+}
+
 // Leaving the allow_mode_override in filter config to be default, which is false.
 // In such case, the mode_override in the response will be ignored.
 TEST_F(HttpFilterTest, DisableResponseModeOverride) {
@@ -3960,6 +4005,283 @@ TEST_F(HttpFilterTest, EmitDynamicMetadataUseLast) {
   filter_->onDestroy();
 }
 
+TEST_F(HttpFilterTest, HeaderRespReceivedBeforeBody) {
+  initialize(R"EOF(
+  grpc_service:
+    envoy_grpc:
+      cluster_name: "ext_proc_server"
+  processing_mode:
+    request_header_mode: "SKIP"
+    response_header_mode: "SEND"
+    response_body_mode: "STREAMED"
+  send_body_without_waiting_for_header_response: true
+  )EOF");
+
+  EXPECT_EQ(config_->sendBodyWithoutWaitingForHeaderResponse(), true);
+
+  // Create synthetic HTTP request
+  HttpTestUtility::addDefaultHeaders(request_headers_);
+  request_headers_.setMethod("POST");
+  request_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  EXPECT_EQ(FilterHeadersStatus::Continue, filter_->decodeHeaders(request_headers_, true));
+
+  response_headers_.addCopy(LowerCaseString(":status"), "200");
+  response_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  bool encoding_watermarked = false;
+  setUpEncodingWatermarking(encoding_watermarked);
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->encodeHeaders(response_headers_, false));
+  // Header response arrives before any body data.
+  processResponseHeaders(false, absl::nullopt);
+
+  Buffer::OwnedImpl want_response_body;
+  Buffer::OwnedImpl got_response_body;
+  EXPECT_CALL(encoder_callbacks_, injectEncodedDataToFilterChain(_, _))
+      .WillRepeatedly(Invoke(
+          [&got_response_body](Buffer::Instance& data, Unused) { got_response_body.move(data); }));
+
+  for (int i = 0; i < 5; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::Continue, filter_->encodeData(resp_chunk, false));
+  }
+
+  // Send body responses
+  for (int i = 0; i < 5; i++) {
+    processResponseBody(
+        [&want_response_body, i](const HttpBody&, ProcessingResponse&, BodyResponse& resp) {
+          auto* body_mut = resp.mutable_response()->mutable_body_mutation();
+          std::string new_body = absl::StrCat(" ", std::to_string(i), " ");
+          body_mut->set_body(new_body);
+          want_response_body.add(new_body);
+        },
+        false);
+  }
+
+  // Send the last empty request chunk.
+  Buffer::OwnedImpl last_resp_chunk;
+  EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(last_resp_chunk, true));
+  processResponseBody(absl::nullopt, true);
+
+  // The two buffers should match.
+  EXPECT_EQ(want_response_body.toString(), got_response_body.toString());
+  EXPECT_FALSE(encoding_watermarked);
+  EXPECT_EQ(config_->stats().spurious_msgs_received_.value(), 0);
+  filter_->onDestroy();
+}
+
+TEST_F(HttpFilterTest, HeaderRespReceivedAfterBodySent) {
+  initialize(R"EOF(
+  grpc_service:
+    envoy_grpc:
+      cluster_name: "ext_proc_server"
+  processing_mode:
+    request_header_mode: "SKIP"
+    response_header_mode: "SEND"
+    response_body_mode: "STREAMED"
+  send_body_without_waiting_for_header_response: true
+  )EOF");
+
+  EXPECT_EQ(config_->sendBodyWithoutWaitingForHeaderResponse(), true);
+
+  // Create synthetic HTTP request
+  HttpTestUtility::addDefaultHeaders(request_headers_);
+  request_headers_.setMethod("POST");
+  request_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  EXPECT_EQ(FilterHeadersStatus::Continue, filter_->decodeHeaders(request_headers_, true));
+
+  response_headers_.addCopy(LowerCaseString(":status"), "200");
+  response_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  bool encoding_watermarked = false;
+  setUpEncodingWatermarking(encoding_watermarked);
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->encodeHeaders(response_headers_, false));
+
+  Buffer::OwnedImpl want_response_body;
+  Buffer::OwnedImpl got_response_body;
+  EXPECT_CALL(encoder_callbacks_, injectEncodedDataToFilterChain(_, _))
+      .WillRepeatedly(Invoke(
+          [&got_response_body](Buffer::Instance& data, Unused) { got_response_body.move(data); }));
+
+  for (int i = 0; i < 5; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(resp_chunk, false));
+  }
+
+  // Header response arrives after some amount of body data sent.
+  auto response = std::make_unique<ProcessingResponse>();
+  (void)response->mutable_response_headers();
+  stream_callbacks_->onReceiveMessage(std::move(response));
+
+  // Three body responses follows the header response.
+  for (int i = 0; i < 2; i++) {
+    processResponseBody(
+        [&want_response_body, i](const HttpBody&, ProcessingResponse&, BodyResponse& resp) {
+          auto* body_mut = resp.mutable_response()->mutable_body_mutation();
+          std::string new_body = absl::StrCat(" ", std::to_string(i), " ");
+          body_mut->set_body(new_body);
+          want_response_body.add(new_body);
+        },
+        false);
+  }
+
+  // Now sends the rest of the body chunks to the server.
+  for (int i = 5; i < 10; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::Continue, filter_->encodeData(resp_chunk, false));
+  }
+
+  // Send body responses
+  for (int i = 2; i < 10; i++) {
+    processResponseBody(
+        [&want_response_body, i](const HttpBody&, ProcessingResponse&, BodyResponse& resp) {
+          auto* body_mut = resp.mutable_response()->mutable_body_mutation();
+          std::string new_body = absl::StrCat(" ", std::to_string(i), " ");
+          body_mut->set_body(new_body);
+          want_response_body.add(new_body);
+        },
+        false);
+  }
+
+  // Send the last empty request chunk.
+  Buffer::OwnedImpl last_resp_chunk;
+  EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(last_resp_chunk, true));
+  processResponseBody(absl::nullopt, true);
+
+  // The two buffers should match.
+  EXPECT_EQ(want_response_body.toString(), got_response_body.toString());
+  EXPECT_FALSE(encoding_watermarked);
+  EXPECT_EQ(config_->stats().spurious_msgs_received_.value(), 0);
+  filter_->onDestroy();
+}
+
+TEST_F(HttpFilterTest, HeaderRespWithStatusContinueAndReplace) {
+  initialize(R"EOF(
+  grpc_service:
+    envoy_grpc:
+      cluster_name: "ext_proc_server"
+  processing_mode:
+    request_header_mode: "SKIP"
+    response_header_mode: "SEND"
+    response_body_mode: "STREAMED"
+  send_body_without_waiting_for_header_response: true
+  )EOF");
+
+  EXPECT_EQ(config_->sendBodyWithoutWaitingForHeaderResponse(), true);
+
+  // Create synthetic HTTP request
+  HttpTestUtility::addDefaultHeaders(request_headers_);
+  request_headers_.setMethod("POST");
+  request_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  EXPECT_EQ(FilterHeadersStatus::Continue, filter_->decodeHeaders(request_headers_, true));
+
+  response_headers_.addCopy(LowerCaseString(":status"), "200");
+  response_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->encodeHeaders(response_headers_, false));
+  for (int i = 0; i < 5; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(resp_chunk, false));
+  }
+
+  Buffer::OwnedImpl resp_buffer;
+  setUpEncodingBuffering(resp_buffer, true);
+  // Header response arrives with status CONTINUE_AND_REPLACE after some amount of body data sent.
+  auto response = std::make_unique<ProcessingResponse>();
+  auto* hdrs_resp = response->mutable_response_headers();
+  hdrs_resp->mutable_response()->set_status(CommonResponse::CONTINUE_AND_REPLACE);
+  hdrs_resp->mutable_response()->mutable_body_mutation()->set_body("Hello, World!");
+  stream_callbacks_->onReceiveMessage(std::move(response));
+
+  // Ensure buffered data was updated
+  EXPECT_EQ(resp_buffer.toString(), "Hello, World!");
+
+  // Since we did CONTINUE_AND_REPLACE, later data is cleared
+  Buffer::OwnedImpl resp_data_1("test");
+  EXPECT_EQ(FilterDataStatus::Continue, filter_->encodeData(resp_data_1, false));
+  EXPECT_EQ(resp_data_1.length(), 0);
+
+  EXPECT_EQ(config_->stats().spurious_msgs_received_.value(), 0);
+  filter_->onDestroy();
+}
+
+TEST_F(HttpFilterTest, StreamedTestInBothDirection) {
+  initialize(R"EOF(
+  grpc_service:
+    envoy_grpc:
+      cluster_name: "ext_proc_server"
+  processing_mode:
+    request_header_mode: "SEND"
+    request_body_mode: "STREAMED"
+    response_header_mode: "SEND"
+    response_body_mode: "STREAMED"
+  send_body_without_waiting_for_header_response: true
+  )EOF");
+
+  EXPECT_EQ(config_->sendBodyWithoutWaitingForHeaderResponse(), true);
+
+  // Create synthetic HTTP request
+  HttpTestUtility::addDefaultHeaders(request_headers_);
+  request_headers_.setMethod("POST");
+  request_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->decodeHeaders(request_headers_, false));
+  for (int i = 0; i < 5; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->decodeData(resp_chunk, false));
+  }
+  // Send the last empty request chunk.
+  Buffer::OwnedImpl last_req_chunk;
+  EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->decodeData(last_req_chunk, true));
+  // Header response arrives
+  auto req_response = std::make_unique<ProcessingResponse>();
+  (void)req_response->mutable_request_headers();
+  EXPECT_CALL(decoder_callbacks_, continueDecoding());
+  stream_callbacks_->onReceiveMessage(std::move(req_response));
+
+  // Data response arrives
+  for (int i = 0; i < 5; i++) {
+    processRequestBody(absl::nullopt, false);
+  }
+  processRequestBody(absl::nullopt, false);
+
+  response_headers_.addCopy(LowerCaseString(":status"), "200");
+  response_headers_.addCopy(LowerCaseString("content-type"), "text/plain");
+
+  bool encoding_watermarked = false;
+  setUpEncodingWatermarking(encoding_watermarked);
+  EXPECT_EQ(FilterHeadersStatus::StopIteration, filter_->encodeHeaders(response_headers_, false));
+
+  for (int i = 0; i < 7; i++) {
+    Buffer::OwnedImpl resp_chunk;
+    TestUtility::feedBufferWithRandomCharacters(resp_chunk, 100);
+    EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(resp_chunk, false));
+  }
+
+  auto resp_response = std::make_unique<ProcessingResponse>();
+  (void)resp_response->mutable_response_headers();
+  stream_callbacks_->onReceiveMessage(std::move(resp_response));
+
+  // Send body responses
+  for (int i = 0; i < 7; i++) {
+    processResponseBody(absl::nullopt, false);
+  }
+
+  // Send the last empty request chunk.
+  Buffer::OwnedImpl last_resp_chunk;
+  EXPECT_EQ(FilterDataStatus::StopIterationNoBuffer, filter_->encodeData(last_resp_chunk, true));
+  processResponseBody(absl::nullopt, true);
+
+  EXPECT_EQ(config_->stats().spurious_msgs_received_.value(), 0);
+  filter_->onDestroy();
+}
+
 // Verify if ext_proc filter is in the upstream filter chain, and if the ext_proc server
 // sends back response with clear_route_cache set to true, it is ignored.
 TEST_F(HttpFilterTest, ClearRouteCacheHeaderMutationUpstreamIgnored) {
diff --git a/test/extensions/filters/http/ext_proc/http_client/BUILD b/test/extensions/filters/http/ext_proc/http_client/BUILD
index d5c2826982..0cc7d2bdab 100644
--- a/test/extensions/filters/http/ext_proc/http_client/BUILD
+++ b/test/extensions/filters/http/ext_proc/http_client/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["http_client_test.cc"],
     extension_names = ["envoy.filters.http.ext_proc"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/http:message_lib",
diff --git a/test/extensions/filters/http/ext_proc/mock_server.cc b/test/extensions/filters/http/ext_proc/mock_server.cc
index 25286be792..29637f793f 100644
--- a/test/extensions/filters/http/ext_proc/mock_server.cc
+++ b/test/extensions/filters/http/ext_proc/mock_server.cc
@@ -5,7 +5,13 @@ namespace Extensions {
 namespace HttpFilters {
 namespace ExternalProcessing {
 
-MockClient::MockClient() = default;
+MockClient::MockClient() {
+  EXPECT_CALL(*this, stream()).WillRepeatedly(testing::Invoke([this]() { return stream_; }));
+
+  EXPECT_CALL(*this, setStream(testing::_))
+      .WillRepeatedly(
+          testing::Invoke([this](ExternalProcessorStream* stream) -> void { stream_ = stream; }));
+}
 MockClient::~MockClient() = default;
 
 MockStream::MockStream() = default;
diff --git a/test/extensions/filters/http/ext_proc/mock_server.h b/test/extensions/filters/http/ext_proc/mock_server.h
index d0b0389b0f..12c9d7308a 100644
--- a/test/extensions/filters/http/ext_proc/mock_server.h
+++ b/test/extensions/filters/http/ext_proc/mock_server.h
@@ -17,6 +17,10 @@ class MockClient : public ExternalProcessorClient {
               (ExternalProcessorCallbacks&, const Grpc::GrpcServiceConfigWithHashKey&,
                const Envoy::Http::AsyncClient::StreamOptions&,
                Envoy::Http::StreamFilterSidestreamWatermarkCallbacks&));
+  MOCK_METHOD(ExternalProcessorStream*, stream, ());
+  MOCK_METHOD(void, setStream, (ExternalProcessorStream * stream));
+
+  ExternalProcessorStream* stream_ = nullptr;
 };
 
 class MockStream : public ExternalProcessorStream {
diff --git a/test/extensions/filters/http/ext_proc/unit_test_fuzz/BUILD b/test/extensions/filters/http/ext_proc/unit_test_fuzz/BUILD
index 13649e7309..66a015876a 100644
--- a/test/extensions/filters/http/ext_proc/unit_test_fuzz/BUILD
+++ b/test/extensions/filters/http/ext_proc/unit_test_fuzz/BUILD
@@ -1,7 +1,6 @@
 load(
     "//bazel:envoy_build_system.bzl",
     "envoy_cc_fuzz_test",
-    "envoy_cc_mock",
     "envoy_package",
     "envoy_proto_library",
 )
@@ -10,16 +9,6 @@ licenses(["notice"])  # Apache 2
 
 envoy_package()
 
-envoy_cc_mock(
-    name = "ext_proc_mocks",
-    hdrs = ["mocks.h"],
-    tags = ["skip_on_windows"],
-    deps = [
-        "//source/extensions/filters/http/ext_proc:client_interface",
-        "@envoy_api//envoy/service/ext_proc/v3:pkg_cc_proto",
-    ],
-)
-
 envoy_proto_library(
     name = "ext_proc_unit_test_fuzz_proto",
     srcs = ["ext_proc_unit_test_fuzz.proto"],
@@ -34,12 +23,13 @@ envoy_cc_fuzz_test(
     name = "ext_proc_unit_test_fuzz",
     srcs = ["ext_proc_unit_test_fuzz.cc"],
     corpus = "ext_proc_corpus",
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
-        ":ext_proc_mocks",
         ":ext_proc_unit_test_fuzz_proto_cc_proto",
         "//source/extensions/filters/http/ext_proc:config",
         "//test/extensions/filters/http/common/fuzz:http_filter_fuzzer_lib",
+        "//test/extensions/filters/http/ext_proc:mock_server_lib",
         "//test/mocks/http:http_mocks",
         "//test/mocks/network:network_mocks",
         "//test/mocks/server:server_factory_context_mocks",
diff --git a/test/extensions/filters/http/ext_proc/unit_test_fuzz/ext_proc_unit_test_fuzz.cc b/test/extensions/filters/http/ext_proc/unit_test_fuzz/ext_proc_unit_test_fuzz.cc
index df321fe204..25c6b3ac2d 100644
--- a/test/extensions/filters/http/ext_proc/unit_test_fuzz/ext_proc_unit_test_fuzz.cc
+++ b/test/extensions/filters/http/ext_proc/unit_test_fuzz/ext_proc_unit_test_fuzz.cc
@@ -1,8 +1,8 @@
 #include "source/extensions/filters/http/ext_proc/ext_proc.h"
 
 #include "test/extensions/filters/http/common/fuzz/http_filter_fuzzer.h"
+#include "test/extensions/filters/http/ext_proc/mock_server.h"
 #include "test/extensions/filters/http/ext_proc/unit_test_fuzz/ext_proc_unit_test_fuzz.pb.validate.h"
-#include "test/extensions/filters/http/ext_proc/unit_test_fuzz/mocks.h"
 #include "test/fuzz/fuzz_runner.h"
 #include "test/mocks/http/mocks.h"
 #include "test/mocks/network/mocks.h"
@@ -69,6 +69,14 @@ DEFINE_PROTO_FUZZER(
     return;
   }
 
+  // Limiting the max supported request body size to 128k.
+  if (input.request().has_proto_body()) {
+    const uint32_t max_body_size = 128 * 1024;
+    if (input.request().proto_body().message().value().size() > max_body_size) {
+      return;
+    }
+  }
+
   static FuzzerMocks mocks;
   NiceMock<Stats::MockIsolatedStatsStore> stats_store;
 
@@ -88,7 +96,7 @@ DEFINE_PROTO_FUZZER(
     return;
   }
 
-  MockClient* client = new MockClient();
+  ExternalProcessing::MockClient* client = new ExternalProcessing::MockClient();
   std::unique_ptr<ExternalProcessing::Filter> filter = std::make_unique<ExternalProcessing::Filter>(
       config, ExternalProcessing::ExternalProcessorClientPtr{client}, proto_config.grpc_service());
   filter->setDecoderFilterCallbacks(mocks.decoder_callbacks_);
@@ -100,7 +108,7 @@ DEFINE_PROTO_FUZZER(
                                  const Envoy::Http::AsyncClient::StreamOptions&,
                                  Envoy::Http::StreamFilterSidestreamWatermarkCallbacks&)
                                  -> ExternalProcessing::ExternalProcessorStreamPtr {
-        auto stream = std::make_unique<MockStream>();
+        auto stream = std::make_unique<ExternalProcessing::MockStream>();
         EXPECT_CALL(*stream, send(_, _))
             .WillRepeatedly(Invoke([&](envoy::service::ext_proc::v3::ProcessingRequest&&,
                                        bool) -> void {
diff --git a/test/extensions/filters/http/ext_proc/unit_test_fuzz/mocks.h b/test/extensions/filters/http/ext_proc/unit_test_fuzz/mocks.h
deleted file mode 100644
index 49ff067dd3..0000000000
--- a/test/extensions/filters/http/ext_proc/unit_test_fuzz/mocks.h
+++ /dev/null
@@ -1,44 +0,0 @@
-#pragma once
-
-#include "envoy/service/ext_proc/v3/external_processor.pb.h"
-
-#include "source/extensions/filters/http/ext_proc/client.h"
-
-#include "gmock/gmock.h"
-
-namespace Envoy {
-namespace Extensions {
-namespace HttpFilters {
-namespace ExtProc {
-namespace UnitTestFuzz {
-
-class MockStream : public ExternalProcessing::ExternalProcessorStream {
-public:
-  MockStream() = default;
-  ~MockStream() override = default;
-
-  MOCK_METHOD(void, send,
-              (envoy::service::ext_proc::v3::ProcessingRequest && request, bool end_stream));
-  MOCK_METHOD(bool, close, ());
-  MOCK_METHOD(const StreamInfo::StreamInfo&, streamInfo, (), (const override));
-  MOCK_METHOD(StreamInfo::StreamInfo&, streamInfo, ());
-  MOCK_METHOD(void, notifyFilterDestroy, ());
-};
-
-class MockClient : public ExternalProcessing::ExternalProcessorClient {
-public:
-  MockClient() = default;
-  ~MockClient() override = default;
-
-  MOCK_METHOD(ExternalProcessing::ExternalProcessorStreamPtr, start,
-              (ExternalProcessing::ExternalProcessorCallbacks & callbacks,
-               const Grpc::GrpcServiceConfigWithHashKey& config_with_hash_key,
-               const Envoy::Http::AsyncClient::StreamOptions&,
-               Envoy::Http::StreamFilterSidestreamWatermarkCallbacks&));
-};
-
-} // namespace UnitTestFuzz
-} // namespace ExtProc
-} // namespace HttpFilters
-} // namespace Extensions
-} // namespace Envoy
diff --git a/test/extensions/filters/http/fault/BUILD b/test/extensions/filters/http/fault/BUILD
index 10fe11a571..ee17d03c03 100644
--- a/test/extensions/filters/http/fault/BUILD
+++ b/test/extensions/filters/http/fault/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "fault_filter_test",
     srcs = ["fault_filter_test.cc"],
     extension_names = ["envoy.filters.http.fault"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//envoy/event:dispatcher_interface",
@@ -42,6 +43,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.fault"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/extensions/filters/http/fault:config",
@@ -56,6 +58,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["fault_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.fault"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/fault:config",
         "//test/integration:http_protocol_integration_lib",
diff --git a/test/extensions/filters/http/file_system_buffer/BUILD b/test/extensions/filters/http/file_system_buffer/BUILD
index 661945a575..a42d1358c7 100644
--- a/test/extensions/filters/http/file_system_buffer/BUILD
+++ b/test/extensions/filters/http/file_system_buffer/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "fragment_test",
     srcs = ["fragment_test.cc"],
     extension_names = ["envoy.filters.http.file_system_buffer"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/file_system_buffer:fragment",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
         "filter_test.cc",
     ],
     extension_names = ["envoy.filters.http.file_system_buffer"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/file_system_buffer:config",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
         "filter_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.file_system_buffer"],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
diff --git a/test/extensions/filters/http/gcp_authn/BUILD b/test/extensions/filters/http/gcp_authn/BUILD
index c6f7d88b38..f6bb4df1b7 100644
--- a/test/extensions/filters/http/gcp_authn/BUILD
+++ b/test/extensions/filters/http/gcp_authn/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["filter_config_test.cc"],
     extension_names = ["envoy.filters.http.gcp_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:message_lib",
         "//source/extensions/filters/http/gcp_authn:config",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["gcp_authn_filter_test.cc"],
     extension_names = ["envoy.filters.http.gcp_authn"],
+    rbe_pool = "2core",
     deps = [
         ":gcp_authn_mocks",
         "//source/extensions/filters/http/gcp_authn",
@@ -59,6 +61,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["gcp_authn_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.gcp_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/gcp_authn",
         "//source/extensions/filters/http/gcp_authn:config",
@@ -77,6 +80,7 @@ envoy_extension_cc_test(
     name = "token_cache_test",
     srcs = ["token_cache_test.cc"],
     extension_names = ["envoy.filters.http.gcp_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/gcp_authn",
         "//source/extensions/filters/http/gcp_authn:config",
diff --git a/test/extensions/filters/http/geoip/BUILD b/test/extensions/filters/http/geoip/BUILD
index 915ad3fde0..471d9b5e39 100644
--- a/test/extensions/filters/http/geoip/BUILD
+++ b/test/extensions/filters/http/geoip/BUILD
@@ -23,6 +23,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.geoip"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":geoip_mocks",
@@ -40,6 +41,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["geoip_filter_test.cc"],
     extension_names = ["envoy.filters.http.geoip"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":dummy_cc_proto",
@@ -67,6 +69,7 @@ envoy_extension_cc_test(
     extension_names = [
         "envoy.filters.http.geoip",
     ],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/geoip:config",
diff --git a/test/extensions/filters/http/grpc_field_extraction/BUILD b/test/extensions/filters/http/grpc_field_extraction/BUILD
index 5c606a2ccf..72726101f4 100644
--- a/test/extensions/filters/http/grpc_field_extraction/BUILD
+++ b/test/extensions/filters/http/grpc_field_extraction/BUILD
@@ -16,6 +16,7 @@ envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     data = ["//test/proto:apikeys_proto_descriptor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_field_extraction:extractor",
         "//source/extensions/filters/http/grpc_field_extraction:filter",
@@ -35,6 +36,7 @@ envoy_cc_test(
         "//test/config/integration/certs",
         "//test/proto:apikeys_proto_descriptor",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_field_extraction:extractor",
         "//source/extensions/filters/http/grpc_field_extraction:extractor_impl",
@@ -55,6 +57,7 @@ envoy_extension_cc_test(
     ],
     data = ["//test/proto:apikeys_proto_descriptor"],
     extension_names = ["envoy.filters.http.grpc_field_extraction"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_field_extraction:config",
         "//test/extensions/filters/http/grpc_field_extraction/message_converter:message_converter_test_lib",
diff --git a/test/extensions/filters/http/grpc_field_extraction/message_converter/BUILD b/test/extensions/filters/http/grpc_field_extraction/message_converter/BUILD
index a26bf073a0..901955ff79 100644
--- a/test/extensions/filters/http/grpc_field_extraction/message_converter/BUILD
+++ b/test/extensions/filters/http/grpc_field_extraction/message_converter/BUILD
@@ -24,6 +24,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "message_converter_utility_test",
     srcs = ["message_converter_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":message_converter_test_lib",
         "//source/extensions/filters/http/grpc_field_extraction/message_converter:message_converter_utility_lib",
@@ -37,6 +38,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "message_converter_test",
     srcs = ["message_converter_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":message_converter_test_lib",
         "//source/extensions/filters/http/grpc_field_extraction/message_converter:message_converter_lib",
@@ -51,6 +53,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stream_message_test",
     srcs = ["stream_message_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_field_extraction/message_converter:stream_message_lib",
     ],
diff --git a/test/extensions/filters/http/grpc_http1_bridge/BUILD b/test/extensions/filters/http/grpc_http1_bridge/BUILD
index 6820d4c4b0..7ce56dc32f 100644
--- a/test/extensions/filters/http/grpc_http1_bridge/BUILD
+++ b/test/extensions/filters/http/grpc_http1_bridge/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "http1_bridge_filter_test",
     srcs = ["http1_bridge_filter_test.cc"],
     extension_names = ["envoy.filters.http.grpc_http1_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.grpc_http1_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_http1_bridge:config",
         "//test/mocks/server:factory_context_mocks",
@@ -43,6 +45,7 @@ envoy_extension_cc_test(
         "grpc_http1_bridge_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.grpc_http1_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/http:headers_lib",
diff --git a/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD b/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
index 4d60dd766b..d5aa790196 100644
--- a/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
+++ b/test/extensions/filters/http/grpc_http1_reverse_bridge/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "reverse_bridge_test",
     srcs = ["reverse_bridge_test.cc"],
     extension_names = ["envoy.filters.http.grpc_http1_reverse_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["reverse_bridge_integration_test.cc"],
     extension_names = ["envoy.filters.http.grpc_http1_reverse_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -45,6 +47,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.grpc_http1_reverse_bridge"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_http1_reverse_bridge:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/grpc_json_transcoder/BUILD b/test/extensions/filters/http/grpc_json_transcoder/BUILD
index 295cda3c57..4fed96f851 100644
--- a/test/extensions/filters/http/grpc_json_transcoder/BUILD
+++ b/test/extensions/filters/http/grpc_json_transcoder/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
         "//test/proto:bookstore_proto_descriptor",
     ],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_json_transcoder:json_transcoder_filter_lib",
         "//test/mocks/http:http_mocks",
@@ -34,6 +35,7 @@ envoy_extension_cc_test(
     name = "http_body_utils_test",
     srcs = ["http_body_utils_test.cc"],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/buffer:zero_copy_input_stream_lib",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
     name = "transcoder_input_stream_test",
     srcs = ["transcoder_input_stream_test.cc"],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/filters/http/grpc_json_transcoder:transcoder_input_stream_lib",
@@ -63,6 +66,7 @@ envoy_extension_cc_test(
         "//test/proto:bookstore_proto_descriptor",
     ],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -81,6 +85,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_json_transcoder:config",
         "//test/mocks/server:factory_context_mocks",
@@ -96,6 +101,7 @@ envoy_extension_cc_test(
         "//test/proto:bookstore_proto_descriptor",
     ],
     extension_names = ["envoy.filters.http.grpc_json_transcoder"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:utility_lib",
         "//source/common/protobuf",
diff --git a/test/extensions/filters/http/grpc_stats/BUILD b/test/extensions/filters/http/grpc_stats/BUILD
index 7a19a06f19..1b15be6251 100644
--- a/test/extensions/filters/http/grpc_stats/BUILD
+++ b/test/extensions/filters/http/grpc_stats/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.grpc_stats"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/grpc:common_lib",
         "//source/extensions/filters/http/grpc_stats:config",
diff --git a/test/extensions/filters/http/grpc_web/BUILD b/test/extensions/filters/http/grpc_web/BUILD
index 0981f9f45c..fdf246403a 100644
--- a/test/extensions/filters/http/grpc_web/BUILD
+++ b/test/extensions/filters/http/grpc_web/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "grpc_web_filter_test",
     srcs = ["grpc_web_filter_test.cc"],
     extension_names = ["envoy.filters.http.grpc_web"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_web:grpc_web_filter_lib",
         "//test/mocks/http:http_mocks",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.grpc_web"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/grpc_web:config",
         "//test/mocks/server:factory_context_mocks",
@@ -38,6 +40,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["grpc_web_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.grpc_web"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
diff --git a/test/extensions/filters/http/header_mutation/BUILD b/test/extensions/filters/http/header_mutation/BUILD
index aa1e81ee71..563272b10c 100644
--- a/test/extensions/filters/http/header_mutation/BUILD
+++ b/test/extensions/filters/http/header_mutation/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "header_mutation_test.cc",
     ],
     extension_names = ["envoy.filters.http.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/filters/http/header_mutation:config",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/filters/http/header_mutation:config",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["header_mutation_integration_test.cc"],
     extension_names = ["envoy.filters.http.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/filters/http/header_mutation:config",
diff --git a/test/extensions/filters/http/header_to_metadata/BUILD b/test/extensions/filters/http/header_to_metadata/BUILD
index 2965c4af1d..ac1e2f6d53 100644
--- a/test/extensions/filters/http/header_to_metadata/BUILD
+++ b/test/extensions/filters/http/header_to_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "header_to_metadata_filter_test",
     srcs = ["header_to_metadata_filter_test.cc"],
     extension_names = ["envoy.filters.http.header_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:base64_lib",
         "//source/extensions/filters/http/header_to_metadata:header_to_metadata_filter_lib",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.header_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/header_to_metadata:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/health_check/BUILD b/test/extensions/filters/http/health_check/BUILD
index 8d7a622ebf..d7268b8954 100644
--- a/test/extensions/filters/http/health_check/BUILD
+++ b/test/extensions/filters/http/health_check/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "health_check_test",
     srcs = ["health_check_test.cc"],
     extension_names = ["envoy.filters.http.health_check"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_utility_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.health_check"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/health_check:config",
         "//test/mocks/server:factory_context_mocks",
@@ -45,6 +47,7 @@ envoy_extension_cc_test(
         "health_check_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.health_check"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/buffer:config",
         "//source/extensions/filters/http/health_check:config",
diff --git a/test/extensions/filters/http/ip_tagging/BUILD b/test/extensions/filters/http/ip_tagging/BUILD
index e2a8b6472b..8f68c8f188 100644
--- a/test/extensions/filters/http/ip_tagging/BUILD
+++ b/test/extensions/filters/http/ip_tagging/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "ip_tagging_filter_test",
     srcs = ["ip_tagging_filter_test.cc"],
     extension_names = ["envoy.filters.http.ip_tagging"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["ip_tagging_integration_test.cc"],
     extension_names = ["envoy.filters.http.ip_tagging"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/ip_tagging:config",
         "//test/integration:http_integration_lib",
diff --git a/test/extensions/filters/http/json_to_metadata/BUILD b/test/extensions/filters/http/json_to_metadata/BUILD
index c679f76c9f..93572fdf29 100644
--- a/test/extensions/filters/http/json_to_metadata/BUILD
+++ b/test/extensions/filters/http/json_to_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.json_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/json_to_metadata:json_to_metadata_lib",
         "//test/common/stream_info:test_util",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.json_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/json_to_metadata:config",
         "//test/mocks/server:server_mocks",
@@ -38,6 +40,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.filters.http.json_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/json_to_metadata:config",
         "//test/integration:http_protocol_integration_lib",
diff --git a/test/extensions/filters/http/jwt_authn/BUILD b/test/extensions/filters/http/jwt_authn/BUILD
index 2603b1f91c..9b766a5fa7 100644
--- a/test/extensions/filters/http/jwt_authn/BUILD
+++ b/test/extensions/filters/http/jwt_authn/BUILD
@@ -35,6 +35,7 @@ envoy_extension_cc_test(
     name = "extractor_test",
     srcs = ["extractor_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/jwt_authn:extractor_lib",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
@@ -48,6 +49,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         ":mock_lib",
         "//source/extensions/filters/http/jwt_authn:filter_lib",
@@ -60,6 +62,7 @@ envoy_extension_cc_test(
     name = "filter_config_test",
     srcs = ["filter_config_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/common/stream_info:filter_state_lib",
@@ -76,6 +79,7 @@ envoy_extension_cc_test(
     name = "jwks_async_fetcher_test",
     srcs = ["jwks_async_fetcher_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/jwt_authn:jwks_async_fetcher_lib",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
@@ -87,6 +91,7 @@ envoy_extension_cc_test(
     name = "filter_factory_test",
     srcs = ["filter_factory_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/jwt_authn:config",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
@@ -99,6 +104,7 @@ envoy_extension_cc_test(
     name = "jwks_cache_test",
     srcs = ["jwks_cache_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:isolated_store_lib",
         "//source/extensions/filters/http/common:jwks_fetcher_lib",
@@ -114,6 +120,7 @@ envoy_extension_cc_test(
     name = "jwt_cache_test",
     srcs = ["jwt_cache_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/jwt_authn:jwt_cache_lib",
         "//test/extensions/filters/http/jwt_authn:test_common_lib",
@@ -127,6 +134,7 @@ envoy_extension_cc_test(
     name = "authenticator_test",
     srcs = ["authenticator_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         ":mock_lib",
         "//source/common/common:base64_lib",
@@ -151,6 +159,7 @@ envoy_extension_cc_test(
         "envoy.filters.http.jwt_authn",
         "envoy.filters.http.set_filter_state",
     ],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
@@ -173,6 +182,7 @@ envoy_extension_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         ":mock_lib",
         ":test_common_lib",
@@ -187,6 +197,7 @@ envoy_extension_cc_test(
     name = "group_verifier_test",
     srcs = ["group_verifier_test.cc"],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         ":mock_lib",
         ":test_common_lib",
@@ -203,6 +214,7 @@ envoy_extension_cc_test(
         "provider_verifier_test.cc",
     ],
     extension_names = ["envoy.filters.http.jwt_authn"],
+    rbe_pool = "2core",
     deps = [
         ":mock_lib",
         ":test_common_lib",
@@ -227,6 +239,7 @@ envoy_cc_fuzz_test(
     name = "jwt_authn_fuzz_test",
     srcs = ["jwt_authn_fuzz_test.cc"],
     corpus = "jwt_authn_corpus",
+    rbe_pool = "2core",
     deps = [
         ":jwt_authn_fuzz_proto_cc_proto",
         "//source/common/common:regex_lib",
diff --git a/test/extensions/filters/http/kill_request/BUILD b/test/extensions/filters/http/kill_request/BUILD
index da485bc039..06c670dc01 100644
--- a/test/extensions/filters/http/kill_request/BUILD
+++ b/test/extensions/filters/http/kill_request/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "kill_request_filter_test",
     srcs = ["kill_request_filter_test.cc"],
     extension_names = ["envoy.filters.http.kill_request"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:metadata_interface",
         "//source/common/buffer:buffer_lib",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     name = "kill_request_config_test",
     srcs = ["kill_request_config_test.cc"],
     extension_names = ["envoy.filters.http.kill_request"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/kill_request:kill_request_config",
         "//test/mocks/server:factory_context_mocks",
@@ -45,6 +47,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["kill_request_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.kill_request"],
+    rbe_pool = "2core",
     shard_count = 8,
     deps = [
         "//source/extensions/filters/http/kill_request:kill_request_config",
@@ -57,6 +60,7 @@ envoy_cc_test(
     size = "large",
     srcs = ["crash_integration_test.cc"],
     coverage = False,
+    rbe_pool = "2core",
     shard_count = 8,
     deps = [
         "//source/extensions/filters/http/kill_request:kill_request_config",
diff --git a/test/extensions/filters/http/local_ratelimit/BUILD b/test/extensions/filters/http/local_ratelimit/BUILD
index a120d6875c..bb876c07f7 100644
--- a/test/extensions/filters/http/local_ratelimit/BUILD
+++ b/test/extensions/filters/http/local_ratelimit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.local_ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/singleton:manager_impl_lib",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.local_ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/local_ratelimit:config",
         "//test/mocks/server:server_mocks",
@@ -44,6 +46,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["local_ratelimit_integration_test.cc"],
     extension_names = ["envoy.filters.http.local_ratelimit"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
diff --git a/test/extensions/filters/http/lua/BUILD b/test/extensions/filters/http/lua/BUILD
index a00710c01f..c29134bdaf 100644
--- a/test/extensions/filters/http/lua/BUILD
+++ b/test/extensions/filters/http/lua/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "lua_filter_test",
     srcs = ["lua_filter_test.cc"],
     extension_names = ["envoy.filters.http.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:stream_info_lib",
         "//source/extensions/filters/http/lua:lua_filter_lib",
@@ -36,6 +37,7 @@ envoy_extension_cc_test(
     name = "wrappers_test",
     srcs = ["wrappers_test.cc"],
     extension_names = ["envoy.filters.http.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/stream_info:stream_info_lib",
@@ -52,6 +54,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["lua_integration_test.cc"],
     extension_names = ["envoy.filters.http.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/lua:config",
         "//test/config:v2_link_hacks",
@@ -66,6 +69,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/lua:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/match_delegate/BUILD b/test/extensions/filters/http/match_delegate/BUILD
index 9c57c18b1b..bc2ffd4124 100644
--- a/test/extensions/filters/http/match_delegate/BUILD
+++ b/test/extensions/filters/http/match_delegate/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/match_delegate:config",
         "//test/mocks/server:factory_context_mocks",
@@ -21,6 +22,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "match_delegate_integration_test",
     srcs = ["match_delegate_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/common:factory_base_lib",
         "//source/extensions/filters/http/match_delegate:config",
diff --git a/test/extensions/filters/http/oauth2/BUILD b/test/extensions/filters/http/oauth2/BUILD
index 6b9b45110f..027fd92d2e 100644
--- a/test/extensions/filters/http/oauth2/BUILD
+++ b/test/extensions/filters/http/oauth2/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.oauth2"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/oauth2:config",
         "//test/mocks/server:factory_context_mocks",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["oauth_integration_test.cc"],
     extension_names = ["envoy.filters.http.oauth2"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:base64_lib",
         "//source/common/http:utility_lib",
@@ -42,6 +44,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.oauth2"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/secret:secret_manager_impl_lib",
         "//source/extensions/filters/http/oauth2:config",
@@ -60,6 +63,7 @@ envoy_extension_cc_test(
     name = "oauth_client_test",
     srcs = ["oauth_test.cc"],
     extension_names = ["envoy.filters.http.oauth2"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/oauth2:oauth_client",
         "//test/integration:http_integration_lib",
diff --git a/test/extensions/filters/http/on_demand/BUILD b/test/extensions/filters/http/on_demand/BUILD
index 4de58cb23e..8a0923fb3e 100644
--- a/test/extensions/filters/http/on_demand/BUILD
+++ b/test/extensions/filters/http/on_demand/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "on_demand_filter_test",
     srcs = ["on_demand_filter_test.cc"],
     extension_names = ["envoy.filters.http.on_demand"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/common/protobuf:utility_lib",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["on_demand_integration_test.cc"],
     extension_names = ["envoy.filters.http.on_demand"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -55,6 +57,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["odcds_integration_test.cc"],
     extension_names = ["envoy.filters.http.on_demand"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:macros",
         "//source/extensions/filters/http/on_demand:config",
diff --git a/test/extensions/filters/http/original_src/BUILD b/test/extensions/filters/http/original_src/BUILD
index dddbc87589..217a3663ef 100644
--- a/test/extensions/filters/http/original_src/BUILD
+++ b/test/extensions/filters/http/original_src/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/original_src:config_lib",
         "@envoy_api//envoy/extensions/filters/http/original_src/v3:pkg_cc_proto",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "original_src_config_factory_test",
     srcs = ["original_src_config_factory_test.cc"],
     extension_names = ["envoy.filters.http.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/original_src:config",
         "//source/extensions/filters/http/original_src:config_lib",
@@ -38,6 +40,7 @@ envoy_extension_cc_test(
     name = "original_src_test",
     srcs = ["original_src_test.cc"],
     extension_names = ["envoy.filters.http.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:socket_option_lib",
         "//source/extensions/filters/http/original_src:original_src_lib",
diff --git a/test/extensions/filters/http/proto_message_extraction/BUILD b/test/extensions/filters/http/proto_message_extraction/BUILD
index 77099dca0a..3013d52808 100644
--- a/test/extensions/filters/http/proto_message_extraction/BUILD
+++ b/test/extensions/filters/http/proto_message_extraction/BUILD
@@ -16,6 +16,7 @@ envoy_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     data = ["//test/proto:apikeys_proto_descriptor"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/proto_message_extraction:extractor",
         "//source/extensions/filters/http/proto_message_extraction:filter",
@@ -35,6 +36,7 @@ envoy_cc_test(
         "//test/config/integration/certs",
         "//test/proto:apikeys_proto_descriptor",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/proto_message_extraction:config",
         "//source/extensions/filters/http/proto_message_extraction:extractor",
@@ -56,6 +58,7 @@ envoy_extension_cc_test(
     ],
     data = ["//test/proto:apikeys_proto_descriptor"],
     extension_names = ["envoy.filters.http.proto_message_extraction"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/proto_message_extraction:config",
         "//test/extensions/filters/http/grpc_field_extraction/message_converter:message_converter_test_lib",
diff --git a/test/extensions/filters/http/proto_message_extraction/extraction_util/BUILD b/test/extensions/filters/http/proto_message_extraction/extraction_util/BUILD
index 3d933ebb9d..e29a80aa26 100644
--- a/test/extensions/filters/http/proto_message_extraction/extraction_util/BUILD
+++ b/test/extensions/filters/http/proto_message_extraction/extraction_util/BUILD
@@ -15,6 +15,7 @@ envoy_cc_test(
         "//test/proto:extraction.proto",
         "//test/proto:extraction_proto_descriptor",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/proto_message_extraction/extraction_util",
         "//test/proto:extraction_proto_cc_proto",
diff --git a/test/extensions/filters/http/rate_limit_quota/BUILD b/test/extensions/filters/http/rate_limit_quota/BUILD
index bda2e3eac4..5759ebbfaa 100644
--- a/test/extensions/filters/http/rate_limit_quota/BUILD
+++ b/test/extensions/filters/http/rate_limit_quota/BUILD
@@ -29,6 +29,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.rate_limit_quota"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/http:message_lib",
@@ -44,6 +45,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.rate_limit_quota"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":client_test_utils",
@@ -65,6 +67,7 @@ envoy_extension_cc_test(
     size = "small",
     srcs = ["client_test.cc"],
     extension_names = ["envoy.filters.http.rate_limit_quota"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":client_test_utils",
@@ -104,6 +107,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.filters.http.rate_limit_quota"],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
diff --git a/test/extensions/filters/http/ratelimit/BUILD b/test/extensions/filters/http/ratelimit/BUILD
index 0b81578c88..66ace82fef 100644
--- a/test/extensions/filters/http/ratelimit/BUILD
+++ b/test/extensions/filters/http/ratelimit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "ratelimit_test",
     srcs = ["ratelimit_test.cc"],
     extension_names = ["envoy.filters.http.ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:empty_string",
@@ -38,6 +39,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/ratelimit:config",
         "//test/mocks/server:factory_context_mocks",
@@ -52,6 +54,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["ratelimit_integration_test.cc"],
     extension_names = ["envoy.filters.http.ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/grpc:codec_lib",
@@ -72,6 +75,7 @@ envoy_extension_cc_test(
     name = "ratelimit_headers_test",
     srcs = ["ratelimit_headers_test.cc"],
     extension_names = ["envoy.filters.http.cache"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/ratelimit:ratelimit_headers_lib",
         "//test/extensions/filters/common/ratelimit:ratelimit_utils",
diff --git a/test/extensions/filters/http/rbac/BUILD b/test/extensions/filters/http/rbac/BUILD
index 92e1d8ab3b..27a5404936 100644
--- a/test/extensions/filters/http/rbac/BUILD
+++ b/test/extensions/filters/http/rbac/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/http/rbac:config",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     name = "rbac_filter_test",
     srcs = ["rbac_filter_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/common/matcher:matcher_lib",
@@ -60,6 +62,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["rbac_filter_integration_test.cc"],
     extension_names = ["envoy.filters.http.rbac"],
+    rbe_pool = "2core",
     shard_count = 3,
     tags = ["skip_on_windows"],
     deps = [
@@ -105,6 +108,7 @@ envoy_cc_fuzz_test(
     name = "rbac_filter_fuzz_test",
     srcs = ["rbac_filter_fuzz_test.cc"],
     corpus = "rbac_filter_corpus",
+    rbe_pool = "2core",
     deps = [
         ":rbac_filter_fuzz_proto_cc_proto",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/http/router/BUILD b/test/extensions/filters/http/router/BUILD
index dc78f02d36..20e86f4464 100644
--- a/test/extensions/filters/http/router/BUILD
+++ b/test/extensions/filters/http/router/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.router"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/router:config",
         "//test/mocks/server:factory_context_mocks",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.filters.http.router"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/router:config",
         "//test/integration:http_integration_lib",
diff --git a/test/extensions/filters/http/set_filter_state/BUILD b/test/extensions/filters/http/set_filter_state/BUILD
index 1b57607136..c82a19aab6 100644
--- a/test/extensions/filters/http/set_filter_state/BUILD
+++ b/test/extensions/filters/http/set_filter_state/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.set_filter_state"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/common/router:string_accessor_lib",
diff --git a/test/extensions/filters/http/set_metadata/BUILD b/test/extensions/filters/http/set_metadata/BUILD
index 4c6e2024e1..9d813831ba 100644
--- a/test/extensions/filters/http/set_metadata/BUILD
+++ b/test/extensions/filters/http/set_metadata/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "set_metadata_filter_test.cc",
     ],
     extension_names = ["envoy.filters.http.set_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/set_metadata:config",
         "//test/integration:http_integration_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.set_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/set_metadata:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/http/stateful_session/BUILD b/test/extensions/filters/http/stateful_session/BUILD
index babe2a2105..52ccd62d2f 100644
--- a/test/extensions/filters/http/stateful_session/BUILD
+++ b/test/extensions/filters/http/stateful_session/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "stateful_session_test.cc",
     ],
     extension_names = ["envoy.filters.http.stateful_session"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/stateful_session:config",
         "//source/server:generic_factory_context_lib",
@@ -36,6 +37,7 @@ envoy_extension_cc_test(
         "stateful_session_integration_test.cc",
     ],
     extension_names = ["envoy.filters.http.stateful_session"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/filters/http/stateful_session:config",
@@ -51,6 +53,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.stateful_session"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/stateful_session:config",
         "//test/mocks/http:stateful_session_mock",
diff --git a/test/extensions/filters/http/tap/BUILD b/test/extensions/filters/http/tap/BUILD
index 4e834ea928..ab90c65d03 100644
--- a/test/extensions/filters/http/tap/BUILD
+++ b/test/extensions/filters/http/tap/BUILD
@@ -25,6 +25,7 @@ envoy_extension_cc_test(
     name = "tap_filter_test",
     srcs = envoy_select_admin_functionality(["tap_filter_test.cc"]),
     extension_names = ["envoy.filters.http.tap"],
+    rbe_pool = "2core",
     deps = [
         ":common",
         "//source/extensions/filters/http/tap:config",
@@ -40,6 +41,7 @@ envoy_extension_cc_test(
     name = "tap_config_impl_test",
     srcs = envoy_select_admin_functionality(["tap_config_impl_test.cc"]),
     extension_names = ["envoy.filters.http.tap"],
+    rbe_pool = "2core",
     deps = [
         ":common",
         "//source/extensions/filters/http/tap:tap_config_impl",
@@ -56,6 +58,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = envoy_select_admin_functionality(["tap_filter_integration_test.cc"]),
     extension_names = ["envoy.filters.http.tap"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/tap:config",
         "//test/extensions/common/tap:common",
diff --git a/test/extensions/filters/http/thrift_to_metadata/BUILD b/test/extensions/filters/http/thrift_to_metadata/BUILD
index 6e0b1c979d..963232e13e 100644
--- a/test/extensions/filters/http/thrift_to_metadata/BUILD
+++ b/test/extensions/filters/http/thrift_to_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.http.thrift_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/thrift_to_metadata:thrift_to_metadata_lib",
         "//source/extensions/filters/network/thrift_proxy:protocol_converter_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.thrift_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/thrift_to_metadata:config",
         "//test/mocks/server:server_mocks",
@@ -40,6 +42,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.filters.http.thrift_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/thrift_to_metadata:config",
         "//source/extensions/filters/network/thrift_proxy:protocol_converter_lib",
diff --git a/test/extensions/filters/http/wasm/BUILD b/test/extensions/filters/http/wasm/BUILD
index ff68951b09..a0e557e96a 100644
--- a/test/extensions/filters/http/wasm/BUILD
+++ b/test/extensions/filters/http/wasm/BUILD
@@ -35,6 +35,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/wasm/test_data:shared_queue_rust.wasm",
     ]),
     extension_names = ["envoy.filters.http.wasm"],
+    rbe_pool = "2core",
     shard_count = 50,
     tags = [
         "cpu:4",
@@ -60,6 +61,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/wasm/test_data:test_cpp.wasm",
     ]),
     extension_names = ["envoy.filters.http.wasm"],
+    rbe_pool = "2core",
     shard_count = 16,
     tags = ["skip_on_windows"],
     deps = [
@@ -84,6 +86,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/http/wasm/test_data:test_cpp.wasm",
     ]),
     extension_names = ["envoy.filters.http.wasm"],
+    rbe_pool = "2core",
     shard_count = 16,
     tags = ["skip_on_windows"],
     deps = [
diff --git a/test/extensions/filters/listener/common/fuzz/BUILD b/test/extensions/filters/listener/common/fuzz/BUILD
index 95035e090d..b373f7f561 100644
--- a/test/extensions/filters/listener/common/fuzz/BUILD
+++ b/test/extensions/filters/listener/common/fuzz/BUILD
@@ -18,6 +18,7 @@ envoy_cc_test_library(
     name = "listener_filter_fuzzer_lib",
     srcs = ["listener_filter_fuzzer.cc"],
     hdrs = ["listener_filter_fuzzer.h"],
+    rbe_pool = "2core",
     deps = [
         ":listener_filter_fakes",
         ":listener_filter_fuzzer_proto_cc_proto",
@@ -34,6 +35,7 @@ envoy_cc_test_library(
     name = "listener_filter_fakes",
     srcs = ["listener_filter_fakes.cc"],
     hdrs = ["listener_filter_fakes.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:os_sys_calls_lib",
         "//test/mocks/network:network_mocks",
diff --git a/test/extensions/filters/listener/http_inspector/BUILD b/test/extensions/filters/listener/http_inspector/BUILD
index 7e5eef4d8c..09eace060f 100644
--- a/test/extensions/filters/listener/http_inspector/BUILD
+++ b/test/extensions/filters/listener/http_inspector/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "http_inspector_test",
     srcs = ["http_inspector_test.cc"],
     extension_names = ["envoy.filters.listener.http_inspector"],
+    rbe_pool = "2core",
     #TODO(davinci26): The test passes on Windows *but* http inspector
     # *used* to rely on Event::FileTriggerType::Edge and we got away with it
     # because we mock the dispatcher. Need to verify that the scenario is
@@ -37,6 +38,7 @@ envoy_extension_cc_test(
     name = "http_inspector_config_test",
     srcs = ["http_inspector_config_test.cc"],
     extension_names = ["envoy.filters.listener.http_inspector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/http_inspector:config",
         "//source/extensions/filters/listener/http_inspector:http_inspector_lib",
@@ -52,6 +54,7 @@ envoy_cc_fuzz_test(
     name = "http_inspector_fuzz_test",
     srcs = ["http_inspector_fuzz_test.cc"],
     corpus = "http_inspector_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/http_inspector:http_inspector_lib",
         "//test/extensions/filters/listener/common/fuzz:listener_filter_fuzzer_lib",
@@ -65,6 +68,7 @@ envoy_extension_cc_test(
         "http_inspector_integration_test.cc",
     ],
     extension_names = ["envoy.filters.listener.http_inspector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/file:config",
         "//source/extensions/filters/listener/http_inspector:config",
diff --git a/test/extensions/filters/listener/local_ratelimit/BUILD b/test/extensions/filters/listener/local_ratelimit/BUILD
index fe20789f4e..184d5402a6 100644
--- a/test/extensions/filters/listener/local_ratelimit/BUILD
+++ b/test/extensions/filters/listener/local_ratelimit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "local_ratelimit_test",
     srcs = ["local_ratelimit_test.cc"],
     extension_names = ["envoy.filters.listener.local_ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:default_socket_interface_lib",
         "//source/common/network:listener_filter_buffer_lib",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
         "local_ratelimit_integration_test.cc",
     ],
     extension_names = ["envoy.filters.listener.local_ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/file:config",
         "//source/extensions/filters/listener/local_ratelimit:config",
diff --git a/test/extensions/filters/listener/original_dst/BUILD b/test/extensions/filters/listener/original_dst/BUILD
index 5d2c2a4ac1..028b63f94f 100644
--- a/test/extensions/filters/listener/original_dst/BUILD
+++ b/test/extensions/filters/listener/original_dst/BUILD
@@ -13,6 +13,7 @@ envoy_cc_fuzz_test(
     name = "original_dst_fuzz_test",
     srcs = ["original_dst_fuzz_test.cc"],
     corpus = "original_dst_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/original_dst:original_dst_lib",
         "//test/extensions/filters/listener/common/fuzz:listener_filter_fuzzer_lib",
@@ -25,6 +26,7 @@ envoy_cc_test(
     srcs = [
         "original_dst_integration_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/clusters/original_dst:original_dst_cluster_lib",
@@ -43,6 +45,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "original_dst_test",
     srcs = ["original_dst_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:filter_state_dst_address_lib",
         "//source/common/network:listener_filter_buffer_lib",
diff --git a/test/extensions/filters/listener/original_src/BUILD b/test/extensions/filters/listener/original_src/BUILD
index 01f8a3b1b2..69c090532d 100644
--- a/test/extensions/filters/listener/original_src/BUILD
+++ b/test/extensions/filters/listener/original_src/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.listener.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/original_src:config_lib",
         "@envoy_api//envoy/extensions/filters/listener/original_src/v3:pkg_cc_proto",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "original_src_config_factory_test",
     srcs = ["original_src_config_factory_test.cc"],
     extension_names = ["envoy.filters.listener.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/original_src:config",
         "//source/extensions/filters/listener/original_src:config_lib",
@@ -39,6 +41,7 @@ envoy_extension_cc_test(
     name = "original_src_test",
     srcs = ["original_src_test.cc"],
     extension_names = ["envoy.filters.listener.original_src"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:socket_option_lib",
         "//source/extensions/filters/listener/original_src:original_src_lib",
@@ -64,6 +67,7 @@ envoy_cc_fuzz_test(
     name = "original_src_fuzz_test",
     srcs = ["original_src_fuzz_test.cc"],
     corpus = "original_src_corpus",
+    rbe_pool = "2core",
     deps = [
         ":original_src_fuzz_test_proto_cc_proto",
         "//source/extensions/filters/listener/original_src:original_src_lib",
diff --git a/test/extensions/filters/listener/proxy_protocol/BUILD b/test/extensions/filters/listener/proxy_protocol/BUILD
index 3f1b35dcae..f93935a9b3 100644
--- a/test/extensions/filters/listener/proxy_protocol/BUILD
+++ b/test/extensions/filters/listener/proxy_protocol/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
     name = "proxy_protocol_test",
     srcs = ["proxy_protocol_test.cc"],
     extension_names = ["envoy.filters.listener.proxy_protocol"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_includes",
@@ -56,6 +57,7 @@ envoy_cc_fuzz_test(
     name = "proxy_protocol_fuzz_test",
     srcs = ["proxy_protocol_fuzz_test.cc"],
     corpus = "proxy_protocol_corpus",
+    rbe_pool = "2core",
     deps = [
         ":proxy_protocol_fuzz_test_proto_cc_proto",
         "//source/extensions/filters/listener/proxy_protocol:proxy_protocol_lib",
@@ -74,6 +76,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["proxy_proto_integration_test.cc"],
     extension_names = ["envoy.filters.listener.proxy_protocol"],
+    rbe_pool = "2core",
     deps = [
         ":proxy_proto_integration_test_lib",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/listener/tls_inspector/BUILD b/test/extensions/filters/listener/tls_inspector/BUILD
index 410d6f9a58..f259207527 100644
--- a/test/extensions/filters/listener/tls_inspector/BUILD
+++ b/test/extensions/filters/listener/tls_inspector/BUILD
@@ -19,6 +19,7 @@ envoy_package()
 envoy_cc_test(
     name = "tls_inspector_test",
     srcs = ["tls_inspector_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":tls_utility_lib",
         "//source/common/http:utility_lib",
@@ -47,6 +48,7 @@ envoy_cc_fuzz_test(
     name = "tls_inspector_fuzz_test",
     srcs = ["tls_inspector_fuzz_test.cc"],
     corpus = "tls_inspector_corpus",
+    rbe_pool = "2core",
     deps = [
         ":tls_inspector_fuzz_test_proto_cc_proto",
         "//source/extensions/filters/listener/tls_inspector:tls_inspector_lib",
@@ -58,6 +60,7 @@ envoy_extension_cc_benchmark_binary(
     name = "tls_inspector_benchmark",
     srcs = ["tls_inspector_benchmark.cc"],
     extension_names = ["envoy.filters.listener.tls_inspector"],
+    rbe_pool = "2core",
     deps = [
         ":tls_utility_lib",
         "//source/common/http:utility_lib",
@@ -97,6 +100,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/config:api_version_lib",
         "//source/common/event:dispatcher_includes",
diff --git a/test/extensions/filters/network/common/fuzz/BUILD b/test/extensions/filters/network/common/fuzz/BUILD
index 3e3a9c7701..97d15b8b07 100644
--- a/test/extensions/filters/network/common/fuzz/BUILD
+++ b/test/extensions/filters/network/common/fuzz/BUILD
@@ -68,6 +68,7 @@ envoy_cc_test_library(
         "uber_readfilter.cc",
     ],
     hdrs = ["uber_readfilter.h"],
+    rbe_pool = "2core",
     deps = [
         ":network_readfilter_fuzz_proto_cc_proto",
         "//source/common/config:utility_lib",
@@ -89,6 +90,7 @@ envoy_cc_fuzz_test(
     srcs = ["network_readfilter_fuzz_test.cc"],
     corpus = "network_readfilter_corpus",
     dictionaries = ["network_readfilter_fuzz_test.dict"],
+    rbe_pool = "2core",
     deps = [
         ":uber_readfilter_lib",
         ":vig_anymap_ext_lib",
@@ -118,6 +120,7 @@ envoy_cc_test_library(
         "uber_writefilter.cc",
     ],
     hdrs = ["uber_writefilter.h"],
+    rbe_pool = "2core",
     deps = [
         ":network_writefilter_fuzz_proto_cc_proto",
         "//source/common/config:utility_lib",
@@ -132,6 +135,7 @@ envoy_cc_fuzz_test(
     name = "network_writefilter_fuzz_test",
     srcs = ["network_writefilter_fuzz_test.cc"],
     corpus = "network_writefilter_corpus",
+    rbe_pool = "2core",
     # All Envoy network filters must be linked to the test in order for the fuzzer to pick
     # these up via the NamedNetworkFilterConfigFactory.
     deps = [
diff --git a/test/extensions/filters/network/common/redis/BUILD b/test/extensions/filters/network/common/redis/BUILD
index 5bb47f0c7e..57d97d5e47 100644
--- a/test/extensions/filters/network/common/redis/BUILD
+++ b/test/extensions/filters/network/common/redis/BUILD
@@ -34,6 +34,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "codec_impl_test",
     srcs = ["codec_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/buffer:buffer_lib",
@@ -46,6 +47,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "client_impl_test",
     srcs = ["client_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         ":test_utils_lib",
@@ -65,6 +67,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "fault_test",
     srcs = ["fault_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/common:assert_lib",
diff --git a/test/extensions/filters/network/connection_limit/BUILD b/test/extensions/filters/network/connection_limit/BUILD
index 8e85b9f6a4..3eb9888d29 100644
--- a/test/extensions/filters/network/connection_limit/BUILD
+++ b/test/extensions/filters/network/connection_limit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "connection_limit_test",
     srcs = ["connection_limit_test.cc"],
     extension_names = ["envoy.filters.network.connection_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/connection_limit:connection_limit_lib",
         "//test/mocks/event:event_mocks",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["connection_limit_integration_test.cc"],
     extension_names = ["envoy.filters.network.connection_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/connection_limit:config",
         "//source/extensions/filters/network/tcp_proxy:config",
diff --git a/test/extensions/filters/network/direct_response/BUILD b/test/extensions/filters/network/direct_response/BUILD
index afd0b59bd0..60a46d7fc7 100644
--- a/test/extensions/filters/network/direct_response/BUILD
+++ b/test/extensions/filters/network/direct_response/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
         "direct_response_integration_test.cc",
     ],
     extension_names = ["envoy.filters.network.direct_response"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/direct_response:config",
         "//test/integration:integration_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "direct_response_test",
     srcs = ["direct_response_test.cc"],
     extension_names = ["envoy.filters.network.direct_response"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/direct_response:filter",
         "//test/mocks/api:api_mocks",
diff --git a/test/extensions/filters/network/dubbo_proxy/BUILD b/test/extensions/filters/network/dubbo_proxy/BUILD
index 59a33aacef..8350d7b230 100644
--- a/test/extensions/filters/network/dubbo_proxy/BUILD
+++ b/test/extensions/filters/network/dubbo_proxy/BUILD
@@ -17,6 +17,7 @@ envoy_cc_mock(
     name = "mocks_lib",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/common/protobuf:utility_lib",
@@ -46,6 +47,7 @@ envoy_extension_cc_test(
     name = "hessian_utils_test",
     srcs = ["hessian_utils_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:byte_order_lib",
@@ -59,6 +61,7 @@ envoy_extension_cc_test(
     name = "message_impl_test",
     srcs = ["message_impl_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/dubbo_proxy:message_lib",
         "//test/test_common:printers_lib",
@@ -70,6 +73,7 @@ envoy_extension_cc_test(
     name = "dubbo_protocol_impl_test",
     srcs = ["dubbo_protocol_impl_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -82,6 +86,7 @@ envoy_extension_cc_test(
     name = "dubbo_hessian2_serializer_impl_test",
     srcs = ["dubbo_hessian2_serializer_impl_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -95,6 +100,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -111,6 +117,7 @@ envoy_extension_cc_test(
     name = "metadata_test",
     srcs = ["metadata_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/dubbo_proxy:metadata_lib",
         "//source/extensions/filters/network/dubbo_proxy:serializer_interface",
@@ -121,6 +128,7 @@ envoy_extension_cc_test(
     name = "route_matcher_test",
     srcs = ["route_matcher_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/dubbo_proxy:metadata_lib",
         "//source/extensions/filters/network/dubbo_proxy/router:route_matcher",
@@ -133,6 +141,7 @@ envoy_extension_cc_test(
     name = "router_test",
     srcs = ["router_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -150,6 +159,7 @@ envoy_extension_cc_test(
     name = "app_exception_test",
     srcs = ["app_exception_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -165,6 +175,7 @@ envoy_extension_cc_test(
     name = "heartbeat_response_test",
     srcs = ["heartbeat_response_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -179,6 +190,7 @@ envoy_extension_cc_test(
     name = "router_filter_config_test",
     srcs = ["router_filter_config_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         "//source/extensions/filters/network/dubbo_proxy/router:config",
@@ -191,6 +203,7 @@ envoy_extension_cc_test(
     name = "decoder_test",
     srcs = ["decoder_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
@@ -203,6 +216,7 @@ envoy_extension_cc_test(
     name = "conn_manager_test",
     srcs = ["conn_manager_test.cc"],
     extension_names = ["envoy.filters.network.dubbo_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks_lib",
         ":utility_lib",
diff --git a/test/extensions/filters/network/echo/BUILD b/test/extensions/filters/network/echo/BUILD
index 28eaa83972..dd8fa642a3 100644
--- a/test/extensions/filters/network/echo/BUILD
+++ b/test/extensions/filters/network/echo/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "echo_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         # Uncomment this line to run this test repeatedly in exclusive mode if not using docker-sandbox,
         # or RBE, see comments in AddRemoveListener.
diff --git a/test/extensions/filters/network/ext_authz/BUILD b/test/extensions/filters/network/ext_authz/BUILD
index d59b491741..373c1f1df1 100644
--- a/test/extensions/filters/network/ext_authz/BUILD
+++ b/test/extensions/filters/network/ext_authz/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "ext_authz_test",
     srcs = ["ext_authz_test.cc"],
     extension_names = ["envoy.filters.network.ext_authz"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_lib",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.ext_authz"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/ext_authz:config",
         "//test/mocks/server:factory_context_mocks",
@@ -59,6 +61,7 @@ envoy_cc_fuzz_test(
     name = "ext_authz_fuzz_test",
     srcs = ["ext_authz_fuzz_test.cc"],
     corpus = "ext_authz_corpus",
+    rbe_pool = "2core",
     deps = [
         ":ext_authz_fuzz_proto_cc_proto",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/network/generic_proxy/BUILD b/test/extensions/filters/network/generic_proxy/BUILD
index d99b49f7d7..a5da848151 100644
--- a/test/extensions/filters/network/generic_proxy/BUILD
+++ b/test/extensions/filters/network/generic_proxy/BUILD
@@ -27,6 +27,7 @@ envoy_cc_test(
     srcs = [
         "route_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/common/buffer:buffer_lib",
@@ -45,6 +46,7 @@ envoy_cc_test(
     srcs = [
         "proxy_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/common/buffer:buffer_lib",
@@ -64,6 +66,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/common/buffer:buffer_lib",
@@ -88,6 +91,7 @@ envoy_cc_test(
     srcs = [
         "integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -120,6 +124,7 @@ envoy_cc_test(
     srcs = [
         "match_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/extensions/filters/network/generic_proxy:match_lib",
@@ -132,6 +137,7 @@ envoy_cc_test(
     srcs = [
         "access_log_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/extensions/filters/network/generic_proxy:access_log_lib",
@@ -144,6 +150,7 @@ envoy_cc_test(
     srcs = [
         "stream_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/generic_proxy/interface:stream_interface",
     ],
@@ -154,6 +161,7 @@ envoy_cc_test(
     srcs = [
         "tracing_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_codec_lib",
         "//source/extensions/filters/network/generic_proxy:tracing_lib",
@@ -165,6 +173,7 @@ envoy_cc_test(
     srcs = [
         "stats_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/generic_proxy:stats_lib",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/network/generic_proxy/codecs/dubbo/BUILD b/test/extensions/filters/network/generic_proxy/codecs/dubbo/BUILD
index 38b9b8fdb1..8180d54aa8 100644
--- a/test/extensions/filters/network/generic_proxy/codecs/dubbo/BUILD
+++ b/test/extensions/filters/network/generic_proxy/codecs/dubbo/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/generic_proxy/codecs/dubbo:config",
         "//test/extensions/common/dubbo:mocks_lib",
diff --git a/test/extensions/filters/network/generic_proxy/codecs/http1/BUILD b/test/extensions/filters/network/generic_proxy/codecs/http1/BUILD
index e0b72f4988..e6782daa69 100644
--- a/test/extensions/filters/network/generic_proxy/codecs/http1/BUILD
+++ b/test/extensions/filters/network/generic_proxy/codecs/http1/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/generic_proxy/codecs/http1:config",
         "//test/extensions/filters/network/generic_proxy/mocks:codec_mocks",
diff --git a/test/extensions/filters/network/generic_proxy/mocks/BUILD b/test/extensions/filters/network/generic_proxy/mocks/BUILD
index bbec71ba2c..21cdb3e191 100644
--- a/test/extensions/filters/network/generic_proxy/mocks/BUILD
+++ b/test/extensions/filters/network/generic_proxy/mocks/BUILD
@@ -12,6 +12,7 @@ envoy_cc_mock(
     name = "filter_mocks",
     srcs = ["filter.cc"],
     hdrs = ["filter.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/filters/network/generic_proxy/interface:filter_interface",
diff --git a/test/extensions/filters/network/generic_proxy/router/BUILD b/test/extensions/filters/network/generic_proxy/router/BUILD
index 106be68d44..3b3bb73829 100644
--- a/test/extensions/filters/network/generic_proxy/router/BUILD
+++ b/test/extensions/filters/network/generic_proxy/router/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     srcs = [
         "router_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/filters/network/generic_proxy/router:router_lib",
@@ -31,6 +32,7 @@ envoy_cc_test(
     srcs = [
         "upstream_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/filters/network/generic_proxy/router:router_lib",
@@ -49,6 +51,7 @@ envoy_cc_test(
     srcs = [
         "config_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/generic_proxy/router:config",
         "//test/extensions/filters/network/generic_proxy/mocks:filter_mocks",
diff --git a/test/extensions/filters/network/http_connection_manager/BUILD b/test/extensions/filters/network/http_connection_manager/BUILD
index 16ee57ba79..98c3dd2bac 100644
--- a/test/extensions/filters/network/http_connection_manager/BUILD
+++ b/test/extensions/filters/network/http_connection_manager/BUILD
@@ -45,6 +45,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.http_connection_manager"],
+    rbe_pool = "2core",
     deps = [
         ":config_cc_proto",
         ":config_test_base",
@@ -72,6 +73,7 @@ envoy_extension_cc_test(
     name = "config_filter_chain_test",
     srcs = ["config_filter_chain_test.cc"],
     extension_names = ["envoy.filters.network.http_connection_manager"],
+    rbe_pool = "2core",
     deps = [
         ":config_cc_proto",
         ":config_test_base",
@@ -84,6 +86,7 @@ envoy_extension_cc_test(
     name = "config_filter_dependencies_test",
     srcs = ["config_filter_dependencies_test.cc"],
     extension_names = ["envoy.filters.network.http_connection_manager"],
+    rbe_pool = "2core",
     deps = [
         ":config_cc_proto",
         ":config_test_base",
diff --git a/test/extensions/filters/network/http_connection_manager/config_test.cc b/test/extensions/filters/network/http_connection_manager/config_test.cc
index 5f39f9935a..9805d0f72c 100644
--- a/test/extensions/filters/network/http_connection_manager/config_test.cc
+++ b/test/extensions/filters/network/http_connection_manager/config_test.cc
@@ -996,6 +996,27 @@ TEST_F(HttpConnectionManagerConfigTest, MaxRequestHeaderCountConfigurable) {
   EXPECT_EQ(200, config.maxRequestHeadersCount());
 }
 
+// Check that max response header size is invalid on HCM.
+TEST_F(HttpConnectionManagerConfigTest, MaxResponseHeaderKbInvalid) {
+  const std::string yaml_string = R"EOF(
+  stat_prefix: ingress_http
+  common_http_protocol_options:
+    max_response_headers_kb: 200
+  route_config:
+    name: local_route
+  http_filters:
+  - name: envoy.filters.http.router
+    typed_config:
+      "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
+  )EOF";
+
+  HttpConnectionManagerConfig config(parseHttpConnectionManagerFromYaml(yaml_string), context_,
+                                     date_provider_, route_config_provider_manager_,
+                                     &scoped_routes_config_provider_manager_, tracer_manager_,
+                                     filter_config_provider_manager_, creation_status_);
+  EXPECT_FALSE(creation_status_.ok());
+}
+
 // Checking that default max_requests_per_connection is 0.
 TEST_F(HttpConnectionManagerConfigTest, DefaultMaxRequestPerConnection) {
   const std::string yaml_string = R"EOF(
@@ -2565,7 +2586,7 @@ namespace {
 
 class OriginalIPDetectionExtensionNotCreatedFactory : public Http::OriginalIPDetectionFactory {
 public:
-  Http::OriginalIPDetectionSharedPtr
+  absl::StatusOr<Http::OriginalIPDetectionSharedPtr>
   createExtension(const Protobuf::Message&, Server::Configuration::FactoryContext&) override {
     return nullptr;
   }
diff --git a/test/extensions/filters/network/local_ratelimit/BUILD b/test/extensions/filters/network/local_ratelimit/BUILD
index 2922f48e8f..25d160adae 100644
--- a/test/extensions/filters/network/local_ratelimit/BUILD
+++ b/test/extensions/filters/network/local_ratelimit/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "local_ratelimit_test",
     srcs = ["local_ratelimit_test.cc"],
     extension_names = ["envoy.filters.network.local_ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/singleton:manager_impl_lib",
         "//source/extensions/filters/network/local_ratelimit:local_ratelimit_lib",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["local_ratelimit_integration_test.cc"],
     extension_names = ["envoy.filters.network.local_ratelimit"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -54,6 +56,7 @@ envoy_cc_fuzz_test(
     name = "local_ratelimit_fuzz_test",
     srcs = ["local_ratelimit_fuzz_test.cc"],
     corpus = "local_ratelimit_corpus",
+    rbe_pool = "2core",
     deps = [
         ":local_ratelimit_fuzz_proto_cc_proto",
         "//source/common/buffer:buffer_lib",
diff --git a/test/extensions/filters/network/mongo_proxy/BUILD b/test/extensions/filters/network/mongo_proxy/BUILD
index a08cea6378..a403aac77e 100644
--- a/test/extensions/filters/network/mongo_proxy/BUILD
+++ b/test/extensions/filters/network/mongo_proxy/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "bson_impl_test",
     srcs = ["bson_impl_test.cc"],
     extension_names = ["envoy.filters.network.mongo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/extensions/filters/network/mongo_proxy:bson_lib",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "codec_impl_test",
     srcs = ["codec_impl_test.cc"],
     extension_names = ["envoy.filters.network.mongo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/json:json_loader_lib",
@@ -37,6 +39,7 @@ envoy_extension_cc_test(
     name = "proxy_test",
     srcs = ["proxy_test.cc"],
     extension_names = ["envoy.filters.network.mongo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/stats:stats_lib",
@@ -58,6 +61,7 @@ envoy_extension_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
     extension_names = ["envoy.filters.network.mongo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/mongo_proxy:bson_lib",
         "//source/extensions/filters/network/mongo_proxy:codec_lib",
@@ -69,6 +73,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.mongo_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/mongo_proxy:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/network/ratelimit/BUILD b/test/extensions/filters/network/ratelimit/BUILD
index 504daf3a8a..4e21d88a65 100644
--- a/test/extensions/filters/network/ratelimit/BUILD
+++ b/test/extensions/filters/network/ratelimit/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
         "envoy.filters.network.ratelimit",
         "envoy.filters.network.tcp_proxy",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/event:dispatcher_lib",
@@ -42,6 +43,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.ratelimit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/ratelimit:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/network/rbac/BUILD b/test/extensions/filters/network/rbac/BUILD
index 7264d1596a..b8a4c8a2d4 100644
--- a/test/extensions/filters/network/rbac/BUILD
+++ b/test/extensions/filters/network/rbac/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/network/rbac:config",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "filter_test",
     srcs = ["filter_test.cc"],
     extension_names = ["envoy.filters.network.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/common/rbac:utility_lib",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.filters.network.rbac"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/network/echo:config",
diff --git a/test/extensions/filters/network/redis_proxy/BUILD b/test/extensions/filters/network/redis_proxy/BUILD
index 4b8282b6a3..4425904a82 100644
--- a/test/extensions/filters/network/redis_proxy/BUILD
+++ b/test/extensions/filters/network/redis_proxy/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
     name = "command_splitter_impl_test",
     srcs = ["command_splitter_impl_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/stats:isolated_store_lib",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
     name = "conn_pool_impl_test",
     srcs = ["conn_pool_impl_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/event:dispatcher_lib",
@@ -73,6 +75,7 @@ envoy_extension_cc_test(
     name = "proxy_filter_test",
     srcs = ["proxy_filter_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/event:dispatcher_lib",
@@ -92,6 +95,7 @@ envoy_extension_cc_test(
     name = "external_auth_test",
     srcs = ["external_auth_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/extensions/filters/network/redis_proxy:external_auth_lib",
@@ -124,6 +128,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf:utility_lib",
         "//source/extensions/filters/network/redis_proxy:config",
@@ -136,6 +141,7 @@ envoy_extension_cc_benchmark_binary(
     name = "command_lookup_speed_test",
     srcs = ["command_lookup_speed_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/stats:isolated_store_lib",
@@ -159,6 +165,7 @@ envoy_extension_cc_test(
     name = "router_impl_test",
     srcs = ["router_impl_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/formatter:formatter_extension_lib",
@@ -179,6 +186,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["redis_proxy_integration_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/common/redis:fault_lib",
         "//source/extensions/filters/network/redis_proxy:config",
@@ -191,6 +199,7 @@ envoy_extension_cc_benchmark_binary(
     name = "command_split_speed_test",
     srcs = ["command_split_speed_test.cc"],
     extension_names = ["envoy.filters.network.redis_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":redis_mocks",
         "//source/common/stats:isolated_store_lib",
diff --git a/test/extensions/filters/network/set_filter_state/BUILD b/test/extensions/filters/network/set_filter_state/BUILD
index 13a6056f03..9860c8a41e 100644
--- a/test/extensions/filters/network/set_filter_state/BUILD
+++ b/test/extensions/filters/network/set_filter_state/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "integration_test.cc",
     ],
     extension_names = ["envoy.filters.network.set_filter_state"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/extensions/filters/network/echo:config",
diff --git a/test/extensions/filters/network/sni_cluster/BUILD b/test/extensions/filters/network/sni_cluster/BUILD
index 28b861295a..4393895fc2 100644
--- a/test/extensions/filters/network/sni_cluster/BUILD
+++ b/test/extensions/filters/network/sni_cluster/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "sni_cluster_test",
     srcs = ["sni_cluster_test.cc"],
     extension_names = ["envoy.filters.network.sni_cluster"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/sni_cluster",
         "//source/extensions/filters/network/sni_cluster:config",
diff --git a/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD b/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
index fe32824622..b8e4565f1b 100644
--- a/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/network/sni_dynamic_forward_proxy/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "proxy_filter_test",
     srcs = ["proxy_filter_test.cc"],
     extension_names = ["envoy.filters.network.sni_dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/common/stream_info:uint32_accessor_lib",
@@ -36,6 +37,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.filters.network.sni_dynamic_forward_proxy"],
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): Diagnose failure shown only on clang-cl build, see:
     #   https://gist.github.com/wrowe/12b0b7579791c541c789c98563999a2e
     tags = ["fails_on_clang_cl"],
diff --git a/test/extensions/filters/network/tcp_proxy/BUILD b/test/extensions/filters/network/tcp_proxy/BUILD
index c2d059d783..95405de2fb 100644
--- a/test/extensions/filters/network/tcp_proxy/BUILD
+++ b/test/extensions/filters/network/tcp_proxy/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.tcp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/tcp_proxy:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/network/thrift_proxy/BUILD b/test/extensions/filters/network/thrift_proxy/BUILD
index 8e74e2962e..a9b620008a 100644
--- a/test/extensions/filters/network/thrift_proxy/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_mock(
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy:conn_manager_lib",
         "//source/extensions/filters/network/thrift_proxy:protocol_interface",
@@ -38,6 +39,7 @@ envoy_extension_cc_test_library(
     srcs = ["integration.cc"],
     hdrs = ["integration.h"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy:config",
         "//source/extensions/filters/network/thrift_proxy:conn_manager_lib",
@@ -65,6 +67,7 @@ envoy_extension_cc_test(
     name = "app_exception_impl_test",
     srcs = ["app_exception_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/extensions/filters/network/thrift_proxy:app_exception_lib",
@@ -77,6 +80,7 @@ envoy_extension_cc_test(
     name = "buffer_helper_test",
     srcs = ["buffer_helper_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/extensions/filters/network/thrift_proxy:buffer_helper_lib",
@@ -89,6 +93,7 @@ envoy_extension_cc_test(
     name = "conn_state_test",
     srcs = ["conn_state_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy:conn_state_lib",
         "//test/test_common:printers_lib",
@@ -100,6 +105,7 @@ envoy_extension_cc_test(
     name = "auto_transport_impl_test",
     srcs = ["auto_transport_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -113,6 +119,7 @@ envoy_extension_cc_test(
     name = "framed_transport_impl_test",
     srcs = ["framed_transport_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -126,6 +133,7 @@ envoy_extension_cc_test(
     name = "header_transport_impl_test",
     srcs = ["header_transport_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -140,6 +148,7 @@ envoy_extension_cc_test(
     name = "unframed_transport_impl_test",
     srcs = ["unframed_transport_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -153,6 +162,7 @@ envoy_extension_cc_test(
     name = "auto_protocol_impl_test",
     srcs = ["auto_protocol_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -166,6 +176,7 @@ envoy_extension_cc_test(
     name = "binary_protocol_impl_test",
     srcs = ["binary_protocol_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -180,6 +191,7 @@ envoy_extension_cc_test(
     name = "compact_protocol_impl_test",
     srcs = ["compact_protocol_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -194,6 +206,7 @@ envoy_extension_cc_test(
     name = "twitter_protocol_impl_test",
     srcs = ["twitter_protocol_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -208,6 +221,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/extensions/filters/network/thrift_proxy:config",
@@ -224,6 +238,7 @@ envoy_extension_cc_test(
     name = "conn_manager_test",
     srcs = ["conn_manager_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -246,6 +261,7 @@ envoy_extension_cc_test(
     name = "decoder_test",
     srcs = ["decoder_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -260,6 +276,7 @@ envoy_extension_cc_test(
     name = "metadata_test",
     srcs = ["metadata_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy:metadata_lib",
         "//test/test_common:printers_lib",
@@ -271,6 +288,7 @@ envoy_extension_cc_test(
     name = "router_test",
     srcs = ["router_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -294,6 +312,7 @@ envoy_extension_cc_test(
     name = "router_ratelimit_test",
     srcs = ["router_ratelimit_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -314,6 +333,7 @@ envoy_extension_cc_test(
     name = "route_matcher_test",
     srcs = ["route_matcher_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/extensions/filters/network/thrift_proxy/router:config",
@@ -330,6 +350,7 @@ envoy_extension_cc_test(
     name = "thrift_object_impl_test",
     srcs = ["thrift_object_impl_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -347,6 +368,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/thrift_proxy/driver:generate_fixture",
     ],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":integration_lib",
@@ -365,6 +387,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/thrift_proxy/driver:generate_fixture",
     ],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":integration_lib",
         ":utility_lib",
@@ -379,6 +402,7 @@ envoy_extension_cc_test(
     name = "shadow_writer_test",
     srcs = ["shadow_writer_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         ":utility_lib",
@@ -403,6 +427,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/thrift_proxy/driver:generate_fixture",
     ],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":integration_lib",
         "//test/test_common:network_utility_lib",
diff --git a/test/extensions/filters/network/thrift_proxy/filters/BUILD b/test/extensions/filters/network/thrift_proxy/filters/BUILD
index 2faa24bb62..fbca1ec6b5 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/filters/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "pass_through_filter_test",
     srcs = ["pass_through_filter_test.cc"],
     extension_names = ["envoy.filters.network.thrift_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters:pass_through_filter_lib",
         "//test/extensions/filters/network/thrift_proxy:mocks",
diff --git a/test/extensions/filters/network/thrift_proxy/filters/header_to_metadata/BUILD b/test/extensions/filters/network/thrift_proxy/filters/header_to_metadata/BUILD
index 45f0eec6b5..c056b6f299 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/header_to_metadata/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/filters/header_to_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.thrift.header_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters/header_to_metadata:config",
         "//source/extensions/filters/network/thrift_proxy/filters/header_to_metadata:header_to_metadata_filter_lib",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "header_to_metadata_filter_test",
     srcs = ["header_to_metadata_filter_test.cc"],
     extension_names = ["envoy.filters.thrift.header_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters/header_to_metadata:header_to_metadata_filter_lib",
         "//test/extensions/filters/network/thrift_proxy:mocks",
diff --git a/test/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/BUILD b/test/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/BUILD
index 2c45adcc5a..fef1d287d8 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/filters/payload_to_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.thrift.payload_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters/payload_to_metadata:config",
         "//source/extensions/filters/network/thrift_proxy/filters/payload_to_metadata:payload_to_metadata_filter_lib",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "payload_to_metadata_filter_test",
     srcs = ["payload_to_metadata_filter_test.cc"],
     extension_names = ["envoy.filters.thrift.payload_to_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters/payload_to_metadata:payload_to_metadata_filter_lib",
         "//test/extensions/filters/network/thrift_proxy:mocks",
diff --git a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
index ab8aed3a2f..77af483108 100644
--- a/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
+++ b/test/extensions/filters/network/thrift_proxy/filters/ratelimit/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "ratelimit_test",
     srcs = ["ratelimit_test.cc"],
     extension_names = ["envoy.filters.thrift.rate_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:empty_string",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.thrift.rate_limit"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/thrift_proxy/filters/ratelimit:config",
         "//test/extensions/filters/network/thrift_proxy:mocks",
diff --git a/test/extensions/filters/network/wasm/BUILD b/test/extensions/filters/network/wasm/BUILD
index 93069c8920..43b61fc821 100644
--- a/test/extensions/filters/network/wasm/BUILD
+++ b/test/extensions/filters/network/wasm/BUILD
@@ -24,6 +24,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/wasm/test_data:test_cpp.wasm",
     ]),
     extension_names = ["envoy.filters.network.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/common:base64_lib",
@@ -52,6 +53,7 @@ envoy_extension_cc_test(
         "//test/extensions/filters/network/wasm/test_data:resume_call_rust.wasm",
     ]),
     extension_names = ["envoy.filters.network.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/filters/network/wasm:wasm_filter_lib",
diff --git a/test/extensions/filters/network/zookeeper_proxy/BUILD b/test/extensions/filters/network/zookeeper_proxy/BUILD
index 3745ed2a8a..3aa6c7733a 100644
--- a/test/extensions/filters/network/zookeeper_proxy/BUILD
+++ b/test/extensions/filters/network/zookeeper_proxy/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "filter_test.cc",
     ],
     extension_names = ["envoy.filters.network.zookeeper_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/zookeeper_proxy:config",
         "//test/mocks/network:network_mocks",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
         "config_test.cc",
     ],
     extension_names = ["envoy.filters.network.zookeeper_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/zookeeper_proxy:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/filters/udp/dns_filter/BUILD b/test/extensions/filters/udp/dns_filter/BUILD
index 61b358d9b3..dcd5d767e5 100644
--- a/test/extensions/filters/udp/dns_filter/BUILD
+++ b/test/extensions/filters/udp/dns_filter/BUILD
@@ -32,6 +32,7 @@ envoy_extension_cc_test(
     name = "dns_filter_test",
     srcs = ["dns_filter_test.cc"],
     extension_names = ["envoy.filters.udp.dns_filter"],
+    rbe_pool = "2core",
     deps = [
         ":dns_filter_test_lib",
         "//source/extensions/filters/udp/dns_filter:dns_filter_lib",
@@ -50,6 +51,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["dns_filter_integration_test.cc"],
     extension_names = ["envoy.filters.udp.dns_filter"],
+    rbe_pool = "2core",
     deps = [
         ":dns_filter_test_lib",
         "//source/extensions/filters/udp/dns_filter:config",
@@ -63,6 +65,7 @@ envoy_extension_cc_test(
     name = "dns_filter_utils_test",
     srcs = ["dns_filter_utils_test.cc"],
     extension_names = ["envoy.filters.udp.dns_filter"],
+    rbe_pool = "2core",
     deps = [
         ":dns_filter_test_lib",
         "//source/extensions/filters/udp/dns_filter:config",
@@ -76,6 +79,7 @@ envoy_cc_fuzz_test(
     name = "dns_filter_fuzz_test",
     srcs = ["dns_filter_fuzz_test.cc"],
     corpus = "dns_filter_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/udp/dns_filter:dns_filter_lib",
         "//test/fuzz:utility_lib",
diff --git a/test/extensions/filters/udp/udp_proxy/BUILD b/test/extensions/filters/udp/udp_proxy/BUILD
index 9d56cf62e8..527836845b 100644
--- a/test/extensions/filters/udp/udp_proxy/BUILD
+++ b/test/extensions/filters/udp/udp_proxy/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_mock(
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/udp/udp_proxy:udp_proxy_filter_lib",
         "//test/mocks/network:network_mocks",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     name = "udp_proxy_filter_test",
     srcs = ["udp_proxy_filter_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":mocks",
         "//source/common/common:hash_lib",
@@ -62,6 +64,7 @@ envoy_extension_cc_test(
     name = "hash_policy_impl_test",
     srcs = ["hash_policy_impl_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:hash_lib",
         "//source/common/network:address_lib",
@@ -74,6 +77,7 @@ envoy_extension_cc_test(
     name = "router_impl_test",
     srcs = ["router_impl_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
@@ -90,6 +94,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["udp_proxy_integration_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:filter_interface",
         "//envoy/server:filter_config_interface",
@@ -109,6 +114,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["udp_session_extension_discovery_integration_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:filter_interface",
         "//envoy/server:filter_config_interface",
diff --git a/test/extensions/filters/udp/udp_proxy/session_filters/BUILD b/test/extensions/filters/udp/udp_proxy/session_filters/BUILD
index 5163923af5..2c306624a7 100644
--- a/test/extensions/filters/udp/udp_proxy/session_filters/BUILD
+++ b/test/extensions/filters/udp/udp_proxy/session_filters/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "pass_through_filter_test",
     srcs = ["pass_through_filter_test.cc"],
     extension_names = ["envoy.filters.udp_listener.udp_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/udp/udp_proxy/session_filters:pass_through_filter_lib",
         "//test/extensions/filters/udp/udp_proxy:mocks",
diff --git a/test/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy/BUILD b/test/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy/BUILD
index de0aceff44..d707a6b884 100644
--- a/test/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy/BUILD
+++ b/test/extensions/filters/udp/udp_proxy/session_filters/dynamic_forward_proxy/BUILD
@@ -35,6 +35,7 @@ envoy_extension_cc_test(
     name = "proxy_filter_test",
     srcs = ["proxy_filter_test.cc"],
     extension_names = ["envoy.filters.udp.session.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:string_accessor_lib",
         "//source/common/stream_info:uint32_accessor_lib",
@@ -50,6 +51,7 @@ envoy_extension_cc_test(
     name = "dynamic_forward_proxy_filter_integration_test",
     srcs = ["proxy_filter_integration_test.cc"],
     extension_names = ["envoy.filters.udp.session.dynamic_forward_proxy"],
+    rbe_pool = "2core",
     deps = [
         ":dfp_setter_filter_config_lib",
         ":dfp_setter_filter_proto_cc_proto",
diff --git a/test/extensions/filters/udp/udp_proxy/session_filters/http_capsule/BUILD b/test/extensions/filters/udp/udp_proxy/session_filters/http_capsule/BUILD
index eebb7aeeb8..65f76a3525 100644
--- a/test/extensions/filters/udp/udp_proxy/session_filters/http_capsule/BUILD
+++ b/test/extensions/filters/udp/udp_proxy/session_filters/http_capsule/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "http_capsule_filter_test",
     srcs = ["http_capsule_filter_test.cc"],
     extension_names = ["envoy.filters.udp.session.http_capsule"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/udp/udp_proxy/session_filters/http_capsule:config",
         "//test/extensions/filters/udp/udp_proxy:mocks",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "http_capsule_integration_test",
     srcs = ["http_capsule_integration_test.cc"],
     extension_names = ["envoy.filters.udp.session.http_capsule"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:filter_interface",
         "//envoy/server:filter_config_interface",
diff --git a/test/extensions/formatter/cel/BUILD b/test/extensions/formatter/cel/BUILD
index e441c30287..b3cb54dfdc 100644
--- a/test/extensions/formatter/cel/BUILD
+++ b/test/extensions/formatter/cel/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.formatter.cel"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/formatter:substitution_formatter_lib",
diff --git a/test/extensions/formatter/metadata/BUILD b/test/extensions/formatter/metadata/BUILD
index 8889de8808..d6d9e6e9e4 100644
--- a/test/extensions/formatter/metadata/BUILD
+++ b/test/extensions/formatter/metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "metadata_test",
     srcs = ["metadata_test.cc"],
     extension_names = ["envoy.formatter.metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:substitution_formatter_lib",
         "//source/common/json:json_loader_lib",
diff --git a/test/extensions/formatter/req_without_query/BUILD b/test/extensions/formatter/req_without_query/BUILD
index 800d4f1680..0eff1eb420 100644
--- a/test/extensions/formatter/req_without_query/BUILD
+++ b/test/extensions/formatter/req_without_query/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "req_without_query_test",
     srcs = ["req_without_query_test.cc"],
     extension_names = ["envoy.formatter.req_without_query"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:substitution_formatter_lib",
         "//source/common/json:json_loader_lib",
diff --git a/test/extensions/geoip_providers/maxmind/BUILD b/test/extensions/geoip_providers/maxmind/BUILD
index 2262723c8a..1f8374ce13 100644
--- a/test/extensions/geoip_providers/maxmind/BUILD
+++ b/test/extensions/geoip_providers/maxmind/BUILD
@@ -23,6 +23,7 @@ envoy_extension_cc_test(
         "//test/extensions/geoip_providers/maxmind/test_data:geolocation_databases",
     ],
     extension_names = ["envoy.geoip_providers.maxmind"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/geoip_providers/maxmind:config",
@@ -44,6 +45,7 @@ envoy_extension_cc_test(
         "//test/extensions/geoip_providers/maxmind/test_data:geolocation_databases",
     ],
     extension_names = ["envoy.geoip_providers.maxmind"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//envoy/registry",
diff --git a/test/extensions/grpc_credentials/aws_iam/BUILD b/test/extensions/grpc_credentials/aws_iam/BUILD
index 392ffda32a..31aea28868 100644
--- a/test/extensions/grpc_credentials/aws_iam/BUILD
+++ b/test/extensions/grpc_credentials/aws_iam/BUILD
@@ -13,6 +13,7 @@ envoy_cc_test(
     name = "aws_iam_grpc_credentials_test",
     srcs = envoy_select_google_grpc(["aws_iam_grpc_credentials_test.cc"]),
     data = ["//test/config/integration/certs"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/grpc_credentials/aws_iam:config",
         "//test/common/grpc:grpc_client_integration_test_harness_lib",
diff --git a/test/extensions/grpc_credentials/file_based_metadata/BUILD b/test/extensions/grpc_credentials/file_based_metadata/BUILD
index 724ac77b1b..a55e9ffe84 100644
--- a/test/extensions/grpc_credentials/file_based_metadata/BUILD
+++ b/test/extensions/grpc_credentials/file_based_metadata/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     data = ["//test/config/integration/certs"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/grpc_credentials/file_based_metadata:config",
         "//test/common/grpc:grpc_client_integration_test_harness_lib",
diff --git a/test/extensions/health_check/event_sinks/file/BUILD b/test/extensions/health_check/event_sinks/file/BUILD
index 34a4e41306..e7ea89d9e9 100644
--- a/test/extensions/health_check/event_sinks/file/BUILD
+++ b/test/extensions/health_check/event_sinks/file/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "file_sink_impl_test",
     srcs = ["file_sink_impl_test.cc"],
     extension_names = ["envoy.health_check.event_sinks.file"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/health_check/event_sinks/file:file_sink_lib",
         "//test/mocks/access_log:access_log_mocks",
diff --git a/test/extensions/health_checkers/redis/BUILD b/test/extensions/health_checkers/redis/BUILD
index 4508ff6d04..b3145a645a 100644
--- a/test/extensions/health_checkers/redis/BUILD
+++ b/test/extensions/health_checkers/redis/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "redis_test",
     srcs = ["redis_test.cc"],
     extension_names = ["envoy.health_checkers.redis"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/extensions/health_checkers/redis",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.health_checkers.redis"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:health_checker_lib",
         "//source/extensions/health_checkers/redis:config",
diff --git a/test/extensions/health_checkers/thrift/BUILD b/test/extensions/health_checkers/thrift/BUILD
index 74b67b5e6a..2e499f34ae 100644
--- a/test/extensions/health_checkers/thrift/BUILD
+++ b/test/extensions/health_checkers/thrift/BUILD
@@ -16,6 +16,7 @@ envoy_cc_mock(
     name = "thrift_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/health_checkers/thrift:client_interface",
         "//test/mocks/network:connection_mocks",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     name = "client_impl_test",
     srcs = ["client_impl_test.cc"],
     extension_names = ["envoy.health_checkers.thrift"],
+    rbe_pool = "2core",
     deps = [
         ":thrift_mocks",
         "//source/common/network:utility_lib",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
     name = "thrift_test",
     srcs = ["thrift_test.cc"],
     extension_names = ["envoy.health_checkers.thrift"],
+    rbe_pool = "2core",
     deps = [
         ":thrift_mocks",
         "//source/common/api:api_lib",
@@ -68,6 +71,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.health_checkers.thrift"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:health_checker_lib",
         "//source/extensions/health_checkers/thrift:config",
diff --git a/test/extensions/http/cache/file_system_http_cache/BUILD b/test/extensions/http/cache/file_system_http_cache/BUILD
index a5bf24f6ef..469dfd6047 100644
--- a/test/extensions/http/cache/file_system_http_cache/BUILD
+++ b/test/extensions/http/cache/file_system_http_cache/BUILD
@@ -12,6 +12,7 @@ envoy_extension_cc_test(
     name = "file_system_http_cache_test",
     srcs = ["file_system_http_cache_test.cc"],
     extension_names = ["envoy.extensions.http.cache.file_system_http_cache"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],  # async_files does not yet support Windows.
     deps = [
         "//source/common/filesystem:directory_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
 envoy_cc_test(
     name = "cache_file_header_proto_util_test",
     srcs = ["cache_file_header_proto_util_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/cache/file_system_http_cache:cache_file_header_proto_util",
     ],
@@ -37,6 +39,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "cache_file_fixed_block_test",
     srcs = ["cache_file_fixed_block_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/cache/file_system_http_cache:cache_file_fixed_block",
     ],
diff --git a/test/extensions/http/cache/simple_http_cache/BUILD b/test/extensions/http/cache/simple_http_cache/BUILD
index a349aa1629..07036b2cb7 100644
--- a/test/extensions/http/cache/simple_http_cache/BUILD
+++ b/test/extensions/http/cache/simple_http_cache/BUILD
@@ -12,6 +12,7 @@ envoy_extension_cc_test(
     name = "simple_http_cache_test",
     srcs = ["simple_http_cache_test.cc"],
     extension_names = ["envoy.extensions.http.cache.simple"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/cache:cache_entry_utils_lib",
         "//source/extensions/http/cache/simple_http_cache:config",
diff --git a/test/extensions/http/credential_injector/generic/BUILD b/test/extensions/http/credential_injector/generic/BUILD
index 533f2ac075..1b0a3fa90e 100644
--- a/test/extensions/http/credential_injector/generic/BUILD
+++ b/test/extensions/http/credential_injector/generic/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["credential_injector_integration_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/credential_injector:config",
         "//source/extensions/http/injected_credentials/generic:config",
diff --git a/test/extensions/http/credential_injector/oauth2/BUILD b/test/extensions/http/credential_injector/oauth2/BUILD
index 2537ba15df..3b6c2f0ea0 100644
--- a/test/extensions/http/credential_injector/oauth2/BUILD
+++ b/test/extensions/http/credential_injector/oauth2/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/injected_credentials/oauth2:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "token_provider_test",
     srcs = ["token_provider_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/injected_credentials/common:secret_reader_lib",
         "//source/extensions/http/injected_credentials/oauth2:token_provider_lib",
@@ -39,6 +41,7 @@ envoy_extension_cc_test(
     name = "credential_injector_oauth_integration_test",
     srcs = ["credential_injector_oauth_integration_test.cc"],
     extension_names = ["envoy.filters.http.credential_injector"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/http/credential_injector:config",
         "//source/extensions/http/injected_credentials/oauth2:config",
diff --git a/test/extensions/http/early_header_mutation/header_mutation/BUILD b/test/extensions/http/early_header_mutation/header_mutation/BUILD
index ec61821a37..ce7e6410ff 100644
--- a/test/extensions/http/early_header_mutation/header_mutation/BUILD
+++ b/test/extensions/http/early_header_mutation/header_mutation/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "header_mutation_test.cc",
     ],
     extension_names = ["envoy.http.early_header_mutation.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/http/early_header_mutation/header_mutation:header_mutation_lib",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
         "config_test.cc",
     ],
     extension_names = ["envoy.http.early_header_mutation.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/config:utility_lib",
@@ -48,6 +50,7 @@ envoy_extension_cc_test(
         "header_mutation_integration_test.cc",
     ],
     extension_names = ["envoy.http.early_header_mutation.header_mutation"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/http/early_header_mutation/header_mutation:config",
diff --git a/test/extensions/http/header_formatters/preserve_case/BUILD b/test/extensions/http/header_formatters/preserve_case/BUILD
index 00bb69c30d..9124965e88 100644
--- a/test/extensions/http/header_formatters/preserve_case/BUILD
+++ b/test/extensions/http/header_formatters/preserve_case/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
         "preserve_case_formatter_test.cc",
     ],
     extension_names = ["envoy.http.stateful_header_formatters.preserve_case"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/header_formatters/preserve_case:preserve_case_formatter",
         "//test/test_common:utility_lib",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
         "preserve_case_formatter_integration_test.cc",
     ],
     extension_names = ["envoy.http.stateful_header_formatters.preserve_case"],
+    rbe_pool = "2core",
     # Broken until bazel 5.0.0 fix to shorten resulting paths for SymInitialize() failure
     tags = ["skip_on_windows"],
     deps = [
@@ -48,6 +50,7 @@ envoy_extension_cc_test(
         "preserve_case_formatter_reason_phrase_integration_test.cc",
     ],
     extension_names = ["envoy.http.stateful_header_formatters.preserve_case"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/header_formatters/preserve_case:config",
         "//source/extensions/http/header_formatters/preserve_case:preserve_case_formatter",
@@ -63,6 +66,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.stateful_header_formatters.preserve_case"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/common:utility_lib",
diff --git a/test/extensions/http/header_validators/envoy_default/BUILD b/test/extensions/http/header_validators/envoy_default/BUILD
index 4564177ea0..7361912cd1 100644
--- a/test/extensions/http/header_validators/envoy_default/BUILD
+++ b/test/extensions/http/header_validators/envoy_default/BUILD
@@ -20,6 +20,7 @@ envoy_extension_cc_test(
         "base_header_validator_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         ":header_validator_utils_lib",
         "//envoy/http:header_validator_errors",
@@ -37,6 +38,7 @@ envoy_extension_cc_test(
         "http_common_validation_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         ":header_validator_utils_lib",
         "//envoy/http:header_validator_errors",
@@ -55,6 +57,7 @@ envoy_extension_cc_test(
         "http1_header_validator_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         ":header_validator_utils_lib",
         "//envoy/http:header_validator_errors",
@@ -71,6 +74,7 @@ envoy_extension_cc_test(
         "http2_header_validator_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         ":header_validator_utils_lib",
         "//envoy/http:header_validator_errors",
@@ -104,6 +108,7 @@ envoy_extension_cc_test(
         "header_validator_factory_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:utility_lib",
         "//source/extensions/http/header_validators/envoy_default:config",
@@ -120,6 +125,7 @@ envoy_extension_cc_test(
         "path_normalizer_test.cc",
     ],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/http/header_validators/envoy_default:path_normalizer",
         "//test/test_common:test_runtime_lib",
@@ -131,6 +137,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.header_validators.envoy_default"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/http/header_validators/envoy_default:config",
@@ -152,6 +159,7 @@ envoy_cc_fuzz_test(
     name = "path_normalizer_fuzz_test",
     srcs = ["path_normalizer_fuzz_test.cc"],
     corpus = "path_normalizer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":path_normalizer_fuzz_proto_cc_proto",
         "//source/extensions/http/header_validators/envoy_default:http1_header_validator",
diff --git a/test/extensions/http/original_ip_detection/custom_header/BUILD b/test/extensions/http/original_ip_detection/custom_header/BUILD
index ca2cc08283..cdc4291b0e 100644
--- a/test/extensions/http/original_ip_detection/custom_header/BUILD
+++ b/test/extensions/http/original_ip_detection/custom_header/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "custom_header_detection_test",
     srcs = ["custom_header_test.cc"],
     extension_names = ["envoy.http.original_ip_detection.custom_header"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:utility_lib",
         "//source/extensions/http/original_ip_detection/custom_header:custom_header_lib",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.original_ip_detection.custom_header"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/http/original_ip_detection/custom_header:config",
diff --git a/test/extensions/http/original_ip_detection/custom_header/config_test.cc b/test/extensions/http/original_ip_detection/custom_header/config_test.cc
index 83346697de..0558ef8fed 100644
--- a/test/extensions/http/original_ip_detection/custom_header/config_test.cc
+++ b/test/extensions/http/original_ip_detection/custom_header/config_test.cc
@@ -29,7 +29,7 @@ TEST(CustomHeaderFactoryTest, Basic) {
   TestUtility::loadFromYaml(yaml, typed_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_NE(factory->createExtension(typed_config.typed_config(), context), nullptr);
+  EXPECT_NE(*factory->createExtension(typed_config.typed_config(), context), nullptr);
 }
 
 TEST(CustomHeaderFactoryTest, InvalidHeaderName) {
@@ -47,7 +47,7 @@ TEST(CustomHeaderFactoryTest, InvalidHeaderName) {
   TestUtility::loadFromYaml(yaml, typed_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_THROW_WITH_REGEX(factory->createExtension(typed_config.typed_config(), context),
+  EXPECT_THROW_WITH_REGEX(*factory->createExtension(typed_config.typed_config(), context),
                           EnvoyException,
                           "Proto constraint validation failed.*does not match regex pattern.*");
 }
diff --git a/test/extensions/http/original_ip_detection/xff/BUILD b/test/extensions/http/original_ip_detection/xff/BUILD
index 0928a5b3f7..c3bf4e05e3 100644
--- a/test/extensions/http/original_ip_detection/xff/BUILD
+++ b/test/extensions/http/original_ip_detection/xff/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "xff_detection_test",
     srcs = ["xff_test.cc"],
     extension_names = ["envoy.http.original_ip_detection.xff"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:utility_lib",
         "//source/common/network:address_lib",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.original_ip_detection.xff"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/network:address_lib",
diff --git a/test/extensions/http/original_ip_detection/xff/config_test.cc b/test/extensions/http/original_ip_detection/xff/config_test.cc
index 5a8ebaa378..cffdb5b1f8 100644
--- a/test/extensions/http/original_ip_detection/xff/config_test.cc
+++ b/test/extensions/http/original_ip_detection/xff/config_test.cc
@@ -29,7 +29,7 @@ TEST(CustomHeaderFactoryTest, Basic) {
   TestUtility::loadFromYaml(yaml, typed_config);
 
   NiceMock<Server::Configuration::MockFactoryContext> context;
-  EXPECT_NE(factory->createExtension(typed_config.typed_config(), context), nullptr);
+  EXPECT_NE(*factory->createExtension(typed_config.typed_config(), context), nullptr);
 }
 
 } // namespace Xff
diff --git a/test/extensions/http/original_ip_detection/xff/xff_test.cc b/test/extensions/http/original_ip_detection/xff/xff_test.cc
index 0fc3bc6145..761932bef8 100644
--- a/test/extensions/http/original_ip_detection/xff/xff_test.cc
+++ b/test/extensions/http/original_ip_detection/xff/xff_test.cc
@@ -18,7 +18,7 @@ class XffNumTrustedHopsTest : public testing::Test {
   XffNumTrustedHopsTest() {
     envoy::extensions::http::original_ip_detection::xff::v3::XffConfig config;
     config.set_xff_num_trusted_hops(1);
-    xff_extension_ = std::make_shared<XffIPDetection>(config);
+    xff_extension_ = *XffIPDetection::create(config);
   }
 
   std::shared_ptr<XffIPDetection> xff_extension_;
@@ -60,7 +60,7 @@ class XffTrustedCidrsTest : public testing::Test {
     cidr3->set_address_prefix("2001:db8:7e57:1::");
     cidr3->mutable_prefix_len()->set_value(64);
     config.mutable_skip_xff_append()->set_value(false);
-    xff_extension_ = std::make_shared<XffIPDetection>(config);
+    xff_extension_ = *XffIPDetection::create(config);
   }
 
   std::shared_ptr<XffIPDetection> xff_extension_;
@@ -146,8 +146,8 @@ TEST(XffInvalidConfigTest, InvalidConfig) {
   cidr->set_address_prefix("192.0.2.0");
   cidr->mutable_prefix_len()->set_value(24);
 
-  EXPECT_THROW_WITH_MESSAGE(std::make_shared<XffIPDetection>(config), EnvoyException,
-                            "Cannot set both xff_num_trusted_hops and xff_trusted_cidrs");
+  EXPECT_EQ(XffIPDetection::create(config).status().message(),
+            "Cannot set both xff_num_trusted_hops and xff_trusted_cidrs");
 }
 
 } // namespace Xff
diff --git a/test/extensions/http/stateful_session/cookie/BUILD b/test/extensions/http/stateful_session/cookie/BUILD
index 18d2caa24c..7ab465a038 100644
--- a/test/extensions/http/stateful_session/cookie/BUILD
+++ b/test/extensions/http/stateful_session/cookie/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "cookie_test",
     srcs = ["cookie_test.cc"],
     extension_names = ["envoy.http.stateful_session.cookie"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:utility_lib",
         "//source/extensions/http/stateful_session/cookie:cookie_lib",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.stateful_session.cookie"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/http/stateful_session/cookie:config",
diff --git a/test/extensions/http/stateful_session/header/BUILD b/test/extensions/http/stateful_session/header/BUILD
index fd1741e9b0..eb6bc51f29 100644
--- a/test/extensions/http/stateful_session/header/BUILD
+++ b/test/extensions/http/stateful_session/header/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "header_test",
     srcs = ["header_test.cc"],
     extension_names = ["envoy.http.stateful_session.header"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:utility_lib",
         "//source/extensions/http/stateful_session/header:header_lib",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.http.stateful_session.header"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/http/stateful_session/header:config",
diff --git a/test/extensions/internal_redirect/BUILD b/test/extensions/internal_redirect/BUILD
index c07300f181..30f17ab347 100644
--- a/test/extensions/internal_redirect/BUILD
+++ b/test/extensions/internal_redirect/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
     srcs = [
         "redirect_extension_integration_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http:header_map_lib",
         "//source/extensions/internal_redirect/allow_listed_routes:config",
diff --git a/test/extensions/internal_redirect/previous_routes/BUILD b/test/extensions/internal_redirect/previous_routes/BUILD
index fe44f0e0c0..bcb4cf911b 100644
--- a/test/extensions/internal_redirect/previous_routes/BUILD
+++ b/test/extensions/internal_redirect/previous_routes/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.internal_redirect_predicates.previous_routes"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:filter_state_lib",
         "//source/extensions/internal_redirect/previous_routes:config",
diff --git a/test/extensions/io_socket/user_space/BUILD b/test/extensions/io_socket/user_space/BUILD
index aa5c9eb2b6..6d3ceb98ff 100644
--- a/test/extensions/io_socket/user_space/BUILD
+++ b/test/extensions/io_socket/user_space/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "file_event_impl_test",
     srcs = ["file_event_impl_test.cc"],
     extension_names = ["envoy.io_socket.user_space"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:file_event_interface",
         "//source/common/event:dispatcher_includes",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     name = "io_handle_impl_test",
     srcs = ["io_handle_impl_test.cc"],
     extension_names = ["envoy.io_socket.user_space"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/network:address_lib",
@@ -44,6 +46,7 @@ envoy_extension_cc_test(
     name = "connection_compatbility_test",
     srcs = ["connection_compatbility_test.cc"],
     extension_names = ["envoy.io_socket.user_space"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/common:utility_lib",
diff --git a/test/extensions/key_value/file_based/BUILD b/test/extensions/key_value/file_based/BUILD
index 7058afdd7c..25b64c201a 100644
--- a/test/extensions/key_value/file_based/BUILD
+++ b/test/extensions/key_value/file_based/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "alternate_protocols_cache_impl_test",
     srcs = ["alternate_protocols_cache_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:key_value_store_lib",
         "//source/common/http:http_server_properties_cache",
@@ -29,6 +30,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "key_value_store_test",
     srcs = ["key_value_store_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:key_value_store_lib",
         "//source/extensions/key_value/file_based:config_lib",
diff --git a/test/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD
new file mode 100644
index 0000000000..e228a82640
--- /dev/null
+++ b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/BUILD
@@ -0,0 +1,52 @@
+load(
+    "//bazel:envoy_build_system.bzl",
+    "envoy_package",
+)
+load(
+    "//test/extensions:extensions_build_system.bzl",
+    "envoy_extension_cc_test",
+)
+
+licenses(["notice"])  # Apache 2
+
+envoy_package()
+
+envoy_extension_cc_test(
+    name = "config_test",
+    srcs = ["config_test.cc"],
+    extension_names = ["envoy.load_balancing_policies.client_side_weighted_round_robin"],
+    deps = [
+        "//source/extensions/load_balancing_policies/client_side_weighted_round_robin:config",
+        "//test/mocks/server:factory_context_mocks",
+        "//test/mocks/upstream:cluster_info_mocks",
+        "//test/mocks/upstream:priority_set_mocks",
+        "@envoy_api//envoy/config/core/v3:pkg_cc_proto",
+    ],
+)
+
+envoy_extension_cc_test(
+    name = "client_side_weighted_round_robin_lb_test",
+    size = "large",
+    srcs = ["client_side_weighted_round_robin_lb_test.cc"],
+    extension_names = ["envoy.load_balancing_policies.client_side_weighted_round_robin"],
+    deps = [
+        "//source/common/protobuf",
+        "//source/extensions/load_balancing_policies/client_side_weighted_round_robin:config",
+        "//test/extensions/load_balancing_policies/common:load_balancer_base_test_lib",
+        "//test/test_common:utility_lib",
+    ],
+)
+
+envoy_extension_cc_test(
+    name = "integration_test",
+    size = "large",
+    srcs = ["integration_test.cc"],
+    extension_names = ["envoy.load_balancing_policies.client_side_weighted_round_robin"],
+    deps = [
+        "//source/common/protobuf",
+        "//source/extensions/load_balancing_policies/client_side_weighted_round_robin:config",
+        "//test/integration:http_integration_lib",
+        "//test/test_common:utility_lib",
+        "@envoy_api//envoy/config/endpoint/v3:pkg_cc_proto",
+    ],
+)
diff --git a/test/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb_test.cc b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb_test.cc
new file mode 100644
index 0000000000..f57aa3f113
--- /dev/null
+++ b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb_test.cc
@@ -0,0 +1,545 @@
+#include <cstdint>
+#include <memory>
+
+#include "envoy/event/dispatcher.h"
+#include "envoy/upstream/load_balancer.h"
+
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/client_side_weighted_round_robin_lb.h"
+
+#include "test/extensions/load_balancing_policies/common/load_balancer_impl_base_test.h"
+
+#include "gmock/gmock.h"
+
+namespace Envoy {
+namespace Upstream {
+
+// Friend ClientSideWeightedRoundRobinLoadBalancer to provide access to private methods.
+class ClientSideWeightedRoundRobinLoadBalancerFriend {
+public:
+  explicit ClientSideWeightedRoundRobinLoadBalancerFriend(
+      std::shared_ptr<ClientSideWeightedRoundRobinLoadBalancer> lb,
+      std::shared_ptr<ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb> worker_lb)
+      : lb_(std::move(lb)), worker_lb_(std::move(worker_lb)) {}
+
+  ~ClientSideWeightedRoundRobinLoadBalancerFriend() = default;
+
+  HostConstSharedPtr chooseHost(LoadBalancerContext* context) {
+    return worker_lb_->chooseHost(context);
+  }
+
+  HostConstSharedPtr peekAnotherHost(LoadBalancerContext* context) {
+    return worker_lb_->peekAnotherHost(context);
+  }
+
+  absl::Status initialize() { return lb_->initialize(); }
+
+  void updateWeightsOnMainThread() { lb_->updateWeightsOnMainThread(); }
+
+  void updateWeightsOnHosts(const HostVector& hosts) { lb_->updateWeightsOnHosts(hosts); }
+
+  static void addClientSideLbPolicyDataToHosts(const HostVector& hosts) {
+    ClientSideWeightedRoundRobinLoadBalancer::addClientSideLbPolicyDataToHosts(hosts);
+  }
+
+  static absl::optional<uint32_t>
+  getClientSideWeightIfValidFromHost(const Host& host, const MonotonicTime& min_non_empty_since,
+                                     const MonotonicTime& max_last_update_time) {
+    return ClientSideWeightedRoundRobinLoadBalancer::getClientSideWeightIfValidFromHost(
+        host, min_non_empty_since, max_last_update_time);
+  }
+
+  static double
+  getUtilizationFromOrcaReport(const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+                               const std::vector<std::string>& utilization_from_metric_names) {
+    return ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::
+        getUtilizationFromOrcaReport(orca_load_report, utilization_from_metric_names);
+  }
+
+  static absl::StatusOr<uint32_t>
+  calculateWeightFromOrcaReport(const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+                                const std::vector<std::string>& utilization_from_metric_names,
+                                double error_utilization_penalty) {
+    return ClientSideWeightedRoundRobinLoadBalancer::OrcaLoadReportHandler::
+        calculateWeightFromOrcaReport(orca_load_report, utilization_from_metric_names,
+                                      error_utilization_penalty);
+  }
+
+  absl::Status updateClientSideDataFromOrcaLoadReport(
+      const xds::data::orca::v3::OrcaLoadReport& orca_load_report,
+      ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData& client_side_data) {
+    return worker_lb_->orca_load_report_handler_->updateClientSideDataFromOrcaLoadReport(
+        orca_load_report, client_side_data);
+  }
+
+  absl::Status onOrcaLoadReport(const OrcaLoadReportProto& orca_load_report,
+                                const HostDescription& host_description) {
+    return worker_lb_->orca_load_report_handler_->onOrcaLoadReport(orca_load_report,
+                                                                   host_description);
+  }
+
+private:
+  std::shared_ptr<ClientSideWeightedRoundRobinLoadBalancer> lb_;
+  std::shared_ptr<ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb> worker_lb_;
+};
+
+namespace {
+
+using testing::Return;
+using testing::ReturnRef;
+using testing::SaveArg;
+
+void setHostClientSideWeight(HostSharedPtr& host, uint32_t weight,
+                             long long non_empty_since_seconds,
+                             long long last_update_time_seconds) {
+  auto client_side_data =
+      std::make_unique<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          weight, /*non_empty_since=*/
+          MonotonicTime(std::chrono::seconds(non_empty_since_seconds)),
+          /*last_update_time=*/
+          MonotonicTime(std::chrono::seconds(last_update_time_seconds)));
+  host->setLbPolicyData(std::move(client_side_data));
+}
+
+class ClientSideWeightedRoundRobinLoadBalancerTest : public LoadBalancerTestBase {
+public:
+  void init(bool need_local_cluster, bool locality_weight_aware = false) {
+    if (need_local_cluster) {
+      local_priority_set_ = std::make_shared<PrioritySetImpl>();
+      local_priority_set_->getOrCreateHostSet(0);
+    }
+
+    if (locality_weight_aware) {
+      common_config_.mutable_locality_weighted_lb_config();
+    }
+
+    client_side_weighted_round_robin_config_.mutable_blackout_period()->set_seconds(10);
+    client_side_weighted_round_robin_config_.mutable_weight_expiration_period()->set_seconds(180);
+    client_side_weighted_round_robin_config_.mutable_weight_update_period()->set_seconds(1);
+    client_side_weighted_round_robin_config_.mutable_error_utilization_penalty()->set_value(0.1);
+    client_side_weighted_round_robin_config_.mutable_metric_names_for_computing_utilization()->Add(
+        "metric1");
+    client_side_weighted_round_robin_config_.mutable_metric_names_for_computing_utilization()->Add(
+        "metric2");
+
+    lb_ = std::make_shared<ClientSideWeightedRoundRobinLoadBalancerFriend>(
+        std::make_shared<ClientSideWeightedRoundRobinLoadBalancer>(
+            lb_config_, cluster_info_, priority_set_, runtime_, random_, simTime()),
+        std::make_shared<ClientSideWeightedRoundRobinLoadBalancer::WorkerLocalLb>(
+            priority_set_, local_priority_set_.get(), stats_, runtime_, random_, common_config_,
+            lb_config_, simTime()));
+
+    // Initialize the thread aware load balancer from config.
+    ASSERT_EQ(lb_->initialize(), absl::OkStatus());
+  }
+
+  // Updates priority 0 with the given hosts and hosts_per_locality.
+  void updateHosts(HostVectorConstSharedPtr hosts,
+                   HostsPerLocalityConstSharedPtr hosts_per_locality) {
+    local_priority_set_->updateHosts(
+        0,
+        updateHostsParams(hosts, hosts_per_locality,
+                          std::make_shared<const HealthyHostVector>(*hosts), hosts_per_locality),
+        {}, empty_host_vector_, empty_host_vector_, random_.random(), absl::nullopt);
+  }
+
+  void peekThenPick(std::vector<int> picks) {
+    for (auto i : picks) {
+      EXPECT_EQ(hostSet().healthy_hosts_[i], lb_->peekAnotherHost(nullptr));
+    }
+    for (auto i : picks) {
+      EXPECT_EQ(hostSet().healthy_hosts_[i], lb_->chooseHost(nullptr));
+    }
+  }
+
+  envoy::extensions::load_balancing_policies::client_side_weighted_round_robin::v3::
+      ClientSideWeightedRoundRobin client_side_weighted_round_robin_config_;
+
+  std::shared_ptr<PrioritySetImpl> local_priority_set_;
+  std::shared_ptr<ClientSideWeightedRoundRobinLoadBalancerFriend> lb_;
+  HostsPerLocalityConstSharedPtr empty_locality_;
+  HostVector empty_host_vector_;
+
+  NiceMock<MockLoadBalancerContext> lb_context_;
+  NiceMock<Event::MockDispatcher> dispatcher_;
+  NiceMock<MockClusterInfo> cluster_info_;
+  ClientSideWeightedRoundRobinLbConfig lb_config_ =
+      ClientSideWeightedRoundRobinLbConfig(client_side_weighted_round_robin_config_, dispatcher_);
+};
+
+//////////////////////////////////////////////////////
+// These tests verify ClientSideWeightedRoundRobinLoadBalancer specific functionality.
+//
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest,
+       UpdateWeightsOnHostsAllHostsHaveClientSideWeights) {
+  init(false);
+  HostVector hosts = {
+      makeTestHost(info_, "tcp://127.0.0.1:80", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:81", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:82", simTime()),
+  };
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+  setHostClientSideWeight(hosts[0], 40, 5, 10);
+  setHostClientSideWeight(hosts[1], 41, 5, 10);
+  setHostClientSideWeight(hosts[2], 42, 5, 10);
+  // Setting client side weights should not change the host weights.
+  EXPECT_EQ(hosts[0]->weight(), 1);
+  EXPECT_EQ(hosts[1]->weight(), 1);
+  EXPECT_EQ(hosts[2]->weight(), 1);
+  // Update weights on hosts.
+  lb_->updateWeightsOnHosts(hosts);
+  // All hosts have client side weights, so the weights should be updated.
+  EXPECT_EQ(hosts[0]->weight(), 40);
+  EXPECT_EQ(hosts[1]->weight(), 41);
+  EXPECT_EQ(hosts[2]->weight(), 42);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, UpdateWeightsOneHostHasClientSideWeight) {
+  init(false);
+  HostVector hosts = {
+      makeTestHost(info_, "tcp://127.0.0.1:80", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:81", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:82", simTime()),
+  };
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+  // Set client side weight for one host.
+  setHostClientSideWeight(hosts[0], 42, 5, 10);
+  // Setting client side weights should not change the host weights.
+  EXPECT_EQ(hosts[0]->weight(), 1);
+  EXPECT_EQ(hosts[1]->weight(), 1);
+  EXPECT_EQ(hosts[2]->weight(), 1);
+  // Update weights on hosts.
+  lb_->updateWeightsOnHosts(hosts);
+  // Only one host has client side weight, other hosts get the median weight.
+  EXPECT_EQ(hosts[0]->weight(), 42);
+  EXPECT_EQ(hosts[1]->weight(), 42);
+  EXPECT_EQ(hosts[2]->weight(), 42);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, UpdateWeightsDefaultIsMedianWeight) {
+  init(false);
+  HostVector hosts = {
+      makeTestHost(info_, "tcp://127.0.0.1:80", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:81", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:82", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:83", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:84", simTime()),
+  };
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+  // Set client side weight for first three hosts.
+  setHostClientSideWeight(hosts[0], 5, 5, 10);
+  setHostClientSideWeight(hosts[1], 42, 5, 10);
+  setHostClientSideWeight(hosts[2], 5000, 5, 10);
+  // Setting client side weights should not change the host weights.
+  EXPECT_EQ(hosts[0]->weight(), 1);
+  EXPECT_EQ(hosts[1]->weight(), 1);
+  EXPECT_EQ(hosts[2]->weight(), 1);
+  EXPECT_EQ(hosts[3]->weight(), 1);
+  EXPECT_EQ(hosts[4]->weight(), 1);
+  // Update weights on hosts.
+  lb_->updateWeightsOnHosts(hosts);
+  // First three hosts have client side weight, other hosts get the median
+  // weight.
+  EXPECT_EQ(hosts[0]->weight(), 5);
+  EXPECT_EQ(hosts[1]->weight(), 42);
+  EXPECT_EQ(hosts[2]->weight(), 5000);
+  EXPECT_EQ(hosts[3]->weight(), 42);
+  EXPECT_EQ(hosts[4]->weight(), 42);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, ChooseHostWithClientSideWeights) {
+  if (&hostSet() == &failover_host_set_) { // P = 1 does not support zone-aware routing.
+    return;
+  }
+  hostSet().healthy_hosts_ = {
+      makeTestHost(info_, "tcp://127.0.0.1:80", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:81", simTime()),
+      makeTestHost(info_, "tcp://127.0.0.1:82", simTime()),
+  };
+  hostSet().hosts_ = hostSet().healthy_hosts_;
+  init(false);
+
+  hostSet().runCallbacks({}, {});
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(5)));
+  for (const auto& host_ptr : hostSet().hosts_) {
+    // chooseHost calls setOrcaLoadReportCallbacks.
+    std::weak_ptr<LoadBalancerContext::OrcaLoadReportCallbacks> weak_orca_load_report_callbacks;
+    EXPECT_CALL(lb_context_, setOrcaLoadReportCallbacks(_))
+        .WillOnce(
+            Invoke([&](std::weak_ptr<LoadBalancerContext::OrcaLoadReportCallbacks> callbacks) {
+              weak_orca_load_report_callbacks = callbacks;
+            }));
+    HostConstSharedPtr host = lb_->chooseHost(&lb_context_);
+    // Hosts have equal weights, so chooseHost returns the current host.
+    ASSERT_EQ(host, host_ptr);
+    // Invoke the callback with an Orca load report.
+    xds::data::orca::v3::OrcaLoadReport orca_load_report;
+    orca_load_report.set_rps_fractional(1000);
+    orca_load_report.set_application_utilization(0.5);
+    // Orca load report callback does NOT change the host weight.
+    auto orca_load_report_callbacks = weak_orca_load_report_callbacks.lock();
+    ASSERT_NE(orca_load_report_callbacks, nullptr);
+    EXPECT_EQ(orca_load_report_callbacks->onOrcaLoadReport(orca_load_report, *host.get()),
+              absl::OkStatus());
+    EXPECT_EQ(host->weight(), 1);
+  }
+  // Update weights on hosts.
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+  lb_->updateWeightsOnMainThread();
+  // All hosts have client side weights, so the weights should be updated.
+  for (const auto& host_ptr : hostSet().hosts_) {
+    EXPECT_EQ(host_ptr->weight(), 2000);
+  }
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, ProcessOrcaLoadReport_FirstReport) {
+  init(false);
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  orca_load_report.set_application_utilization(0.5);
+
+  auto client_side_data =
+      std::make_shared<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>();
+  EXPECT_EQ(lb_->updateClientSideDataFromOrcaLoadReport(orca_load_report, *client_side_data),
+            absl::OkStatus());
+  // First report, so non_empty_since_ is updated.
+  EXPECT_EQ(client_side_data->non_empty_since_.load(), MonotonicTime(std::chrono::seconds(30)));
+  // last_update_time_ is updated.
+  EXPECT_EQ(client_side_data->last_update_time_.load(), MonotonicTime(std::chrono::seconds(30)));
+  // weight_ is calculated based on the Orca report.
+  EXPECT_EQ(client_side_data->weight_.load(), 2000);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, ProcessOrcaLoadReport_Update) {
+  init(false);
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  orca_load_report.set_application_utilization(0.5);
+
+  auto client_side_data =
+      std::make_shared<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          42, /*non_empty_since=*/MonotonicTime(std::chrono::seconds(1)),
+          /*last_update_time=*/MonotonicTime(std::chrono::seconds(10)));
+  EXPECT_EQ(lb_->updateClientSideDataFromOrcaLoadReport(orca_load_report, *client_side_data),
+            absl::OkStatus());
+  // Not a first report, so non_empty_since_ is not updated.
+  EXPECT_EQ(client_side_data->non_empty_since_.load(), MonotonicTime(std::chrono::seconds(1)));
+  // last_update_time_ is updated.
+  EXPECT_EQ(client_side_data->last_update_time_.load(), MonotonicTime(std::chrono::seconds(30)));
+  // weight_ is recalculated based on the Orca report.
+  EXPECT_EQ(client_side_data->weight_.load(), 2000);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, ProcessOrcaLoadReport_UpdateWithInvalidQps) {
+  init(false);
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  // QPS is 0, so the report is invalid.
+  orca_load_report.set_rps_fractional(0);
+  orca_load_report.set_application_utilization(0.5);
+
+  auto client_side_data =
+      std::make_shared<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          42, /*non_empty_since=*/MonotonicTime(std::chrono::seconds(1)),
+          /*last_update_time=*/MonotonicTime(std::chrono::seconds(10)));
+  EXPECT_EQ(lb_->updateClientSideDataFromOrcaLoadReport(orca_load_report, *client_side_data),
+            absl::InvalidArgumentError("QPS must be positive"));
+  // None of the client side data is updated.
+  EXPECT_EQ(client_side_data->non_empty_since_.load(), MonotonicTime(std::chrono::seconds(1)));
+  EXPECT_EQ(client_side_data->last_update_time_.load(), MonotonicTime(std::chrono::seconds(10)));
+  EXPECT_EQ(client_side_data->weight_.load(), 42);
+}
+
+TEST_P(ClientSideWeightedRoundRobinLoadBalancerTest, OnOrcaLoadReport_NoClientSideData) {
+  init(false);
+  simTime().setMonotonicTime(MonotonicTime(std::chrono::seconds(30)));
+
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  // QPS is 0, so the report is invalid.
+  orca_load_report.set_rps_fractional(0);
+  orca_load_report.set_application_utilization(0.5);
+
+  auto host = makeTestHost(info_, "tcp://127.0.0.1:80", simTime());
+
+  EXPECT_EQ(lb_->onOrcaLoadReport(orca_load_report, *host.get()),
+            absl::NotFoundError("Host does not have ClientSideLbPolicyData"));
+}
+
+INSTANTIATE_TEST_SUITE_P(PrimaryOrFailoverAndLegacyOrNew,
+                         ClientSideWeightedRoundRobinLoadBalancerTest,
+                         ::testing::Values(LoadBalancerTestParam{true},
+                                           LoadBalancerTestParam{false}));
+
+// Unit tests for ClientSideWeightedRoundRobinLoadBalancer implementation.
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest,
+     GetClientSideWeightIfValidFromHost_NoClientSideData) {
+  NiceMock<Envoy::Upstream::MockHost> host;
+  EXPECT_FALSE(ClientSideWeightedRoundRobinLoadBalancerFriend::getClientSideWeightIfValidFromHost(
+      host, MonotonicTime::min(), MonotonicTime::max()));
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetClientSideWeightIfValidFromHost_TooRecent) {
+  NiceMock<Envoy::Upstream::MockHost> host;
+  host.lb_policy_data_ =
+      std::make_unique<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          42, /*non_empty_since=*/MonotonicTime(std::chrono::seconds(5)),
+          /*last_update_time=*/MonotonicTime(std::chrono::seconds(10)));
+  // Non empty since is too recent (5 > 2).
+  EXPECT_FALSE(ClientSideWeightedRoundRobinLoadBalancerFriend::getClientSideWeightIfValidFromHost(
+      host,
+      /*min_non_empty_since=*/MonotonicTime(std::chrono::seconds(2)),
+      /*max_last_update_time=*/MonotonicTime(std::chrono::seconds(8))));
+  // non_empty_since_ is not updated.
+  EXPECT_EQ(
+      host.typedLbPolicyData<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>()
+          ->non_empty_since_.load(),
+      MonotonicTime(std::chrono::seconds(5)));
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetClientSideWeightIfValidFromHost_TooStale) {
+  NiceMock<Envoy::Upstream::MockHost> host;
+  host.lb_policy_data_ =
+      std::make_unique<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          42, /*non_empty_since=*/MonotonicTime(std::chrono::seconds(1)),
+          /*last_update_time=*/MonotonicTime(std::chrono::seconds(7)));
+  // Last update time is too stale (7 < 8).
+  EXPECT_FALSE(ClientSideWeightedRoundRobinLoadBalancerFriend::getClientSideWeightIfValidFromHost(
+      host,
+      /*min_non_empty_since=*/MonotonicTime(std::chrono::seconds(2)),
+      /*max_last_update_time=*/MonotonicTime(std::chrono::seconds(8))));
+  // Also resets the non_empty_since_ time.
+  EXPECT_EQ(
+      host.typedLbPolicyData<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>()
+          ->non_empty_since_.load(),
+      ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData::kDefaultNonEmptySince);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetClientSideWeightIfValidFromHost_Valid) {
+  NiceMock<Envoy::Upstream::MockHost> host;
+  host.lb_policy_data_ =
+      std::make_unique<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>(
+          42, /*non_empty_since=*/MonotonicTime(std::chrono::seconds(1)),
+          /*last_update_time=*/MonotonicTime(std::chrono::seconds(10)));
+  // Not empty since is not too recent (1 < 2) and last update time is not too
+  // old (10 > 8).
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::getClientSideWeightIfValidFromHost(
+                host,
+                /*min_non_empty_since=*/MonotonicTime(std::chrono::seconds(2)),
+                /*max_last_update_time=*/MonotonicTime(std::chrono::seconds(8)))
+                .value(),
+            42);
+  // non_empty_since_ is not updated.
+  EXPECT_EQ(
+      host.typedLbPolicyData<ClientSideWeightedRoundRobinLoadBalancer::ClientSideHostLbPolicyData>()
+          ->non_empty_since_.load(),
+      MonotonicTime(std::chrono::seconds(1)));
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest,
+     GetUtilizationFromOrcaReport_ApplicationUtilization) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_application_utilization(0.5);
+  orca_load_report.mutable_named_metrics()->insert({"foo", 0.3});
+  orca_load_report.set_cpu_utilization(0.6);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::getUtilizationFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}),
+            0.5);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetUtilizationFromOrcaReport_NamedMetrics) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.mutable_named_metrics()->insert({"foo", 0.3});
+  orca_load_report.set_cpu_utilization(0.6);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::getUtilizationFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}),
+            0.3);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetUtilizationFromOrcaReport_CpuUtilization) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.mutable_named_metrics()->insert({"bar", 0.3});
+  orca_load_report.set_cpu_utilization(0.6);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::getUtilizationFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}),
+            0.6);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, GetUtilizationFromOrcaReport_NoUtilization) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::getUtilizationFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}),
+            0);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, CalculateWeightFromOrcaReport_NoQps) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 0.0)
+                .status(),
+            absl::InvalidArgumentError("QPS must be positive"));
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, CalculateWeightFromOrcaReport_NoUtilization) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 0.0)
+                .status(),
+            absl::InvalidArgumentError("Utilization must be positive"));
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest,
+     CalculateWeightFromOrcaReport_ValidQpsAndUtilization) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  orca_load_report.set_application_utilization(0.5);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 0.0)
+                .value(),
+            2000);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest, CalculateWeightFromOrcaReport_MaxWeight) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  // High QPS and low utilization.
+  orca_load_report.set_rps_fractional(10000000000000L);
+  orca_load_report.set_application_utilization(0.0000001);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 0.0)
+                .value(),
+            /*std::numeric_limits<uint32_t>::max() = */ 4294967295);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest,
+     CalculateWeightFromOrcaReport_ValidNoErrorPenalty) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  orca_load_report.set_eps(100);
+  orca_load_report.set_application_utilization(0.5);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 0.0)
+                .value(),
+            2000);
+}
+
+TEST(ClientSideWeightedRoundRobinLoadBalancerTest,
+     CalculateWeightFromOrcaReport_ValidWithErrorPenalty) {
+  xds::data::orca::v3::OrcaLoadReport orca_load_report;
+  orca_load_report.set_rps_fractional(1000);
+  orca_load_report.set_eps(100);
+  orca_load_report.set_application_utilization(0.5);
+  EXPECT_EQ(ClientSideWeightedRoundRobinLoadBalancerFriend::calculateWeightFromOrcaReport(
+                orca_load_report, {"named_metrics.foo"}, 2.0)
+                .value(),
+            1428);
+}
+
+} // namespace
+} // namespace Upstream
+} // namespace Envoy
diff --git a/test/extensions/load_balancing_policies/client_side_weighted_round_robin/config_test.cc b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/config_test.cc
new file mode 100644
index 0000000000..d9bc93b4c4
--- /dev/null
+++ b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/config_test.cc
@@ -0,0 +1,55 @@
+#include "source/extensions/load_balancing_policies/client_side_weighted_round_robin/config.h"
+
+//#include "testing/base/public/gunit.h"
+#include "envoy/config/core/v3/extension.pb.h"
+#include "test/mocks/server/factory_context.h"
+#include "test/mocks/upstream/cluster_info.h"
+#include "test/mocks/upstream/priority_set.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace LoadBalancingPolices {
+namespace ClientSideWeightedRoundRobin {
+namespace {
+
+TEST(ClientSideWeightedRoundRobinConfigTest, ValidateFail) {
+  NiceMock<Server::Configuration::MockServerFactoryContext> context;
+  NiceMock<Upstream::MockClusterInfo> cluster_info;
+  NiceMock<Upstream::MockPrioritySet> main_thread_priority_set;
+  NiceMock<Upstream::MockPrioritySet> thread_local_priority_set;
+  NiceMock<Event::MockDispatcher> mock_thread_dispatcher;
+  NiceMock<Upstream::MockLoadBalancerFactoryContext> lb_factory_context;
+  ON_CALL(lb_factory_context, mainThreadDispatcher())
+      .WillByDefault(ReturnRef(mock_thread_dispatcher));
+
+  envoy::config::core::v3::TypedExtensionConfig config;
+  config.set_name("envoy.load_balancing_policies.client_side_weighted_round_robin");
+  envoy::extensions::load_balancing_policies::client_side_weighted_round_robin::v3::
+      ClientSideWeightedRoundRobin config_msg;
+  config.mutable_typed_config()->PackFrom(config_msg);
+
+  auto& factory = Config::Utility::getAndCheckFactory<Upstream::TypedLoadBalancerFactory>(config);
+  EXPECT_EQ("envoy.load_balancing_policies.client_side_weighted_round_robin", factory.name());
+
+  auto lb_config = factory.loadConfig(lb_factory_context, *factory.createEmptyConfigProto(),
+                                      context.messageValidationVisitor());
+
+  auto thread_aware_lb =
+      factory.create(*lb_config, cluster_info, main_thread_priority_set, context.runtime_loader_,
+                     context.api_.random_, context.time_system_);
+  EXPECT_NE(nullptr, thread_aware_lb);
+
+  ASSERT_TRUE(thread_aware_lb->initialize().ok());
+
+  auto thread_local_lb_factory = thread_aware_lb->factory();
+  EXPECT_NE(nullptr, thread_local_lb_factory);
+
+  auto thread_local_lb = thread_local_lb_factory->create({thread_local_priority_set, nullptr});
+  EXPECT_NE(nullptr, thread_local_lb);
+}
+
+} // namespace
+} // namespace ClientSideWeightedRoundRobin
+} // namespace LoadBalancingPolices
+} // namespace Extensions
+} // namespace Envoy
diff --git a/test/extensions/load_balancing_policies/client_side_weighted_round_robin/integration_test.cc b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/integration_test.cc
new file mode 100644
index 0000000000..94c5c04050
--- /dev/null
+++ b/test/extensions/load_balancing_policies/client_side_weighted_round_robin/integration_test.cc
@@ -0,0 +1,172 @@
+#include <chrono>
+#include <cstdint>
+
+#include "envoy/config/endpoint/v3/endpoint_components.pb.h"
+
+#include "source/common/common/base64.h"
+#include "source/common/http/utility.h"
+#include "source/common/protobuf/protobuf.h"
+#include "source/extensions/load_balancing_policies/round_robin/config.h"
+
+#include "test/integration/http_integration.h"
+
+#include "gtest/gtest.h"
+
+namespace Envoy {
+namespace Extensions {
+namespace LoadBalancingPolices {
+namespace ClientSideWeightedRoundRobin {
+namespace {
+
+class ClientSideWeightedRoundRobinIntegrationTest
+    : public testing::TestWithParam<Network::Address::IpVersion>,
+      public HttpIntegrationTest {
+public:
+  ClientSideWeightedRoundRobinIntegrationTest()
+      : HttpIntegrationTest(Http::CodecType::HTTP1, GetParam()) {
+    // Create 3 different upstream server for stateful session test.
+    setUpstreamCount(3);
+  }
+
+  void initializeConfig() {
+    config_helper_.addConfigModifier([](envoy::config::bootstrap::v3::Bootstrap& bootstrap) {
+      auto* cluster_0 = bootstrap.mutable_static_resources()->mutable_clusters()->Mutable(0);
+      ASSERT(cluster_0->name() == "cluster_0");
+      auto* endpoint = cluster_0->mutable_load_assignment()->mutable_endpoints()->Mutable(0);
+
+      constexpr absl::string_view endpoints_yaml = R"EOF(
+          lb_endpoints:
+          - endpoint:
+              address:
+                socket_address:
+                  address: {}
+                  port_value: 0
+          - endpoint:
+              address:
+                socket_address:
+                  address: {}
+                  port_value: 0
+          - endpoint:
+              address:
+                socket_address:
+                  address: {}
+                  port_value: 0
+          )EOF";
+
+      const std::string local_address = Network::Test::getLoopbackAddressString(GetParam());
+      TestUtility::loadFromYaml(
+          fmt::format(endpoints_yaml, local_address, local_address, local_address), *endpoint);
+
+      auto* policy = cluster_0->mutable_load_balancing_policy();
+
+      // Configure LB policy with short blackout period, long expiration period,
+      // and short update period.
+      const std::string policy_yaml = R"EOF(
+          policies:
+          - typed_extension_config:
+              name: envoy.load_balancing_policies.client_side_weighted_round_robin
+              typed_config:
+                  "@type": type.googleapis.com/envoy.extensions.load_balancing_policies.client_side_weighted_round_robin.v3.ClientSideWeightedRoundRobin
+                  blackout_period:
+                      seconds: 1
+                  weight_expiration_period:
+                      seconds: 180
+                  weight_update_period:
+                      seconds: 1
+          )EOF";
+
+      TestUtility::loadFromYaml(policy_yaml, *policy);
+    });
+
+    HttpIntegrationTest::initialize();
+  }
+
+  Http::TestResponseHeaderMapImpl
+  responseHeadersWithLoadReport(int backend_index, double application_utilization, double qps) {
+    xds::data::orca::v3::OrcaLoadReport orca_load_report;
+    orca_load_report.set_application_utilization(application_utilization);
+    orca_load_report.mutable_named_metrics()->insert({"backend_index", backend_index});
+    orca_load_report.set_rps_fractional(qps);
+    std::string proto_string = TestUtility::getProtobufBinaryStringFromMessage(orca_load_report);
+    std::string orca_load_report_header_bin =
+        Envoy::Base64::encode(proto_string.c_str(), proto_string.length());
+    Http::TestResponseHeaderMapImpl response_headers{{":status", "200"}};
+    response_headers.addCopy("endpoint-load-metrics-bin", orca_load_report_header_bin);
+    return response_headers;
+  }
+
+  void sendRequestsAndTrackUpstreamUsage(uint64_t number_of_requests,
+                                         std::vector<uint64_t>& upstream_usage) {
+    // Expected number of upstreams.
+    upstream_usage.resize(3);
+    ENVOY_LOG(trace, "Start sending {} requests.", number_of_requests);
+
+    for (uint64_t i = 0; i < number_of_requests; i++) {
+      ENVOY_LOG(trace, "Before request {}.", i);
+
+      codec_client_ = makeHttpConnection(lookupPort("http"));
+
+      Http::TestRequestHeaderMapImpl request_headers{
+          {":method", "GET"}, {":path", "/"}, {":scheme", "http"}, {":authority", "example.com"}};
+
+      auto response = codec_client_->makeRequestWithBody(request_headers, 0);
+
+      auto upstream_index = waitForNextUpstreamRequest({0, 1, 2});
+      ASSERT(upstream_index.has_value());
+      upstream_usage[upstream_index.value()]++;
+
+      // All hosts report the same utilization, but different QPS, so their
+      // weights will be different.
+      upstream_request_->encodeHeaders(
+          responseHeadersWithLoadReport(upstream_index.value(), 0.5,
+                                        1 * (upstream_index.value() + 1)),
+          true);
+
+      ASSERT_TRUE(response->waitForEndStream());
+
+      EXPECT_TRUE(upstream_request_->complete());
+      EXPECT_TRUE(response->complete());
+
+      cleanupUpstreamAndDownstream();
+      ENVOY_LOG(trace, "After request {}.", i);
+    }
+  }
+
+  void runNormalLoadBalancing() {
+    std::vector<uint64_t> indexs;
+
+    // Initial requests use round robin because client-side reported weights
+    // are ignored during 1s blackout period.
+    std::vector<uint64_t> initial_usage;
+    sendRequestsAndTrackUpstreamUsage(50, initial_usage);
+
+    ENVOY_LOG(trace, "initial_usage {}", initial_usage);
+
+    // Wait longer than blackout period to ensure that client side weights are
+    // applied.
+    timeSystem().advanceTimeWait(std::chrono::seconds(2));
+
+    // Send more requests expecting weights to be applied, so upstream hosts are
+    // used proportionally to their weights.
+    std::vector<uint64_t> weighted_usage;
+    sendRequestsAndTrackUpstreamUsage(100, weighted_usage);
+    ENVOY_LOG(trace, "weighted_usage {}", weighted_usage);
+    EXPECT_LT(weighted_usage[0], weighted_usage[1]);
+    EXPECT_LT(weighted_usage[1], weighted_usage[2]);
+  }
+};
+
+INSTANTIATE_TEST_SUITE_P(IpVersions, ClientSideWeightedRoundRobinIntegrationTest,
+                         testing::ValuesIn(TestEnvironment::getIpVersionsForTest()),
+                         TestUtility::ipTestParamsToString);
+
+TEST_P(ClientSideWeightedRoundRobinIntegrationTest, NormalLoadBalancing) {
+  initializeConfig();
+  runNormalLoadBalancing();
+}
+
+} // namespace
+} // namespace ClientSideWeightedRoundRobin
+} // namespace LoadBalancingPolices
+} // namespace Extensions
+} // namespace Envoy
diff --git a/test/extensions/load_balancing_policies/cluster_provided/BUILD b/test/extensions/load_balancing_policies/cluster_provided/BUILD
index af0b1d96c2..33fb56b539 100644
--- a/test/extensions/load_balancing_policies/cluster_provided/BUILD
+++ b/test/extensions/load_balancing_policies/cluster_provided/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.cluster_provided"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/cluster_provided:config",
         "//test/mocks/server:factory_context_mocks",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.cluster_provided"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/clusters/original_dst:original_dst_cluster_lib",
diff --git a/test/extensions/load_balancing_policies/common/BUILD b/test/extensions/load_balancing_policies/common/BUILD
index 2fa854c692..255bb6e5e7 100644
--- a/test/extensions/load_balancing_policies/common/BUILD
+++ b/test/extensions/load_balancing_policies/common/BUILD
@@ -30,6 +30,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "bounded_load_hlb_test",
     srcs = ["bounded_load_hlb_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/upstream:upstream_includes",
         "//source/extensions/load_balancing_policies/common:thread_aware_lb_lib",
@@ -43,6 +44,7 @@ envoy_cc_test_library(
     name = "load_balancer_fuzz_lib",
     srcs = ["load_balancer_fuzz_base.cc"],
     hdrs = ["load_balancer_fuzz_base.h"],
+    rbe_pool = "2core",
     deps = [
         ":load_balancer_fuzz_proto_cc_proto",
         "//source/common/upstream:load_balancer_context_base_lib",
@@ -118,6 +120,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "load_balancer_base_test",
     srcs = ["load_balancer_impl_base_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":load_balancer_base_test_lib",
     ],
diff --git a/test/extensions/load_balancing_policies/least_request/BUILD b/test/extensions/load_balancing_policies/least_request/BUILD
index 923b383b69..25a44e0973 100644
--- a/test/extensions/load_balancing_policies/least_request/BUILD
+++ b/test/extensions/load_balancing_policies/least_request/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.least_request"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/least_request:config",
         "//test/mocks/server:factory_context_mocks",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.least_request"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/load_balancing_policies/least_request:config",
@@ -55,6 +57,7 @@ envoy_cc_fuzz_test(
     name = "least_request_load_balancer_fuzz_test",
     srcs = ["least_request_load_balancer_fuzz_test.cc"],
     corpus = "least_request_load_balancer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":least_request_load_balancer_fuzz_proto_cc_proto",
         "//source/extensions/load_balancing_policies/least_request:config",
@@ -66,6 +69,7 @@ envoy_cc_fuzz_test(
 envoy_cc_benchmark_binary(
     name = "least_request_lb_benchmark",
     srcs = ["least_request_lb_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/least_request:least_request_lb_lib",
         "//test/extensions/load_balancing_policies/common:benchmark_base_tester_lib",
@@ -82,6 +86,7 @@ envoy_extension_cc_test(
     name = "least_request_lb_test",
     srcs = ["least_request_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.least_request"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/least_request:least_request_lb_lib",
         "//test/extensions/load_balancing_policies/common:load_balancer_base_test_lib",
@@ -92,6 +97,7 @@ envoy_extension_cc_test(
     name = "least_request_lb_simulation_test",
     srcs = ["least_request_lb_simulation_test.cc"],
     extension_names = ["envoy.load_balancing_policies.least_request"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:random_generator_lib",
         "//source/common/upstream:load_balancer_context_base_lib",
diff --git a/test/extensions/load_balancing_policies/maglev/BUILD b/test/extensions/load_balancing_policies/maglev/BUILD
index bb8b5809cc..49c7308ccd 100644
--- a/test/extensions/load_balancing_policies/maglev/BUILD
+++ b/test/extensions/load_balancing_policies/maglev/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "maglev_lb_test",
     srcs = ["maglev_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.maglev"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/maglev:maglev_lb_lib",
         "//test/common/upstream:utility_lib",
@@ -38,6 +39,7 @@ envoy_extension_cc_test(
     name = "maglev_lb_force_original_impl_test",
     srcs = ["maglev_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.maglev"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/maglev:maglev_lb_force_original_impl_lib",
         "//test/common/upstream:utility_lib",
@@ -57,6 +59,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.maglev"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/maglev:config",
         "//test/mocks/server:factory_context_mocks",
@@ -72,6 +75,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.maglev"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/load_balancing_policies/maglev:config",
@@ -84,6 +88,7 @@ envoy_extension_cc_test(
 envoy_cc_benchmark_binary(
     name = "maglev_lb_benchmark",
     srcs = ["maglev_lb_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/maglev:maglev_lb_lib",
         "//test/extensions/load_balancing_policies/common:benchmark_base_tester_lib",
diff --git a/test/extensions/load_balancing_policies/random/BUILD b/test/extensions/load_balancing_policies/random/BUILD
index 8f295c307e..47a1b26406 100644
--- a/test/extensions/load_balancing_policies/random/BUILD
+++ b/test/extensions/load_balancing_policies/random/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.random"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/random:config",
         "//test/mocks/server:factory_context_mocks",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.random"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/load_balancing_policies/random:config",
@@ -54,6 +56,7 @@ envoy_cc_fuzz_test(
     name = "random_load_balancer_fuzz_test",
     srcs = ["random_load_balancer_fuzz_test.cc"],
     corpus = "random_load_balancer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":random_load_balancer_fuzz_proto_cc_proto",
         "//source/extensions/load_balancing_policies/random:config",
@@ -65,6 +68,7 @@ envoy_cc_fuzz_test(
 envoy_cc_benchmark_binary(
     name = "random_lb_benchmark",
     srcs = ["random_lb_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/random:random_lb_lib",
         "//test/extensions/load_balancing_policies/common:benchmark_base_tester_lib",
@@ -81,6 +85,7 @@ envoy_extension_cc_test(
     name = "random_lb_test",
     srcs = ["random_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.random"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/random:random_lb_lib",
         "//test/extensions/load_balancing_policies/common:load_balancer_base_test_lib",
@@ -91,6 +96,7 @@ envoy_extension_cc_test(
     name = "random_lb_simulation_test",
     srcs = ["random_lb_simulation_test.cc"],
     extension_names = ["envoy.load_balancing_policies.random"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:random_generator_lib",
         "//source/common/upstream:load_balancer_context_base_lib",
diff --git a/test/extensions/load_balancing_policies/ring_hash/BUILD b/test/extensions/load_balancing_policies/ring_hash/BUILD
index a55f329031..44aa918c0c 100644
--- a/test/extensions/load_balancing_policies/ring_hash/BUILD
+++ b/test/extensions/load_balancing_policies/ring_hash/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "ring_hash_lb_test",
     srcs = ["ring_hash_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.ring_hash"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/router:router_interface",
         "//source/common/network:utility_lib",
@@ -40,6 +41,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.ring_hash"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/ring_hash:config",
         "//test/mocks/server:factory_context_mocks",
@@ -55,6 +57,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.ring_hash"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/load_balancing_policies/ring_hash:config",
@@ -67,6 +70,7 @@ envoy_extension_cc_test(
 envoy_cc_benchmark_binary(
     name = "ring_hash_lb_benchmark",
     srcs = ["ring_hash_lb_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/ring_hash:ring_hash_lb_lib",
         "//test/extensions/load_balancing_policies/common:benchmark_base_tester_lib",
diff --git a/test/extensions/load_balancing_policies/round_robin/BUILD b/test/extensions/load_balancing_policies/round_robin/BUILD
index e627d16684..c392843805 100644
--- a/test/extensions/load_balancing_policies/round_robin/BUILD
+++ b/test/extensions/load_balancing_policies/round_robin/BUILD
@@ -19,6 +19,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.round_robin"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/round_robin:config",
         "//test/mocks/server:factory_context_mocks",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.round_robin"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/load_balancing_policies/round_robin:config",
@@ -55,6 +57,7 @@ envoy_cc_fuzz_test(
     name = "round_robin_load_balancer_fuzz_test",
     srcs = ["round_robin_load_balancer_fuzz_test.cc"],
     corpus = "round_robin_load_balancer_corpus",
+    rbe_pool = "2core",
     deps = [
         ":round_robin_load_balancer_fuzz_proto_cc_proto",
         "//source/extensions/load_balancing_policies/round_robin:config",
@@ -67,6 +70,7 @@ envoy_cc_fuzz_test(
 envoy_cc_benchmark_binary(
     name = "round_robin_lb_benchmark",
     srcs = ["round_robin_lb_benchmark.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/round_robin:config",
         "//test/extensions/load_balancing_policies/common:benchmark_base_tester_lib",
@@ -83,6 +87,7 @@ envoy_extension_cc_test(
     name = "round_robin_lb_test",
     srcs = ["round_robin_lb_test.cc"],
     extension_names = ["envoy.load_balancing_policies.round_robin"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/round_robin:round_robin_lb_lib",
         "//test/extensions/load_balancing_policies/common:load_balancer_base_test_lib",
diff --git a/test/extensions/load_balancing_policies/subset/BUILD b/test/extensions/load_balancing_policies/subset/BUILD
index b66dab8161..5dc5265cfa 100644
--- a/test/extensions/load_balancing_policies/subset/BUILD
+++ b/test/extensions/load_balancing_policies/subset/BUILD
@@ -17,6 +17,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.load_balancing_policies.subset"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/random:config",
         "//source/extensions/load_balancing_policies/subset:config",
@@ -33,6 +34,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.load_balancing_policies.subset"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf",
         "//source/extensions/filters/http/header_to_metadata:config",
@@ -48,6 +50,7 @@ envoy_extension_cc_test(
     name = "subset_test",
     srcs = ["subset_test.cc"],
     extension_names = ["envoy.load_balancing_policies.subset"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:minimal_logger_lib",
         "//source/common/network:utility_lib",
@@ -81,6 +84,7 @@ envoy_extension_cc_benchmark_binary(
     name = "subset_benchmark",
     srcs = ["subset_benchmark.cc"],
     extension_names = ["envoy.load_balancing_policies.subset"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/load_balancing_policies/random:config",
         "//source/extensions/load_balancing_policies/subset:config",
diff --git a/test/extensions/matching/actions/format_string/BUILD b/test/extensions/matching/actions/format_string/BUILD
index 47a4fc7f91..2034f218a1 100644
--- a/test/extensions/matching/actions/format_string/BUILD
+++ b/test/extensions/matching/actions/format_string/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.matching.actions.format_string"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/extensions/matching/actions/format_string:config",
diff --git a/test/extensions/matching/common_inputs/environment_variable/BUILD b/test/extensions/matching/common_inputs/environment_variable/BUILD
index fc0b1cff09..5c8d2aa4c1 100644
--- a/test/extensions/matching/common_inputs/environment_variable/BUILD
+++ b/test/extensions/matching/common_inputs/environment_variable/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.matching.common_inputs.environment_variable"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/common_inputs/environment_variable:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "input_test",
     srcs = ["input_test.cc"],
     extension_names = ["envoy.matching.common_inputs.environment_variable"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/common_inputs/environment_variable:input_lib",
     ],
diff --git a/test/extensions/matching/input_matchers/cel_matcher/BUILD b/test/extensions/matching/input_matchers/cel_matcher/BUILD
index 74f2ce3473..8cc90b4b22 100644
--- a/test/extensions/matching/input_matchers/cel_matcher/BUILD
+++ b/test/extensions/matching/input_matchers/cel_matcher/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
     name = "cel_matcher_test",
     srcs = ["cel_matcher_test.cc"],
     extension_names = ["envoy.matching.matchers.cel_matcher"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         ":cel_matcher_test_lib",
diff --git a/test/extensions/matching/input_matchers/consistent_hashing/BUILD b/test/extensions/matching/input_matchers/consistent_hashing/BUILD
index 6e1b9e77a1..a1d37c07a1 100644
--- a/test/extensions/matching/input_matchers/consistent_hashing/BUILD
+++ b/test/extensions/matching/input_matchers/consistent_hashing/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.matching.matchers.consistent_hashing"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/consistent_hashing:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
     extension_names = ["envoy.matching.matchers.consistent_hashing"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/consistent_hashing:consistent_hashing_lib",
     ],
diff --git a/test/extensions/matching/input_matchers/ip/BUILD b/test/extensions/matching/input_matchers/ip/BUILD
index 3bab6a1dd8..783b783464 100644
--- a/test/extensions/matching/input_matchers/ip/BUILD
+++ b/test/extensions/matching/input_matchers/ip/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.matching.matchers.ip"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/ip:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
     extension_names = ["envoy.matching.matchers.ip"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/ip:ip_lib",
     ],
diff --git a/test/extensions/matching/input_matchers/metadata/BUILD b/test/extensions/matching/input_matchers/metadata/BUILD
index e77588a746..fcf8a8bd5e 100644
--- a/test/extensions/matching/input_matchers/metadata/BUILD
+++ b/test/extensions/matching/input_matchers/metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "dyn_meta_matcher_test",
     srcs = ["dyn_meta_matcher_test.cc"],
     extension_names = ["envoy.matching.matchers.metadata_matcher"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/matcher:matcher_lib",
         "//source/extensions/matching/http/metadata_input:metadata_input_lib",
diff --git a/test/extensions/matching/input_matchers/runtime_fraction/BUILD b/test/extensions/matching/input_matchers/runtime_fraction/BUILD
index 96767f502d..82909a5593 100644
--- a/test/extensions/matching/input_matchers/runtime_fraction/BUILD
+++ b/test/extensions/matching/input_matchers/runtime_fraction/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.matching.matchers.runtime_fraction"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/runtime_fraction:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "matcher_test",
     srcs = ["matcher_test.cc"],
     extension_names = ["envoy.matching.matchers.runtime_fraction"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/matching/input_matchers/runtime_fraction:runtime_fraction_lib",
         "//test/mocks/runtime:runtime_mocks",
diff --git a/test/extensions/matching/network/common/BUILD b/test/extensions/matching/network/common/BUILD
index 4ca160f902..4823e50d4b 100644
--- a/test/extensions/matching/network/common/BUILD
+++ b/test/extensions/matching/network/common/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "inputs_test",
     srcs = ["inputs_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/http/matching:data_impl_lib",
         "//source/common/network:address_lib",
@@ -27,6 +28,7 @@ envoy_cc_test(
     name = "inputs_integration_test",
     size = "large",
     srcs = ["inputs_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network/matching:data_impl_lib",
diff --git a/test/extensions/network/dns_resolver/apple/BUILD b/test/extensions/network/dns_resolver/apple/BUILD
index ba3373879d..00e7d67560 100644
--- a/test/extensions/network/dns_resolver/apple/BUILD
+++ b/test/extensions/network/dns_resolver/apple/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
         "//bazel:apple": ["apple_dns_impl_test.cc"],
         "//conditions:default": [],
     }),
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/event:file_event_interface",
diff --git a/test/extensions/network/dns_resolver/cares/BUILD b/test/extensions/network/dns_resolver/cares/BUILD
index 21eb2bcfcf..c7185321d4 100644
--- a/test/extensions/network/dns_resolver/cares/BUILD
+++ b/test/extensions/network/dns_resolver/cares/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "dns_impl_test",
     srcs = ["dns_impl_test.cc"],
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): Under winsock2 this is behaving unusually for windows, even as
     # 127.0.0.1 and ::1 are explicitly added to `c:\windows\system32\drivers\etc\hosts` ... see:
     # https://gist.github.com/wrowe/24fe5b93b58bb444bce7ecc134905395
diff --git a/test/extensions/network/dns_resolver/getaddrinfo/BUILD b/test/extensions/network/dns_resolver/getaddrinfo/BUILD
index 883e567cf2..8ca69966a1 100644
--- a/test/extensions/network/dns_resolver/getaddrinfo/BUILD
+++ b/test/extensions/network/dns_resolver/getaddrinfo/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "getaddrinfo_test",
     srcs = ["getaddrinfo_test.cc"],
     extension_names = ["envoy.network.dns_resolver.getaddrinfo"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/network/dns_resolver/getaddrinfo:config",
         "//test/mocks/api:api_mocks",
diff --git a/test/extensions/path/match/uri_template/BUILD b/test/extensions/path/match/uri_template/BUILD
index fa5b36a775..9766129a39 100644
--- a/test/extensions/path/match/uri_template/BUILD
+++ b/test/extensions/path/match/uri_template/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.path.match.uri_template.uri_template_matcher"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/match/uri_template:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "library_test",
     srcs = ["library_test.cc"],
     extension_names = ["envoy.path.match.uri_template.uri_template_matcher"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/match/uri_template:config",
         "//source/extensions/path/match/uri_template:uri_template_match_lib",
diff --git a/test/extensions/path/rewrite/uri_template/BUILD b/test/extensions/path/rewrite/uri_template/BUILD
index cd9b2db081..3f00910f76 100644
--- a/test/extensions/path/rewrite/uri_template/BUILD
+++ b/test/extensions/path/rewrite/uri_template/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.path.rewrite.uri_template.uri_template_rewriter"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/rewrite/uri_template:config",
         "//test/mocks/server:factory_context_mocks",
@@ -25,6 +26,7 @@ envoy_extension_cc_test(
     name = "library_test",
     srcs = ["library_test.cc"],
     extension_names = ["envoy.path.rewrite.uri_template.uri_template_rewriter"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/match/uri_template:config",
         "//source/extensions/path/match/uri_template:uri_template_match_lib",
diff --git a/test/extensions/path/uri_template_lib/BUILD b/test/extensions/path/uri_template_lib/BUILD
index d2e5913571..98016c3345 100644
--- a/test/extensions/path/uri_template_lib/BUILD
+++ b/test/extensions/path/uri_template_lib/BUILD
@@ -14,6 +14,7 @@ envoy_package()
 envoy_cc_test(
     name = "uri_template_test",
     srcs = ["uri_template_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/uri_template_lib",
         "//test/test_common:status_utility_lib",
@@ -26,6 +27,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "uri_template_internal_test",
     srcs = ["uri_template_internal_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/path/uri_template_lib:uri_template_internal_cc",
         "//test/test_common:status_utility_lib",
@@ -40,6 +42,7 @@ envoy_cc_fuzz_test(
     name = "uri_template_fuzz_test",
     srcs = ["uri_template_fuzz_test.cc"],
     corpus = "uri_template_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:statusor_lib",
         "//source/extensions/path/uri_template_lib",
diff --git a/test/extensions/quic/connection_id_generator/BUILD b/test/extensions/quic/connection_id_generator/BUILD
index f2902af1e9..84e97d9f75 100644
--- a/test/extensions/quic/connection_id_generator/BUILD
+++ b/test/extensions/quic/connection_id_generator/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
     name = "envoy_deterministic_connection_id_generator_test",
     srcs = ["envoy_deterministic_connection_id_generator_test.cc"],
     extension_names = ["envoy.quic.deterministic_connection_id_generator"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         ":matchers",
diff --git a/test/extensions/quic/server_preferred_address/BUILD b/test/extensions/quic/server_preferred_address/BUILD
index 32daabc316..b404af4121 100644
--- a/test/extensions/quic/server_preferred_address/BUILD
+++ b/test/extensions/quic/server_preferred_address/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "datasource_server_preferred_address_test",
     srcs = ["datasource_server_preferred_address_test.cc"],
     extension_names = ["envoy.quic.server_preferred_address.datasource"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/extensions/quic/server_preferred_address:datasource_server_preferred_address_config_lib",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "fixed_server_preferred_address_test",
     srcs = ["fixed_server_preferred_address_test.cc"],
     extension_names = ["envoy.quic.server_preferred_address.fixed"],
+    rbe_pool = "2core",
     tags = ["nofips"],
     deps = [
         "//source/extensions/quic/server_preferred_address:fixed_server_preferred_address_config_lib",
diff --git a/test/extensions/rate_limit_descriptors/expr/BUILD b/test/extensions/rate_limit_descriptors/expr/BUILD
index f6f7ad1684..2ad04389c7 100644
--- a/test/extensions/rate_limit_descriptors/expr/BUILD
+++ b/test/extensions/rate_limit_descriptors/expr/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
         ],
     }),
     extension_names = ["envoy.rate_limit_descriptors.expr"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/request_id/uuid/BUILD b/test/extensions/request_id/uuid/BUILD
index a9dd4f3576..23d5852a07 100644
--- a/test/extensions/request_id/uuid/BUILD
+++ b/test/extensions/request_id/uuid/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:random_generator_lib",
         "//source/extensions/request_id/uuid:config",
diff --git a/test/extensions/resource_monitors/downstream_connections/BUILD b/test/extensions/resource_monitors/downstream_connections/BUILD
index 8b8c603df9..966cdd355f 100644
--- a/test/extensions/resource_monitors/downstream_connections/BUILD
+++ b/test/extensions/resource_monitors/downstream_connections/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "downstream_connections_monitor_test",
     srcs = ["downstream_connections_monitor_test.cc"],
     extension_names = ["envoy.resource_monitors.global_downstream_max_connections"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/resource_monitors/downstream_connections:downstream_connections_monitor",
         "@com_google_absl//absl/types:optional",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.resource_monitors.global_downstream_max_connections"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/resource_monitors/downstream_connections:config",
@@ -42,6 +44,7 @@ envoy_cc_test(
     name = "cx_limit_overload_integration_test",
     size = "large",
     srcs = ["cx_limit_overload_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
diff --git a/test/extensions/resource_monitors/fixed_heap/BUILD b/test/extensions/resource_monitors/fixed_heap/BUILD
index 7bd5295841..16f9ed8717 100644
--- a/test/extensions/resource_monitors/fixed_heap/BUILD
+++ b/test/extensions/resource_monitors/fixed_heap/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "fixed_heap_monitor_test",
     srcs = ["fixed_heap_monitor_test.cc"],
     extension_names = ["envoy.resource_monitors.fixed_heap"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/resource_monitors/fixed_heap:fixed_heap_monitor",
         "@com_google_absl//absl/types:optional",
@@ -26,6 +27,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.resource_monitors.fixed_heap"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/stats:isolated_store_lib",
diff --git a/test/extensions/resource_monitors/injected_resource/BUILD b/test/extensions/resource_monitors/injected_resource/BUILD
index eac06f44d9..c50b6de9a4 100644
--- a/test/extensions/resource_monitors/injected_resource/BUILD
+++ b/test/extensions/resource_monitors/injected_resource/BUILD
@@ -16,6 +16,7 @@ envoy_cc_test(
     name = "injected_resource_monitor_integration_test",
     size = "large",
     srcs = ["injected_resource_monitor_integration_test.cc"],
+    rbe_pool = "2core",
     # Broken until bazel 5.0.0 fix to shorten resulting paths for SymInitialize() failure
     tags = ["skip_on_windows"],
     deps = [
@@ -31,6 +32,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "injected_resource_monitor_test",
     srcs = ["injected_resource_monitor_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/stats:isolated_store_lib",
@@ -47,6 +49,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.resource_monitors.injected_resource"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/event:dispatcher_lib",
diff --git a/test/extensions/retry/host/omit_canary_hosts/BUILD b/test/extensions/retry/host/omit_canary_hosts/BUILD
index 97553f1099..f203076104 100644
--- a/test/extensions/retry/host/omit_canary_hosts/BUILD
+++ b/test/extensions/retry/host/omit_canary_hosts/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.retry_host_predicates.omit_canary_hosts"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/retry/host/omit_canary_hosts:config",
         "//test/mocks/upstream:host_mocks",
diff --git a/test/extensions/retry/host/omit_host_metadata/BUILD b/test/extensions/retry/host/omit_host_metadata/BUILD
index aed8aaa880..c039e9c1e8 100644
--- a/test/extensions/retry/host/omit_host_metadata/BUILD
+++ b/test/extensions/retry/host/omit_host_metadata/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.retry_host_predicates.omit_host_metadata"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/retry/host/omit_host_metadata:config",
         "//test/mocks/upstream:host_mocks",
diff --git a/test/extensions/retry/host/previous_hosts/BUILD b/test/extensions/retry/host/previous_hosts/BUILD
index f6b0234ab3..bf26e2d3f8 100644
--- a/test/extensions/retry/host/previous_hosts/BUILD
+++ b/test/extensions/retry/host/previous_hosts/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.retry_host_predicates.previous_hosts"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/extensions/retry/host/previous_hosts:config",
@@ -27,6 +28,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["integration_test.cc"],
     extension_names = ["envoy.retry_host_predicates.previous_hosts"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/retry/host/previous_hosts:config",
         "//test/integration:http_integration_lib",
diff --git a/test/extensions/retry/priority/previous_priorities/BUILD b/test/extensions/retry/priority/previous_priorities/BUILD
index 33035251b2..ce699182a0 100644
--- a/test/extensions/retry/priority/previous_priorities/BUILD
+++ b/test/extensions/retry/priority/previous_priorities/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.retry_priorities.previous_priorities"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/protobuf:message_validator_lib",
         "//source/extensions/retry/priority/previous_priorities:config",
diff --git a/test/extensions/router/cluster_specifiers/lua/BUILD b/test/extensions/router/cluster_specifiers/lua/BUILD
index f2e3d0a15d..7b5c4aa392 100644
--- a/test/extensions/router/cluster_specifiers/lua/BUILD
+++ b/test/extensions/router/cluster_specifiers/lua/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "lua_cluster_specifier_test",
     srcs = ["lua_cluster_specifier_test.cc"],
     extension_names = ["envoy.router.cluster_specifier_plugin.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/router/cluster_specifiers/lua:lua_cluster_specifier_lib",
         "//test/mocks/router:router_mocks",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.router.cluster_specifier_plugin.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/router/cluster_specifiers/lua:config",
         "//test/mocks/server:factory_context_mocks",
diff --git a/test/extensions/stats_sinks/common/statsd/BUILD b/test/extensions/stats_sinks/common/statsd/BUILD
index 87f79c252c..b6c0fe1230 100644
--- a/test/extensions/stats_sinks/common/statsd/BUILD
+++ b/test/extensions/stats_sinks/common/statsd/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "statsd_test",
     srcs = ["statsd_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/network:utility_lib",
@@ -32,6 +33,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "udp_statsd_test",
     srcs = ["udp_statsd_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:address_lib",
         "//source/common/network:utility_lib",
diff --git a/test/extensions/stats_sinks/dog_statsd/BUILD b/test/extensions/stats_sinks/dog_statsd/BUILD
index 143d039575..030d3d71dd 100644
--- a/test/extensions/stats_sinks/dog_statsd/BUILD
+++ b/test/extensions/stats_sinks/dog_statsd/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.stat_sinks.dog_statsd"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/stats_sinks/graphite_statsd/BUILD b/test/extensions/stats_sinks/graphite_statsd/BUILD
index 0508cc8776..3d05ef42df 100644
--- a/test/extensions/stats_sinks/graphite_statsd/BUILD
+++ b/test/extensions/stats_sinks/graphite_statsd/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.stat_sinks.graphite_statsd"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/stats_sinks/hystrix/BUILD b/test/extensions/stats_sinks/hystrix/BUILD
index 95de804f1c..d3e617eb60 100644
--- a/test/extensions/stats_sinks/hystrix/BUILD
+++ b/test/extensions/stats_sinks/hystrix/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.stat_sinks.hystrix"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/protobuf:utility_lib",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     name = "hystrix_test",
     srcs = ["hystrix_test.cc"],
     extension_names = ["envoy.stat_sinks.hystrix"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/json:json_loader_lib",
         "//source/common/stats:stats_lib",
@@ -51,6 +53,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = envoy_select_admin_functionality(["hystrix_integration_test.cc"]),
     extension_names = ["envoy.stat_sinks.hystrix"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/stat_sinks/hystrix:config",
         "//test/integration:http_protocol_integration_lib",
diff --git a/test/extensions/stats_sinks/metrics_service/BUILD b/test/extensions/stats_sinks/metrics_service/BUILD
index 0c52451abe..877905d43f 100644
--- a/test/extensions/stats_sinks/metrics_service/BUILD
+++ b/test/extensions/stats_sinks/metrics_service/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "metrics_service_test",
     srcs = ["grpc_metrics_service_impl_test.cc"],
     extension_names = ["envoy.stat_sinks.metrics_service"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:dispatcher_lib",
         "//source/common/upstream:upstream_includes",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["metrics_service_integration_test.cc"],
     extension_names = ["envoy.stat_sinks.metrics_service"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/grpc:codec_lib",
diff --git a/test/extensions/stats_sinks/open_telemetry/BUILD b/test/extensions/stats_sinks/open_telemetry/BUILD
index e7098a1c74..1fef9961be 100644
--- a/test/extensions/stats_sinks/open_telemetry/BUILD
+++ b/test/extensions/stats_sinks/open_telemetry/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.stat_sinks.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/stat_sinks/open_telemetry:config",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "open_telemetry_test",
     srcs = ["open_telemetry_impl_test.cc"],
     extension_names = ["envoy.stat_sinks.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/stat_sinks/open_telemetry:open_telemetry_lib",
         "//test/mocks/grpc:grpc_mocks",
@@ -41,6 +43,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["open_telemetry_integration_test.cc"],
     extension_names = ["envoy.stat_sinks.open_telemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:zero_copy_input_stream_lib",
         "//source/common/grpc:codec_lib",
diff --git a/test/extensions/stats_sinks/statsd/BUILD b/test/extensions/stats_sinks/statsd/BUILD
index d5d827d74a..2baea71454 100644
--- a/test/extensions/stats_sinks/statsd/BUILD
+++ b/test/extensions/stats_sinks/statsd/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.stat_sinks.statsd"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/protobuf:utility_lib",
diff --git a/test/extensions/stats_sinks/wasm/BUILD b/test/extensions/stats_sinks/wasm/BUILD
index eca515eebf..61ee8dfbd6 100644
--- a/test/extensions/stats_sinks/wasm/BUILD
+++ b/test/extensions/stats_sinks/wasm/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
         "//test/extensions/stats_sinks/wasm/test_data:test_context_cpp.wasm",
     ]),
     extension_names = ["envoy.stat_sinks.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/extensions/stat_sinks/wasm:config",
@@ -39,6 +40,7 @@ envoy_extension_cc_test(
         "//test/extensions/stats_sinks/wasm/test_data:test_context_cpp.wasm",
     ]),
     extension_names = ["envoy.stat_sinks.wasm"],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
     deps = [
         "//source/common/stats:stats_lib",
diff --git a/test/extensions/string_matcher/lua/BUILD b/test/extensions/string_matcher/lua/BUILD
index eefbc19aa2..0b85ad3d9b 100644
--- a/test/extensions/string_matcher/lua/BUILD
+++ b/test/extensions/string_matcher/lua/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "lua_test",
     srcs = ["lua_test.cc"],
     extension_names = ["envoy.string_matcher.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/string_matcher/lua:config",
         "//test/mocks/server:server_factory_context_mocks",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "lua_integration_test",
     srcs = ["lua_integration_test.cc"],
     extension_names = ["envoy.string_matcher.lua"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/string_matcher/lua:config",
         "//test/integration:http_integration_lib",
diff --git a/test/extensions/tracers/datadog/BUILD b/test/extensions/tracers/datadog/BUILD
index 739bfd76ec..31751e7003 100644
--- a/test/extensions/tracers/datadog/BUILD
+++ b/test/extensions/tracers/datadog/BUILD
@@ -31,6 +31,7 @@ envoy_extension_cc_test(
         "-DDD_USE_ABSEIL_FOR_ENVOY",
     ],
     extension_names = ["envoy.tracers.datadog"],
+    rbe_pool = "2core",
     # TODO(wrowe): envoy_extension_ rules don't currently exclude windows extensions
     tags = ["skip_on_windows"],
     deps = [
diff --git a/test/extensions/tracers/opencensus/BUILD b/test/extensions/tracers/opencensus/BUILD
index 53cf89ab66..5b9585862b 100644
--- a/test/extensions/tracers/opencensus/BUILD
+++ b/test/extensions/tracers/opencensus/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "tracer_test",
     srcs = ["tracer_test.cc"],
     extension_names = ["envoy.tracers.opencensus"],
+    rbe_pool = "2core",
     # TODO(wrowe): envoy_extension_ rules don't currently exclude windows extensions
     tags = ["skip_on_windows"],
     deps = [
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opencensus"],
+    rbe_pool = "2core",
     # TODO(wrowe): envoy_extension_ rules don't currently exclude windows extensions
     tags = ["skip_on_windows"],
     deps = [
diff --git a/test/extensions/tracers/opentelemetry/BUILD b/test/extensions/tracers/opentelemetry/BUILD
index ac25ecbdb9..758db3be72 100644
--- a/test/extensions/tracers/opentelemetry/BUILD
+++ b/test/extensions/tracers/opentelemetry/BUILD
@@ -22,6 +22,7 @@ envoy_extension_cc_test(
         "-DHAVE_ABSEIL",
     ],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:time_interface",
         "//envoy/runtime:runtime_interface",
@@ -54,6 +55,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:config",
         "//test/mocks/server:tracer_factory_context_mocks",
@@ -67,6 +69,7 @@ envoy_extension_cc_test(
     name = "span_context_extractor_test",
     srcs = ["span_context_extractor_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:opentelemetry_tracer_lib",
         "//test/test_common:status_utility_lib",
@@ -78,6 +81,7 @@ envoy_extension_cc_test(
     name = "grpc_trace_exporter_test",
     srcs = ["grpc_trace_exporter_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:trace_exporter",
         "//test/mocks/grpc:grpc_mocks",
@@ -90,6 +94,7 @@ envoy_extension_cc_test(
     name = "http_trace_exporter_test",
     srcs = ["http_trace_exporter_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:trace_exporter",
         "//test/mocks/http:http_mocks",
@@ -104,6 +109,7 @@ envoy_extension_cc_test(
     name = "operation_name_test",
     srcs = ["operation_name_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:config",
         "//source/extensions/tracers/opentelemetry:opentelemetry_tracer_lib",
diff --git a/test/extensions/tracers/opentelemetry/opentelemetry_tracer_impl_test.cc b/test/extensions/tracers/opentelemetry/opentelemetry_tracer_impl_test.cc
index 1be53b67e7..25a9300093 100644
--- a/test/extensions/tracers/opentelemetry/opentelemetry_tracer_impl_test.cc
+++ b/test/extensions/tracers/opentelemetry/opentelemetry_tracer_impl_test.cc
@@ -686,6 +686,89 @@ TEST_F(OpenTelemetryDriverTest, ExportOTLPSpanWithAttributesAndStatus) {
   EXPECT_EQ(1U, stats_.counter("tracing.opentelemetry.spans_sent").value());
 }
 
+// Verifies Grpc spans are exported with their attributes and status
+TEST_F(OpenTelemetryDriverTest, ExportOTLPGRPCSpanWithAttributesAndStatus) {
+  setupValidDriver();
+  Tracing::TestTraceContextImpl request_headers{
+      {":authority", "test.com"}, {":path", "/"}, {":method", "GET"}};
+  NiceMock<Random::MockRandomGenerator>& mock_random_generator_ =
+      context_.server_factory_context_.api_.random_;
+  int64_t generated_int = 1;
+  EXPECT_CALL(mock_random_generator_, random()).Times(3).WillRepeatedly(Return(generated_int));
+  SystemTime timestamp = time_system_.systemTime();
+  ON_CALL(stream_info_, startTime()).WillByDefault(Return(timestamp));
+
+  Tracing::SpanPtr span = driver_->startSpan(mock_tracing_config_, request_headers, stream_info_,
+                                             operation_name_, {Tracing::Reason::Sampling, true});
+  EXPECT_NE(span.get(), nullptr);
+
+  span->setTag("first_tag_name", "first_tag_value");
+  span->setTag("second_tag_name", "second_tag_value");
+  // Try an empty tag.
+  span->setTag("", "empty_tag_value");
+  // Overwrite a tag.
+  span->setTag("first_tag_name", "first_tag_new_value");
+  span->setTag("http.status_code", "200");
+  span->setTag("grpc.status_code", "13");
+  span->setTag("grpc.message", "connect Canceled randomly");
+
+  // Note the placeholders for the bytes - cleaner to manually set after.
+  constexpr absl::string_view request_yaml = R"(
+resource_spans:
+  resource:
+    attributes:
+      key: "service.name"
+      value:
+        string_value: "unknown_service:envoy"
+      key: "key1"
+      value:
+        string_value: "val1"
+  scope_spans:
+    spans:
+      trace_id: "AAA"
+      span_id: "AAA"
+      name: "test"
+      kind: SPAN_KIND_SERVER
+      start_time_unix_nano: {}
+      end_time_unix_nano: {}
+      status:
+        code: STATUS_CODE_ERROR
+      attributes:
+        - key: "first_tag_name"
+          value:
+            string_value: "first_tag_new_value"
+        - key: "second_tag_name"
+          value:
+            string_value: "second_tag_value"
+        - key: "http.status_code"
+          value:
+            string_value: "200"
+        - key: "grpc.status_code"
+          value:
+            string_value: "13"
+        - key: "grpc.message"
+          value:
+            string_value: "connect Canceled randomly"
+  )";
+  opentelemetry::proto::collector::trace::v1::ExportTraceServiceRequest request_proto;
+  int64_t timestamp_ns = std::chrono::nanoseconds(timestamp.time_since_epoch()).count();
+  TestUtility::loadFromYaml(fmt::format(request_yaml, timestamp_ns, timestamp_ns), request_proto);
+  std::string generated_int_hex = Hex::uint64ToHex(generated_int);
+  auto* expected_span =
+      request_proto.mutable_resource_spans(0)->mutable_scope_spans(0)->mutable_spans(0);
+  expected_span->set_trace_id(
+      absl::HexStringToBytes(absl::StrCat(generated_int_hex, generated_int_hex)));
+  expected_span->set_span_id(absl::HexStringToBytes(absl::StrCat(generated_int_hex)));
+
+  EXPECT_CALL(runtime_.snapshot_, getInteger("tracing.opentelemetry.min_flush_spans", 5U))
+      .Times(1)
+      .WillRepeatedly(Return(1));
+  EXPECT_CALL(*mock_stream_ptr_,
+              sendMessageRaw_(Grpc::ProtoBufferEqIgnoreRepeatedFieldOrdering(request_proto), _));
+  span->finishSpan();
+  EXPECT_EQ(1U, stats_.counter("tracing.opentelemetry.spans_sent").value());
+}
+
 // Not sampled spans are ignored
 TEST_F(OpenTelemetryDriverTest, IgnoreNotSampledSpan) {
   setupValidDriver();
diff --git a/test/extensions/tracers/opentelemetry/resource_detectors/BUILD b/test/extensions/tracers/opentelemetry/resource_detectors/BUILD
index b91bdda9b2..55e82a9651 100644
--- a/test/extensions/tracers/opentelemetry/resource_detectors/BUILD
+++ b/test/extensions/tracers/opentelemetry/resource_detectors/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "resource_provider_test",
     srcs = ["resource_provider_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/resource_detectors:resource_detector_lib",
diff --git a/test/extensions/tracers/opentelemetry/resource_detectors/dynatrace/BUILD b/test/extensions/tracers/opentelemetry/resource_detectors/dynatrace/BUILD
index b02e8581f2..10b42c5b2e 100644
--- a/test/extensions/tracers/opentelemetry/resource_detectors/dynatrace/BUILD
+++ b/test/extensions/tracers/opentelemetry/resource_detectors/dynatrace/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/resource_detectors/dynatrace:config",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
         "dynatrace_resource_detector_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry/resource_detectors/dynatrace:config",
         "//source/extensions/tracers/opentelemetry/resource_detectors/dynatrace:dynatrace_resource_detector_lib",
@@ -46,6 +48,7 @@ envoy_extension_cc_test(
         "dynatrace_resource_detector_integration_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//source/exe:main_common_lib",
         "//source/extensions/tracers/opentelemetry:config",
diff --git a/test/extensions/tracers/opentelemetry/resource_detectors/environment/BUILD b/test/extensions/tracers/opentelemetry/resource_detectors/environment/BUILD
index 3bfb2f65f1..97af775774 100644
--- a/test/extensions/tracers/opentelemetry/resource_detectors/environment/BUILD
+++ b/test/extensions/tracers/opentelemetry/resource_detectors/environment/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.environment"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/resource_detectors/environment:config",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "environment_resource_detector_test",
     srcs = ["environment_resource_detector_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.environment"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry/resource_detectors/environment:environment_resource_detector_lib",
         "//test/mocks/server:tracer_factory_context_mocks",
@@ -42,6 +44,7 @@ envoy_extension_cc_test(
         "environment_resource_detector_integration_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.environment"],
+    rbe_pool = "2core",
     deps = [
         "//source/exe:main_common_lib",
         "//source/extensions/tracers/opentelemetry:config",
diff --git a/test/extensions/tracers/opentelemetry/resource_detectors/static/BUILD b/test/extensions/tracers/opentelemetry/resource_detectors/static/BUILD
index 82e0de2b2c..01adab6866 100644
--- a/test/extensions/tracers/opentelemetry/resource_detectors/static/BUILD
+++ b/test/extensions/tracers/opentelemetry/resource_detectors/static/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.static_config"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/resource_detectors/static:config",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "static_config_resource_detector_test",
     srcs = ["static_config_resource_detector_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.static_config"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry/resource_detectors/static:static_config_resource_detector_lib",
         "//test/mocks/server:tracer_factory_context_mocks",
@@ -43,6 +45,7 @@ envoy_extension_cc_test(
         "static_config_resource_detector_integration_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.resource_detectors.static_config"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry:config",
         "//source/extensions/tracers/opentelemetry/resource_detectors/static:config",
diff --git a/test/extensions/tracers/opentelemetry/samplers/BUILD b/test/extensions/tracers/opentelemetry/samplers/BUILD
index 55414e7854..929b4bf0be 100644
--- a/test/extensions/tracers/opentelemetry/samplers/BUILD
+++ b/test/extensions/tracers/opentelemetry/samplers/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "sampler_test",
     srcs = ["sampler_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry:opentelemetry_tracer_lib",
diff --git a/test/extensions/tracers/opentelemetry/samplers/always_on/BUILD b/test/extensions/tracers/opentelemetry/samplers/always_on/BUILD
index 24c2c52e32..f309abf9c2 100644
--- a/test/extensions/tracers/opentelemetry/samplers/always_on/BUILD
+++ b/test/extensions/tracers/opentelemetry/samplers/always_on/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.samplers.always_on"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/samplers/always_on:always_on_sampler_lib",
@@ -28,6 +29,7 @@ envoy_extension_cc_test(
     name = "always_on_sampler_test",
     srcs = ["always_on_sampler_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.samplers.always_on"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry/samplers/always_on:always_on_sampler_lib",
         "//source/extensions/tracers/opentelemetry/samplers/always_on:config",
@@ -43,6 +45,7 @@ envoy_extension_cc_test(
         "always_on_sampler_integration_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.samplers.always_on"],
+    rbe_pool = "2core",
     deps = [
         "//source/exe:main_common_lib",
         "//source/extensions/tracers/opentelemetry:config",
diff --git a/test/extensions/tracers/opentelemetry/samplers/dynatrace/BUILD b/test/extensions/tracers/opentelemetry/samplers/dynatrace/BUILD
index b708876da0..7d3af06baa 100644
--- a/test/extensions/tracers/opentelemetry/samplers/dynatrace/BUILD
+++ b/test/extensions/tracers/opentelemetry/samplers/dynatrace/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.opentelemetry.samplers.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/extensions/tracers/opentelemetry/samplers/dynatrace:config",
@@ -35,6 +36,7 @@ envoy_extension_cc_test(
         "tenant_id_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.samplers.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/opentelemetry/samplers/dynatrace:dynatrace_sampler_lib",
         "//test/mocks/server:tracer_factory_context_mocks",
@@ -50,6 +52,7 @@ envoy_extension_cc_test(
         "dynatrace_sampler_integration_test.cc",
     ],
     extension_names = ["envoy.tracers.opentelemetry.samplers.dynatrace"],
+    rbe_pool = "2core",
     deps = [
         "//source/exe:main_common_lib",
         "//source/extensions/tracers/opentelemetry:config",
diff --git a/test/extensions/tracers/skywalking/BUILD b/test/extensions/tracers/skywalking/BUILD
index e0e017783f..bbd9496b2d 100644
--- a/test/extensions/tracers/skywalking/BUILD
+++ b/test/extensions/tracers/skywalking/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.skywalking"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/skywalking:config",
         "//test/mocks/server:tracer_factory_context_mocks",
@@ -29,6 +30,7 @@ envoy_extension_cc_test(
     name = "trace_segment_reporter_test",
     srcs = ["trace_segment_reporter_test.cc"],
     extension_names = ["envoy.tracers.skywalking"],
+    rbe_pool = "2core",
     deps = [
         ":skywalking_test_helper",
         "//source/extensions/tracers/skywalking:trace_segment_reporter_lib",
@@ -50,6 +52,7 @@ envoy_cc_library(
 envoy_extension_cc_test(
     name = "skywalking_test_helper",
     extension_names = ["envoy.tracers.skywalking"],
+    rbe_pool = "2core",
     deps = [
         ":skywalking_test_helper_lib",
         "//source/common/common:base64_lib",
@@ -63,6 +66,7 @@ envoy_extension_cc_test(
     name = "tracer_test",
     srcs = ["tracer_test.cc"],
     extension_names = ["envoy.tracers.skywalking"],
+    rbe_pool = "2core",
     deps = [
         ":skywalking_test_helper",
         "//source/extensions/tracers/skywalking:skywalking_tracer_lib",
@@ -81,6 +85,7 @@ envoy_extension_cc_test(
     name = "skywalking_tracer_impl_test",
     srcs = ["skywalking_tracer_impl_test.cc"],
     extension_names = ["envoy.tracers.skywalking"],
+    rbe_pool = "2core",
     deps = [
         ":skywalking_test_helper",
         "//source/extensions/tracers/skywalking:skywalking_tracer_lib",
diff --git a/test/extensions/tracers/xray/BUILD b/test/extensions/tracers/xray/BUILD
index fc87f0baa3..51859bb9a4 100644
--- a/test/extensions/tracers/xray/BUILD
+++ b/test/extensions/tracers/xray/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
         "xray_tracer_impl_test.cc",
     ],
     extension_names = ["envoy.tracers.xray"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/xray:xray_lib",
         "//test/mocks:common_lib",
@@ -43,6 +44,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.xray"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/xray:config",
         "//test/mocks/server:instance_mocks",
@@ -58,6 +60,7 @@ envoy_cc_fuzz_test(
     name = "xray_fuzz_test",
     srcs = ["fuzz_test.cc"],
     corpus = "wildcard_matcher_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/xray:xray_lib",
     ],
diff --git a/test/extensions/tracers/zipkin/BUILD b/test/extensions/tracers/zipkin/BUILD
index f83810b16c..8dae0c585f 100644
--- a/test/extensions/tracers/zipkin/BUILD
+++ b/test/extensions/tracers/zipkin/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
         "zipkin_tracer_impl_test.cc",
     ],
     extension_names = ["envoy.tracers.zipkin"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:time_interface",
         "//envoy/runtime:runtime_interface",
@@ -52,6 +53,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.tracers.zipkin"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/tracers/zipkin:config",
         "//test/mocks/server:tracer_factory_context_mocks",
diff --git a/test/extensions/transport_sockets/alts/BUILD b/test/extensions/transport_sockets/alts/BUILD
index 87a9782044..0e8a316eb2 100644
--- a/test/extensions/transport_sockets/alts/BUILD
+++ b/test/extensions/transport_sockets/alts/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/singleton:manager_impl_lib",
         "//source/extensions/transport_sockets/alts:config",
@@ -30,6 +31,7 @@ envoy_extension_cc_test(
     name = "alts_channel_pool_test",
     srcs = ["alts_channel_pool_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:address_interface",
         "//source/extensions/transport_sockets/alts:alts_channel_pool",
@@ -45,6 +47,7 @@ envoy_extension_cc_test(
     name = "alts_proxy_test",
     srcs = ["alts_proxy_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:address_interface",
         "//source/extensions/transport_sockets/alts:alts_proxy",
@@ -64,6 +67,7 @@ envoy_extension_cc_test(
     name = "alts_tsi_handshaker_test",
     srcs = ["alts_tsi_handshaker_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:address_interface",
         "//source/extensions/transport_sockets/alts:alts_proxy",
@@ -84,6 +88,7 @@ envoy_extension_cc_test(
     name = "tsi_frame_protector_test",
     srcs = ["tsi_frame_protector_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/alts:tsi_frame_protector",
         "//test/mocks/buffer:buffer_mocks",
@@ -94,6 +99,7 @@ envoy_extension_cc_test(
     name = "tsi_handshaker_test",
     srcs = ["tsi_handshaker_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/network:address_interface",
@@ -118,6 +124,7 @@ envoy_extension_cc_test(
     srcs = ["tsi_socket_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
     external_deps = ["grpc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/network:address_interface",
@@ -136,6 +143,7 @@ envoy_extension_cc_test(
     name = "noop_transport_socket_callbacks_test",
     srcs = ["noop_transport_socket_callbacks_test.cc"],
     extension_names = ["envoy.transport_sockets.alts"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/alts:noop_transport_socket_callbacks_lib",
         "//test/mocks/network:network_mocks",
@@ -148,6 +156,7 @@ envoy_extension_cc_test(
     srcs = envoy_select_google_grpc(["alts_integration_test.cc"]),
     extension_names = ["envoy.transport_sockets.alts"],
     external_deps = ["grpc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/event:dispatcher_includes",
diff --git a/test/extensions/transport_sockets/common/BUILD b/test/extensions/transport_sockets/common/BUILD
index f30b8bf8bb..2bd960f9aa 100644
--- a/test/extensions/transport_sockets/common/BUILD
+++ b/test/extensions/transport_sockets/common/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "passthrough_test",
     srcs = ["passthrough_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/common:passthrough_lib",
         "//test/mocks/buffer:buffer_mocks",
diff --git a/test/extensions/transport_sockets/http_11_proxy/BUILD b/test/extensions/transport_sockets/http_11_proxy/BUILD
index b0138dfeed..ca4e8fb372 100644
--- a/test/extensions/transport_sockets/http_11_proxy/BUILD
+++ b/test/extensions/transport_sockets/http_11_proxy/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "connect_test",
     srcs = ["connect_test.cc"],
     extension_names = ["envoy.transport_sockets.http_11_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/http_11_proxy:connect",
         "//test/mocks/buffer:buffer_mocks",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["connect_integration_test.cc"],
     extension_names = ["envoy.transport_sockets.http_11_proxy"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/clusters/dynamic_forward_proxy:cluster",
         "//source/extensions/filters/http/dynamic_forward_proxy:config",
diff --git a/test/extensions/transport_sockets/internal_upstream/BUILD b/test/extensions/transport_sockets/internal_upstream/BUILD
index b262ab6a6b..dc827ce79f 100644
--- a/test/extensions/transport_sockets/internal_upstream/BUILD
+++ b/test/extensions/transport_sockets/internal_upstream/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "internal_upstream_test",
     srcs = ["internal_upstream_test.cc"],
     extension_names = ["envoy.transport_sockets.internal_upstream"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:hashable_interface",
         "//source/common/stream_info:filter_state_lib",
@@ -41,6 +42,7 @@ envoy_extension_cc_test(
         "envoy.bootstrap.internal_listener",
         "envoy.filters.http.set_filter_state",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:connection_lib",
         "//source/common/network:utility_lib",
diff --git a/test/extensions/transport_sockets/proxy_protocol/BUILD b/test/extensions/transport_sockets/proxy_protocol/BUILD
index 7311e817b1..fe34210238 100644
--- a/test/extensions/transport_sockets/proxy_protocol/BUILD
+++ b/test/extensions/transport_sockets/proxy_protocol/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "proxy_protocol_test",
     srcs = ["proxy_protocol_test.cc"],
     extension_names = ["envoy.transport_sockets.upstream_proxy_protocol"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:proxy_protocol_options_lib",
         "//source/extensions/common/proxy_protocol:proxy_protocol_header_lib",
@@ -32,6 +33,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["proxy_protocol_integration_test.cc"],
     extension_names = ["envoy.transport_sockets.upstream_proxy_protocol"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/listener/proxy_protocol:config",
         "//source/extensions/filters/network/tcp_proxy:config",
diff --git a/test/extensions/transport_sockets/starttls/BUILD b/test/extensions/transport_sockets/starttls/BUILD
index 05239545ae..79dfbf4bfa 100644
--- a/test/extensions/transport_sockets/starttls/BUILD
+++ b/test/extensions/transport_sockets/starttls/BUILD
@@ -18,6 +18,7 @@ envoy_extension_cc_test(
         "starttls_socket_test.cc",
     ],
     extension_names = ["envoy.transport_sockets.starttls"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:transport_socket_options_lib",
         "//source/extensions/transport_sockets/starttls:config",
@@ -41,6 +42,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.transport_sockets.starttls"],
+    rbe_pool = "2core",
     deps = [
         ":starttls_integration_proto_cc_proto",
         "//source/extensions/filters/network/tcp_proxy:config",
@@ -62,6 +64,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.transport_sockets.starttls"],
+    rbe_pool = "2core",
     deps = [
         ":starttls_integration_proto_cc_proto",
         "//source/extensions/transport_sockets/starttls:config",
diff --git a/test/extensions/transport_sockets/tap/BUILD b/test/extensions/transport_sockets/tap/BUILD
index 6071e12726..8f678ca2b9 100644
--- a/test/extensions/transport_sockets/tap/BUILD
+++ b/test/extensions/transport_sockets/tap/BUILD
@@ -16,6 +16,7 @@ envoy_extension_cc_test(
     name = "tap_config_impl_test",
     srcs = ["tap_config_impl_test.cc"],
     extension_names = ["envoy.transport_sockets.tap"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/tap:tap_config_impl",
         "//test/extensions/common/tap:common",
@@ -31,6 +32,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.transport_sockets.tap"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:connection_lib",
         "//source/extensions/transport_sockets/tap:config",
diff --git a/test/extensions/transport_sockets/tcp_stats/BUILD b/test/extensions/transport_sockets/tcp_stats/BUILD
index 67f79849bf..0b986c904d 100644
--- a/test/extensions/transport_sockets/tcp_stats/BUILD
+++ b/test/extensions/transport_sockets/tcp_stats/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "tcp_stats_test",
     srcs = ["tcp_stats_test.cc"],
     extension_names = ["envoy.transport_sockets.tcp_stats"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/raw_buffer:config",
         "//source/extensions/transport_sockets/tcp_stats:config",
@@ -34,6 +35,7 @@ envoy_extension_cc_test(
     size = "large",
     srcs = ["tcp_stats_integration_test.cc"],
     extension_names = ["envoy.transport_sockets.tcp_stats"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/filters/network/tcp_proxy:config",
         "//source/extensions/transport_sockets/raw_buffer:config",
diff --git a/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD b/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
index c95555b9be..e683229d71 100644
--- a/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
+++ b/test/extensions/transport_sockets/tls/cert_validator/spiffe/BUILD
@@ -21,6 +21,7 @@ envoy_extension_cc_test(
         "//test/common/tls/test_data:certs",
     ],
     extension_names = ["envoy.tls.cert_validator.spiffe"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/transport_sockets/tls/cert_validator/spiffe:config",
         "//test/common/tls:ssl_test_utils",
@@ -47,6 +48,7 @@ envoy_extension_cc_test(
         "//test/config/integration/certs",
     ],
     extension_names = ["envoy.tls.cert_validator.spiffe"],
+    rbe_pool = "2core",
     # Broken until bazel 5.0.0 fix to shorten resulting paths for SymInitialize() failure
     tags = ["skip_on_windows"],
     deps = [
diff --git a/test/extensions/udp_packet_writer/default/BUILD b/test/extensions/udp_packet_writer/default/BUILD
index b95b695ecb..30a07eb596 100644
--- a/test/extensions/udp_packet_writer/default/BUILD
+++ b/test/extensions/udp_packet_writer/default/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/udp_packet_writer/default:config",
         "//test/test_common:utility_lib",
diff --git a/test/extensions/udp_packet_writer/gso/BUILD b/test/extensions/udp_packet_writer/gso/BUILD
index 73c518a9c5..ec698e0b2f 100644
--- a/test/extensions/udp_packet_writer/gso/BUILD
+++ b/test/extensions/udp_packet_writer/gso/BUILD
@@ -12,6 +12,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/test_common:utility_lib",
         "@envoy_api//envoy/extensions/udp_packet_writer/v3:pkg_cc_proto",
diff --git a/test/extensions/upstreams/http/BUILD b/test/extensions/upstreams/http/BUILD
index 3099bea990..1b233d0336 100644
--- a/test/extensions/upstreams/http/BUILD
+++ b/test/extensions/upstreams/http/BUILD
@@ -17,6 +17,7 @@ envoy_proto_library(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":config_cc_proto",
         "//envoy/http:header_validator_factory_interface",
diff --git a/test/extensions/upstreams/http/generic/BUILD b/test/extensions/upstreams/http/generic/BUILD
index 17cb97dc79..90e1ffb1fa 100644
--- a/test/extensions/upstreams/http/generic/BUILD
+++ b/test/extensions/upstreams/http/generic/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/upstreams/http/generic:config",
         "//test/mocks:common_lib",
diff --git a/test/extensions/upstreams/http/tcp/BUILD b/test/extensions/upstreams/http/tcp/BUILD
index 7230cfe183..c9dcb5e25d 100644
--- a/test/extensions/upstreams/http/tcp/BUILD
+++ b/test/extensions/upstreams/http/tcp/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "upstream_request_test",
     srcs = ["upstream_request_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/network:address_lib",
diff --git a/test/extensions/upstreams/http/udp/BUILD b/test/extensions/upstreams/http/udp/BUILD
index 2d757dd91c..672d9e7a9c 100644
--- a/test/extensions/upstreams/http/udp/BUILD
+++ b/test/extensions/upstreams/http/udp/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "upstream_request_test",
     srcs = ["upstream_request_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/network:address_lib",
@@ -36,6 +37,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/upstreams/http/udp:config",
         "//source/extensions/upstreams/http/udp:upstream_request_lib",
diff --git a/test/extensions/upstreams/tcp/generic/BUILD b/test/extensions/upstreams/tcp/generic/BUILD
index c42794c636..6ed27a044b 100644
--- a/test/extensions/upstreams/tcp/generic/BUILD
+++ b/test/extensions/upstreams/tcp/generic/BUILD
@@ -11,6 +11,7 @@ envoy_package()
 envoy_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/stream_info:bool_accessor_lib",
         "//source/common/tcp_proxy",
diff --git a/test/extensions/watchdog/profile_action/BUILD b/test/extensions/watchdog/profile_action/BUILD
index ccf98b33d2..04e9a0d31e 100644
--- a/test/extensions/watchdog/profile_action/BUILD
+++ b/test/extensions/watchdog/profile_action/BUILD
@@ -15,6 +15,7 @@ envoy_extension_cc_test(
     name = "profile_action_test",
     srcs = ["profile_action_test.cc"],
     extension_names = ["envoy.watchdog.profile_action"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/common:time_interface",
         "//envoy/registry",
@@ -38,6 +39,7 @@ envoy_extension_cc_test(
     name = "config_test",
     srcs = ["config_test.cc"],
     extension_names = ["envoy.watchdog.profile_action"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//envoy/server:guarddog_config_interface",
diff --git a/test/fuzz/BUILD b/test/fuzz/BUILD
index d9dd74d003..28ad94e6ee 100644
--- a/test/fuzz/BUILD
+++ b/test/fuzz/BUILD
@@ -59,6 +59,7 @@ envoy_cc_test_library(
     name = "utility_lib",
     srcs = ["utility.cc"],
     hdrs = ["utility.h"],
+    rbe_pool = "2core",
     deps = [
         ":common_proto_cc_proto",
         "//source/common/common:empty_string",
@@ -116,6 +117,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "random_test",
     srcs = ["random_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//test/fuzz:random_lib",
     ],
diff --git a/test/integration/BUILD b/test/integration/BUILD
index 2de4af651c..58a33e4a52 100644
--- a/test/integration/BUILD
+++ b/test/integration/BUILD
@@ -31,6 +31,7 @@ envoy_cc_test_library(
         "//test/config/integration:server_xds_files",
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/common/common:matchers_lib",
@@ -58,6 +59,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality(
         ["ads_integration_test.cc"],
     ),
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -83,6 +85,7 @@ envoy_cc_test(
     name = "alpn_integration_test",
     size = "large",
     srcs = ["alpn_integration_test.cc"],
+    rbe_pool = "2core",
     shard_count = 2,
     tags = [
         "cpu:3",
@@ -94,6 +97,7 @@ envoy_cc_test(
     name = "api_listener_integration_test",
     size = "large",
     srcs = ["api_listener_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -132,6 +136,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
@@ -155,6 +160,7 @@ envoy_cc_test(
     name = "eds_integration_test",
     size = "large",
     srcs = ["eds_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -178,6 +184,7 @@ envoy_cc_test(
     name = "leds_integration_test",
     size = "large",
     srcs = ["leds_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -204,6 +211,7 @@ envoy_cc_test(
     srcs = [
         "filter_manager_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -238,6 +246,7 @@ envoy_cc_test(
     srcs = [
         "upstream_access_log_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -257,6 +266,7 @@ envoy_cc_test(
     name = "cluster_filter_integration_test",
     size = "large",
     srcs = ["cluster_filter_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -276,6 +286,7 @@ envoy_cc_test(
     name = "custom_cluster_integration_test",
     size = "large",
     srcs = ["custom_cluster_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -297,6 +308,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -329,6 +341,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "drain_close_integration_test.cc",
     ]),
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -343,6 +356,7 @@ exports_files(["test_utility.sh"])
 envoy_cc_test_binary(
     name = "hotrestart_main",
     srcs = ["hotrestart_main.cc"],
+    rbe_pool = "2core",
     deps = [
         ":common_extensions_lib",
         "//source/common/http:rds_lib",
@@ -364,6 +378,7 @@ envoy_cc_test_binary(
     name = "hotrestart_small_main",
     srcs = ["hotrestart_main.cc"],
     linkstatic = envoy_select_linkstatic(),
+    rbe_pool = "2core",
     deps = [
         ":common_extensions_lib",
         "//source/exe:main_common_lib",
@@ -403,6 +418,7 @@ envoy_sh_test(
         "test_utility.sh",
         "//test/config/integration:server_config_files",
     ],
+    rbe_pool = "2core",
     tags = ["skip_on_windows"],
 )
 
@@ -415,6 +431,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -433,6 +450,7 @@ envoy_cc_test(
     srcs = [
         "header_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -458,6 +476,7 @@ envoy_cc_test(
     name = "http_conn_pool_integration_test",
     size = "large",
     srcs = ["http_conn_pool_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -472,6 +491,7 @@ envoy_cc_test(
     name = "circuit_breakers_integration_test",
     size = "large",
     srcs = ["circuit_breakers_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -488,6 +508,7 @@ envoy_cc_test(
     srcs = [
         "http2_flood_integration_test.cc",
     ],
+    rbe_pool = "2core",
     shard_count = 6,
     tags = [
         "cpu:3",
@@ -516,6 +537,7 @@ envoy_cc_test(
     srcs = [
         "multiplexed_integration_test.cc",
     ],
+    rbe_pool = "2core",
     shard_count = 10,
     tags = [
         "cpu:3",
@@ -554,6 +576,7 @@ envoy_cc_test(
     name = "shadow_policy_integration_test",
     size = "large",
     srcs = ["shadow_policy_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -577,6 +600,7 @@ envoy_cc_test(
     name = "upstream_http_filter_integration_test",
     size = "large",
     srcs = ["upstream_http_filter_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -598,6 +622,7 @@ envoy_cc_test(
     name = "upstream_network_filter_integration_test",
     size = "large",
     srcs = ["upstream_network_filter_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/extensions/filters/network/tcp_proxy:config",
@@ -616,6 +641,7 @@ envoy_cc_test(
     srcs = [
         "buffer_accounting_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -657,6 +683,7 @@ envoy_cc_test(
     srcs = [
         "http_subset_lb_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -682,6 +709,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -701,6 +729,7 @@ envoy_cc_test(
     srcs = [
         "header_casing_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -717,6 +746,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "http_typed_per_filter_config_test.cc",
     ]),
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//test/integration/filters:set_route_filter_lib",
@@ -738,6 +768,7 @@ envoy_cc_test(
     srcs = [
         "http_timeout_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -754,6 +785,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "filter_integration_test.cc",
     ]),
+    rbe_pool = "2core",
     shard_count = 8,
     tags = [
         "cpu:3",
@@ -792,6 +824,7 @@ envoy_cc_test_library(
     name = "protocol_integration_test_lib",
     srcs = ["protocol_integration_test.cc"],
     hdrs = ["protocol_integration_test.h"],
+    rbe_pool = "2core",
     deps = [
         ":http_protocol_integration_lib",
         ":socket_interface_swap_lib",
@@ -830,6 +863,7 @@ envoy_cc_test(
     srcs = [
         "instantiate_protocol_integration_test.cc",
     ],
+    rbe_pool = "2core",
     # As this test has many H1/H2/v4/v6 tests it takes a while to run.
     # Shard it enough to bring the run time in line with other integration tests.
     shard_count = 16,
@@ -847,6 +881,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "multi_envoy_test.cc",
     ]),
+    rbe_pool = "2core",
     deps = [
         ":http_protocol_integration_lib",
     ],
@@ -858,6 +893,7 @@ envoy_cc_test(
     srcs = [
         "multiplexed_upstream_integration_test.cc",
     ],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
@@ -889,6 +925,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality(
         ["integration_admin_test.cc"],
     ),
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -939,6 +976,7 @@ envoy_cc_test_library(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":integration_lib_light",
         ":test_host_predicate_lib",
@@ -987,6 +1025,7 @@ envoy_cc_test_library(
     hdrs = [
         "http_protocol_integration.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//test/common/upstream:utility_lib",
@@ -999,6 +1038,7 @@ envoy_cc_test(
     name = "idle_timeout_integration_test",
     size = "large",
     srcs = ["idle_timeout_integration_test.cc"],
+    rbe_pool = "2core",
     # As this test has many pauses for idle timeouts, it takes a while to run.
     # Shard it enough to bring the run time in line with other integration tests.
     shard_count = 8,
@@ -1064,6 +1104,7 @@ envoy_cc_test_library(
     hdrs = [
         "fake_upstream.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//envoy/api:api_interface",
@@ -1142,6 +1183,7 @@ envoy_cc_test_library(
     hdrs = [
         "base_integration_test.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":autonomous_upstream_lib",
         ":fake_upstream_lib",
@@ -1185,6 +1227,7 @@ envoy_cc_test_library(
     hdrs = [
         "autonomous_upstream.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":fake_upstream_lib",
     ],
@@ -1203,6 +1246,7 @@ envoy_cc_test_library(
         "utility.h",
     ],
     data = ["//test/common/runtime:filesystem_test_data"],
+    rbe_pool = "2core",
     deps = [
         ":server_stats_interface",
         ":tcp_dump",
@@ -1360,6 +1404,7 @@ envoy_cc_test(
     name = "integration_test",
     size = "large",
     srcs = ["integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1396,6 +1441,7 @@ envoy_cc_test(
     srcs = [
         "redirect_integration_test.cc",
     ],
+    rbe_pool = "2core",
     shard_count = 2,
     tags = [
         "cpu:3",
@@ -1415,6 +1461,7 @@ envoy_cc_test(
     name = "regex_engine_integration_test",
     size = "large",
     srcs = ["regex_engine_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":integration_lib",
         "//source/common/common:regex_lib",
@@ -1432,6 +1479,7 @@ envoy_cc_test(
     name = "websocket_integration_test",
     size = "large",
     srcs = ["websocket_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1452,6 +1500,7 @@ envoy_cc_test(
     name = "socket_interface_integration_test",
     size = "large",
     srcs = ["socket_interface_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/common/network:socket_interface_lib",
@@ -1466,6 +1515,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     # The symbol table cluster memory tests take a while to run specially under tsan.
     deps = [
         ":integration_lib",
@@ -1486,6 +1536,7 @@ envoy_cc_test(
     name = "load_stats_integration_test",
     size = "large",
     srcs = ["load_stats_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//test/config:utility_lib",
@@ -1507,6 +1558,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1535,6 +1587,7 @@ envoy_cc_test(
     size = "large",
     srcs = ["header_prefix_integration_test.cc"],
     coverage = False,
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1579,6 +1632,7 @@ envoy_cc_test(
     name = "overload_integration_test",
     size = "large",
     srcs = ["overload_integration_test.cc"],
+    rbe_pool = "2core",
     shard_count = 4,
     tags = [
         "cpu:3",
@@ -1601,6 +1655,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "rtds_integration_test.cc",
     ]),
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1616,6 +1671,7 @@ envoy_cc_test(
     name = "extension_discovery_integration_test",
     size = "large",
     srcs = ["extension_discovery_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/extensions/filters/http/match_delegate:config",
@@ -1638,6 +1694,7 @@ envoy_cc_test(
     name = "listener_extension_discovery_integration_test",
     size = "large",
     srcs = ["listener_extension_discovery_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/extensions/filters/network/tcp_proxy:config",
@@ -1654,6 +1711,7 @@ envoy_cc_test(
     name = "network_extension_discovery_integration_test",
     size = "large",
     srcs = ["network_extension_discovery_integration_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/extensions/filters/network/tcp_proxy:config",
@@ -1684,6 +1742,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/common/event:dispatcher_includes",
@@ -1710,6 +1769,7 @@ envoy_cc_test(
         "sds_dynamic_key_rotation_setup.sh",
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): The key rotation in SdsDynamicKeyRotationIntegrationTest via
     # TestEnvironment::renameFile() fails on Windows. The renameFile() implementation does not
     # correctly handle symlinks.
@@ -1751,6 +1811,7 @@ envoy_cc_test(
     srcs = [
         "sds_generic_secret_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1784,6 +1845,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1822,6 +1884,7 @@ envoy_cc_test(
     srcs = [
         "tcp_proxy_many_connections_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1854,6 +1917,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     shard_count = 30,
     tags = [
         "cpu:3",
@@ -1883,6 +1947,7 @@ envoy_cc_test_library(
     hdrs = [
         "tcp_tunneling_integration.h",
     ],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
     ],
@@ -1897,6 +1962,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         ":http_protocol_integration_lib",
@@ -1920,6 +1986,7 @@ envoy_cc_test(
     srcs = [
         "tcp_conn_pool_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -1939,6 +2006,7 @@ envoy_cc_test(
     srcs = [
         "tcp_async_client_integration_test.cc",
     ],
+    rbe_pool = "2core",
     deps = [
         ":integration_lib",
         "//test/integration/filters:test_network_async_tcp_filter_lib",
@@ -1974,6 +2042,7 @@ envoy_cc_test(
     name = "tracked_watermark_buffer_test",
     size = "large",
     srcs = ["tracked_watermark_buffer_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":tracked_watermark_buffer_lib",
         "//test/mocks/http:stream_reset_handler_mock",
@@ -1992,6 +2061,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "uds_integration_test.cc",
     ]),
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         "//source/common/event:dispatcher_includes",
@@ -2012,6 +2082,7 @@ envoy_cc_test(
         ["dynamic_validation_integration_test.cc"],
     ),
     data = ["//test/config/integration:server_xds_files"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2033,6 +2104,7 @@ envoy_cc_test(
         "//test/config/integration:server_xds_files",
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2072,6 +2144,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2103,6 +2176,7 @@ envoy_cc_test_library(
     name = "h1_fuzz_lib",
     srcs = ["h1_fuzz.cc"],
     hdrs = ["h1_fuzz.h"],
+    rbe_pool = "2core",
     deps = H1_FUZZ_LIB_DEPS,
 )
 
@@ -2111,6 +2185,7 @@ envoy_cc_test_library(
     srcs = ["h1_fuzz.cc"],
     hdrs = ["h1_fuzz.h"],
     copts = ["-DPERSISTENT_FUZZER"],
+    rbe_pool = "2core",
     deps = H1_FUZZ_LIB_DEPS,
 )
 
@@ -2118,6 +2193,7 @@ envoy_cc_fuzz_test(
     name = "h1_capture_fuzz_test",
     srcs = ["h1_capture_fuzz_test.cc"],
     corpus = "h1_corpus",
+    rbe_pool = "2core",
     deps = [":h1_fuzz_lib"],
 )
 
@@ -2126,6 +2202,7 @@ envoy_cc_fuzz_test(
     srcs = ["h1_capture_fuzz_test.cc"],
     copts = ["-DPERSISTENT_FUZZER"],
     corpus = "h1_corpus",
+    rbe_pool = "2core",
     deps = [":h1_fuzz_persistent_lib"],
 )
 
@@ -2133,6 +2210,7 @@ envoy_cc_fuzz_test(
     name = "h1_capture_direct_response_fuzz_test",
     srcs = ["h1_capture_direct_response_fuzz_test.cc"],
     corpus = "h1_corpus",
+    rbe_pool = "2core",
     deps = [
         ":h1_fuzz_lib",
         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
@@ -2144,6 +2222,7 @@ envoy_cc_fuzz_test(
     srcs = ["h1_capture_direct_response_fuzz_test.cc"],
     copts = ["-DPERSISTENT_FUZZER"],
     corpus = "h1_corpus",
+    rbe_pool = "2core",
     deps = [
         ":h1_fuzz_persistent_lib",
         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
@@ -2166,6 +2245,7 @@ envoy_cc_test_library(
     name = "h2_fuzz_lib",
     srcs = ["h2_fuzz.cc"],
     hdrs = ["h2_fuzz.h"],
+    rbe_pool = "2core",
     deps = H2_FUZZ_LIB_DEPS,
 )
 
@@ -2174,6 +2254,7 @@ envoy_cc_test_library(
     srcs = ["h2_fuzz.cc"],
     hdrs = ["h2_fuzz.h"],
     copts = ["-DPERSISTENT_FUZZER"],
+    rbe_pool = "2core",
     deps = H2_FUZZ_LIB_DEPS,
 )
 
@@ -2181,6 +2262,7 @@ envoy_cc_fuzz_test(
     name = "h2_capture_fuzz_test",
     srcs = ["h2_capture_fuzz_test.cc"],
     corpus = "h2_corpus",
+    rbe_pool = "2core",
     deps = [":h2_fuzz_lib"],
 )
 
@@ -2189,6 +2271,7 @@ envoy_cc_fuzz_test(
     srcs = ["h2_capture_fuzz_test.cc"],
     copts = ["-DPERSISTENT_FUZZER"],
     corpus = "h2_corpus",
+    rbe_pool = "2core",
     deps = [":h2_fuzz_persistent_lib"],
 )
 
@@ -2196,6 +2279,7 @@ envoy_cc_fuzz_test(
     name = "h2_capture_direct_response_fuzz_test",
     srcs = ["h2_capture_direct_response_fuzz_test.cc"],
     corpus = "h2_corpus",
+    rbe_pool = "2core",
     deps = [
         ":h2_fuzz_lib",
         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
@@ -2207,6 +2291,7 @@ envoy_cc_fuzz_test(
     srcs = ["h2_capture_direct_response_fuzz_test.cc"],
     copts = ["-DPERSISTENT_FUZZER"],
     corpus = "h2_corpus",
+    rbe_pool = "2core",
     deps = [
         ":h2_fuzz_persistent_lib",
         "@envoy_api//envoy/extensions/filters/network/http_connection_manager/v3:pkg_cc_proto",
@@ -2228,6 +2313,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "scoped_rds_lib",
     size = "large",
+    rbe_pool = "2core",
     deps = [
         ":http_integration_lib",
         ":scoped_rds_test_lib",
@@ -2249,6 +2335,7 @@ envoy_cc_test(
     srcs = [
         "scoped_rds_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2278,6 +2365,7 @@ envoy_cc_test(
     srcs = [
         "listener_lds_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2311,6 +2399,7 @@ envoy_cc_test(
     name = "cx_limit_integration_test",
     size = "large",
     srcs = ["cx_limit_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2329,6 +2418,7 @@ envoy_cc_test(
     name = "direct_response_integration_test",
     size = "large",
     srcs = ["direct_response_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:2",
     ],
@@ -2343,6 +2433,7 @@ envoy_cc_test(
     srcs = [
         "local_reply_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:2",
     ],
@@ -2359,6 +2450,7 @@ envoy_cc_test(
     srcs = [
         "command_formatter_extension_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2373,6 +2465,7 @@ envoy_cc_test(
     name = "health_check_integration_test",
     size = "large",
     srcs = ["health_check_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2392,6 +2485,7 @@ envoy_cc_test(
     srcs = [
         "cluster_upstream_extension_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2417,6 +2511,7 @@ envoy_cc_test(
         "//conditions:default": ["quic_protocol_integration_test.cc"],
     }),
     data = ["//test/config/integration/certs"],
+    rbe_pool = "2core",
     shard_count = 16,
     tags = [
         "cpu:4",
@@ -2448,6 +2543,7 @@ envoy_cc_test(
         "//conditions:default": ["quic_http_integration_test.cc"],
     }),
     data = ["//test/config/integration/certs"],
+    rbe_pool = "2core",
     # TODO(envoyproxy/windows-dev): Diagnose failure shown only on clang-cl build, see:
     #   https://gist.github.com/wrowe/a152cb1d12c2f751916122aed39d8517
     # TODO(envoyproxy/windows-dev): Diagnose timeout, why opt build test under Windows GCP RBE
@@ -2496,6 +2592,7 @@ envoy_cc_test(
     srcs = [
         "original_ip_detection_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2513,6 +2610,7 @@ envoy_cc_test(
     srcs = [
         "access_log_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2527,6 +2625,7 @@ envoy_cc_test(
     name = "weighted_cluster_integration_test",
     size = "large",
     srcs = ["weighted_cluster_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2566,6 +2665,7 @@ envoy_cc_test(
     srcs = [
         "typed_metadata_integration_test.cc",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2587,6 +2687,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2610,6 +2711,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality([
         "xds_delegate_extension_integration_test.cc",
     ]),
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2635,6 +2737,7 @@ envoy_cc_test(
     name = "xds_config_tracker_integration_test",
     size = "large",
     srcs = ["xds_config_tracker_integration_test.cc"],
+    rbe_pool = "2core",
     tags = [
         "cpu:3",
     ],
@@ -2665,6 +2768,7 @@ envoy_cc_test(
     srcs = [
         "default_header_validator_integration_test.cc",
     ],
+    rbe_pool = "2core",
     shard_count = 8,
     tags = [
         "cpu:3",
diff --git a/test/integration/admin_html/BUILD b/test/integration/admin_html/BUILD
index e633f407db..c1466680c1 100644
--- a/test/integration/admin_html/BUILD
+++ b/test/integration/admin_html/BUILD
@@ -13,6 +13,7 @@ envoy_package()
 envoy_cc_test_binary(
     name = "test_server",
     srcs = ["test_server.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/exe:envoy_main_common_with_core_extensions_lib",
@@ -36,6 +37,7 @@ envoy_sh_test(
         "//source/server/admin/html:admin_web_files",
         "//test/integration:test_utility.sh",
     ],
+    rbe_pool = "2core",
 
     # This test fails on windows trying to poll the server for the admin
     # address. Failure is:
diff --git a/test/integration/http_integration.cc b/test/integration/http_integration.cc
index d8bc506c18..c640f45214 100644
--- a/test/integration/http_integration.cc
+++ b/test/integration/http_integration.cc
@@ -266,6 +266,7 @@ IntegrationCodecClientPtr HttpIntegrationTest::makeHttpConnection(uint32_t port)
 IntegrationCodecClientPtr HttpIntegrationTest::makeRawHttpConnection(
     Network::ClientConnectionPtr&& conn,
     absl::optional<envoy::config::core::v3::Http2ProtocolOptions> http2_options,
+    absl::optional<envoy::config::core::v3::HttpProtocolOptions> common_http_options,
     bool wait_till_connected) {
   std::shared_ptr<Upstream::MockClusterInfo> cluster{new NiceMock<Upstream::MockClusterInfo>()};
   cluster->max_response_headers_count_ = 200;
@@ -286,6 +287,10 @@ IntegrationCodecClientPtr HttpIntegrationTest::makeRawHttpConnection(
   cluster->http2_options_ = http2_options.value();
   cluster->http1_settings_.enable_trailers_ = true;
 
+  if (common_http_options.has_value()) {
+    cluster->common_http_protocol_options_ = common_http_options.value();
+  }
+
   if (!disable_client_header_validation_) {
     cluster->header_validator_factory_ = IntegrationUtil::makeHeaderValidationFactory(
         ::envoy::extensions::http::header_validators::envoy_default::v3::HeaderValidatorConfig());
@@ -1448,7 +1453,72 @@ void HttpIntegrationTest::testLargeRequestHeaders(uint32_t size, uint32_t count,
   } else {
     IntegrationStreamDecoderPtr response = codec_client_->makeHeaderOnlyRequest(big_headers);
     RELEASE_ASSERT(response->waitForEndStream(timeout),
-                   fmt::format("unexpected timeout after ", timeout.count(), " ms"));
+                   fmt::format("unexpected timeout after {}ms", timeout.count()));
+    EXPECT_TRUE(response->complete());
+    EXPECT_EQ("200", response->headers().getStatusValue());
+  }
+  if (count > max_count) {
+    EXPECT_THAT(waitForAccessLog(access_log_name_), HasSubstr("too_many_headers"));
+  }
+}
+
+void HttpIntegrationTest::testLargeResponseHeaders(uint32_t size, uint32_t count, uint32_t max_size,
+                                                   uint32_t max_count,
+                                                   std::chrono::milliseconds timeout) {
+  autonomous_upstream_ = true;
+  useAccessLog("%RESPONSE_CODE_DETAILS%");
+  // `size` parameter dictates the size of each header that will be added to the response and
+  // `count` parameter is the number of headers to be added. The actual request byte size will
+  // exceed `size` due to the keys and other headers. The actual request header count will exceed
+  // `count` by four due to default headers.
+
+  config_helper_.addConfigModifier([&](envoy::config::bootstrap::v3::Bootstrap& bootstrap) {
+    ConfigHelper::HttpProtocolOptions protocol_options;
+    auto* http_protocol_options = protocol_options.mutable_common_http_protocol_options();
+    http_protocol_options->mutable_max_response_headers_kb()->set_value(max_size);
+    http_protocol_options->mutable_max_headers_count()->set_value(max_count);
+
+    ConfigHelper::setProtocolOptions(*bootstrap.mutable_static_resources()->mutable_clusters(0),
+                                     protocol_options);
+  });
+
+  // This test is validating upstream response headers, but the test client will fail to receive the
+  // request from Envoy if its limits aren't increased.
+  envoy::config::core::v3::HttpProtocolOptions client_protocol_options;
+  client_protocol_options.mutable_max_response_headers_kb()->set_value(max_size);
+  client_protocol_options.mutable_max_headers_count()->set_value(max_count);
+
+  Http::TestRequestHeaderMapImpl big_headers(default_response_headers_);
+
+  // Already added four headers.
+  for (unsigned int i = 0; i < count; i++) {
+    big_headers.addCopy(std::to_string(i), std::string(size * 1024, 'a'));
+  }
+
+  initialize();
+  codec_client_ = makeRawHttpConnection(makeClientConnection(lookupPort("http")), absl::nullopt,
+                                        client_protocol_options);
+  reinterpret_cast<AutonomousUpstream*>(fake_upstreams_.front().get())
+      ->setResponseHeaders(std::make_unique<Http::TestResponseHeaderMapImpl>(big_headers));
+
+  if (size >= max_size || count > max_count) {
+    // header size includes keys too, so expect rejection when equal
+    auto encoder_decoder = codec_client_->startRequest(default_request_headers_);
+    auto response = std::move(encoder_decoder.second);
+
+    if (downstream_protocol_ == Http::CodecType::HTTP1) {
+      ASSERT_TRUE(codec_client_->waitForDisconnect());
+      ASSERT_TRUE(response->complete());
+      EXPECT_EQ("431", response->headers().getStatusValue());
+    } else {
+      ASSERT_TRUE(response->waitForReset());
+      codec_client_->close();
+    }
+  } else {
+    IntegrationStreamDecoderPtr response =
+        codec_client_->makeHeaderOnlyRequest(default_request_headers_);
+    RELEASE_ASSERT(response->waitForEndStream(timeout),
+                   fmt::format("unexpected timeout after {}ms", timeout.count()));
     EXPECT_TRUE(response->complete());
     EXPECT_EQ("200", response->headers().getStatusValue());
   }
diff --git a/test/integration/http_integration.h b/test/integration/http_integration.h
index 06f2dd15a6..55adabba2e 100644
--- a/test/integration/http_integration.h
+++ b/test/integration/http_integration.h
@@ -158,10 +158,12 @@ class HttpIntegrationTest : public BaseIntegrationTest {
 
   IntegrationCodecClientPtr makeHttpConnection(uint32_t port);
   // Makes a http connection object without checking its connected state.
-  virtual IntegrationCodecClientPtr
-  makeRawHttpConnection(Network::ClientConnectionPtr&& conn,
-                        absl::optional<envoy::config::core::v3::Http2ProtocolOptions> http2_options,
-                        bool wait_till_connected = true);
+  virtual IntegrationCodecClientPtr makeRawHttpConnection(
+      Network::ClientConnectionPtr&& conn,
+      absl::optional<envoy::config::core::v3::Http2ProtocolOptions> http2_options,
+      absl::optional<envoy::config::core::v3::HttpProtocolOptions> common_http_options =
+          absl::nullopt,
+      bool wait_till_connected = true);
   // Makes a downstream network connection object based on client codec version.
   Network::ClientConnectionPtr makeClientConnectionWithOptions(
       uint32_t port, const Network::ConnectionSocket::OptionsSharedPtr& options) override;
@@ -271,13 +273,13 @@ class HttpIntegrationTest : public BaseIntegrationTest {
   void testRouterUpstreamResponseBeforeRequestComplete(uint32_t status_code = 0);
 
   void testTwoRequests(bool force_network_backup = false);
-  void testLargeHeaders(Http::TestRequestHeaderMapImpl request_headers,
-                        Http::TestRequestTrailerMapImpl request_trailers, uint32_t size,
-                        uint32_t max_size);
   void testLargeRequestUrl(uint32_t url_size, uint32_t max_headers_size);
   void testLargeRequestHeaders(uint32_t size, uint32_t count, uint32_t max_size = 60,
                                uint32_t max_count = 100,
                                std::chrono::milliseconds timeout = TestUtility::DefaultTimeout);
+  void testLargeResponseHeaders(uint32_t size, uint32_t count, uint32_t max_size = 60,
+                                uint32_t max_count = 100,
+                                std::chrono::milliseconds timeout = TestUtility::DefaultTimeout);
   void testLargeRequestTrailers(uint32_t size, uint32_t max_size = 60);
   void testManyRequestHeaders(std::chrono::milliseconds time = TestUtility::DefaultTimeout);
 
diff --git a/test/integration/overload_integration_test.cc b/test/integration/overload_integration_test.cc
index d3a62cdb2f..d5e808a888 100644
--- a/test/integration/overload_integration_test.cc
+++ b/test/integration/overload_integration_test.cc
@@ -403,6 +403,7 @@ TEST_P(OverloadScaledTimerIntegrationTest, HTTP3CloseIdleHttpConnectionsDuringHa
   test_server_->waitForGaugeGe("overload.envoy.overload_actions.reduce_timeouts.scale_percent", 50);
   // Create an HTTP connection without finishing the handshake.
   codec_client_ = makeRawHttpConnection(makeClientConnection((lookupPort("http"))), absl::nullopt,
+                                        absl::nullopt,
                                         /*wait_till_connected=*/false);
   EXPECT_FALSE(codec_client_->connected());
 
@@ -418,8 +419,9 @@ TEST_P(OverloadScaledTimerIntegrationTest, HTTP3CloseIdleHttpConnectionsDuringHa
                                100);
 
   // Create another HTTP connection without finishing handshake.
-  IntegrationCodecClientPtr codec_client2 = makeRawHttpConnection(
-      makeClientConnection((lookupPort("http"))), absl::nullopt, /*wait_till_connected=*/false);
+  IntegrationCodecClientPtr codec_client2 =
+      makeRawHttpConnection(makeClientConnection((lookupPort("http"))), absl::nullopt,
+                            absl::nullopt, /*wait_till_connected=*/false);
   EXPECT_FALSE(codec_client2->connected());
   // Advancing past the minimum time and wait for the proxy to notice and close both connections.
   timeSystem().advanceTimeWait(std::chrono::seconds(3));
diff --git a/test/integration/protocol_integration_test.cc b/test/integration/protocol_integration_test.cc
index 3625b0b58d..921e5ba809 100644
--- a/test/integration/protocol_integration_test.cc
+++ b/test/integration/protocol_integration_test.cc
@@ -2380,11 +2380,52 @@ TEST_P(DownstreamProtocolIntegrationTest, LargeRequestHeadersAccepted) {
   testLargeRequestHeaders(100, 1, 8192, 100);
 }
 
-TEST_P(DownstreamProtocolIntegrationTest, ManyLargeRequestHeadersAccepted) {
+TEST_P(ProtocolIntegrationTest, ManyLargeRequestHeadersAccepted) {
   // Send 70 headers each of size 100 kB with limit 8192 kB (8 MB) and 100 headers.
   testLargeRequestHeaders(100, 70, 8192, 100, TestUtility::DefaultTimeout);
 }
 
+namespace {
+uint32_t adjustMaxSingleHeaderSizeForCodecLimits(uint32_t size,
+                                                 const HttpProtocolTestParams& params) {
+  if (params.http2_implementation == Http2Impl::Nghttp2 &&
+      (params.downstream_protocol == Http::CodecType::HTTP2 ||
+       params.upstream_protocol == Http::CodecType::HTTP2)) {
+    // nghttp2 has a hard-coded, unconfigurable limit of 64k for a header in it's header
+    // decompressor, so this test will always fail when using that codec.
+    // Reduce the size so that it can pass and receive some test coverage.
+    return 100;
+  } else if (params.downstream_protocol == Http::CodecType::HTTP3 ||
+             params.upstream_protocol == Http::CodecType::HTTP3) {
+    // QUICHE has a hard-coded limit of 1024KiB in it's QPACK decoder.
+    // Reduce the size so that it can pass and receive some test coverage.
+    return 1023;
+  }
+
+  return size;
+}
+} // namespace
+
+// Test a single header of the maximum allowed size.
+TEST_P(ProtocolIntegrationTest, VeryLargeRequestHeadersAccepted) {
+  uint32_t size = adjustMaxSingleHeaderSizeForCodecLimits(8191, GetParam());
+
+  testLargeRequestHeaders(size, 1, 8192, 100, TestUtility::DefaultTimeout);
+}
+
+// Test a single header of the maximum allowed size.
+TEST_P(ProtocolIntegrationTest, ManyLargeResponseHeadersAccepted) {
+  // Send 70 headers each of size 100 kB with limit 8192 kB (8 MB) and 100 headers.
+  testLargeResponseHeaders(100, 70, 8192, 100, TestUtility::DefaultTimeout);
+}
+
+// Test a single header of the maximum allowed size.
+TEST_P(ProtocolIntegrationTest, VeryLargeResponseHeadersAccepted) {
+  uint32_t size = adjustMaxSingleHeaderSizeForCodecLimits(8191, GetParam());
+
+  testLargeResponseHeaders(size, 1, 8192, 100, TestUtility::DefaultTimeout);
+}
+
 TEST_P(DownstreamProtocolIntegrationTest, ManyRequestHeadersRejected) {
   // Send 101 empty headers with limit 60 kB and 100 headers.
   testLargeRequestHeaders(0, 101, 60, 80);
diff --git a/test/integration/python/BUILD b/test/integration/python/BUILD
index 5f1e425179..f04ac587f8 100644
--- a/test/integration/python/BUILD
+++ b/test/integration/python/BUILD
@@ -26,6 +26,10 @@ envoy_py_test(
         "//test/integration:hotrestart_main",
         "//tools/h3_request",
     ],
+    exec_properties = select({
+        "//bazel:engflow_rbe": {"Pool": "2core"},
+        "//conditions:default": {},
+    }),
     main = select({
         "//bazel:disable_hot_restart_or_admin": "null_test.py",
         "//conditions:default": "hotrestart_handoff_test.py",
diff --git a/test/integration/quic_http_integration_test.cc b/test/integration/quic_http_integration_test.cc
index efc3e6b922..8be734d474 100644
--- a/test/integration/quic_http_integration_test.cc
+++ b/test/integration/quic_http_integration_test.cc
@@ -251,12 +251,15 @@ class QuicHttpIntegrationTestBase : public HttpIntegrationTest {
     return session;
   }
 
-  IntegrationCodecClientPtr
-  makeRawHttpConnection(Network::ClientConnectionPtr&& conn,
-                        absl::optional<envoy::config::core::v3::Http2ProtocolOptions> http2_options,
-                        bool wait_till_connected = true) override {
+  IntegrationCodecClientPtr makeRawHttpConnection(
+      Network::ClientConnectionPtr&& conn,
+      absl::optional<envoy::config::core::v3::Http2ProtocolOptions> http2_options,
+      absl::optional<envoy::config::core::v3::HttpProtocolOptions> common_http_options =
+          absl::nullopt,
+      bool wait_till_connected = true) override {
     ENVOY_LOG(debug, "Creating a new client {}",
               conn->connectionInfoProvider().localAddress()->asStringView());
+    ASSERT(!common_http_options.has_value(), "Not implemented");
     return makeRawHttp3Connection(std::move(conn), http2_options, wait_till_connected);
   }
 
diff --git a/test/integration/quic_protocol_integration_test.cc b/test/integration/quic_protocol_integration_test.cc
index 2572976dfb..06ab467e53 100644
--- a/test/integration/quic_protocol_integration_test.cc
+++ b/test/integration/quic_protocol_integration_test.cc
@@ -6,7 +6,8 @@ namespace Envoy {
 
 // Test that the quiche code can handle packets getting batched together, i.e.
 // that it will re-register to read even without incoming packets.
-TEST_P(DownstreamProtocolIntegrationTest, BatchedPackets) {
+// TODO(alyssawilk) debug https://github.com/envoyproxy/envoy/issues/36265
+TEST_P(DownstreamProtocolIntegrationTest, DISABLED_BatchedPackets) {
   if (downstreamProtocol() != Http::CodecType::HTTP3) {
     return; // Testing H3 client talking to H3 upstream only.
   }
diff --git a/test/mocks/common.h b/test/mocks/common.h
index 246aec0f00..d5ee5c6607 100644
--- a/test/mocks/common.h
+++ b/test/mocks/common.h
@@ -103,7 +103,7 @@ inline bool operator==(const StringViewSaver& saver, const char* str) {
 class MockScopeTrackedObject : public ScopeTrackedObject {
 public:
   MOCK_METHOD(void, dumpState, (std::ostream&, int), (const));
-  MOCK_METHOD(ExecutionContext*, executionContext, (), (const));
+  MOCK_METHOD(OptRef<const StreamInfo::StreamInfo>, trackedStream, (), (const));
 };
 
 namespace ConnectionPool {
diff --git a/test/mocks/grpc/BUILD b/test/mocks/grpc/BUILD
index 5ecab4ab40..ff6d35be33 100644
--- a/test/mocks/grpc/BUILD
+++ b/test/mocks/grpc/BUILD
@@ -12,6 +12,7 @@ envoy_cc_mock(
     name = "grpc_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/grpc:async_client_interface",
         "//envoy/grpc:async_client_manager_interface",
diff --git a/test/mocks/http/BUILD b/test/mocks/http/BUILD
index 9afca00530..f38a3cc544 100644
--- a/test/mocks/http/BUILD
+++ b/test/mocks/http/BUILD
@@ -31,6 +31,7 @@ envoy_cc_mock(
     name = "conn_pool_mocks",
     srcs = ["conn_pool.cc"],
     hdrs = ["conn_pool.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:conn_pool_interface",
         "//test/mocks:common_lib",
@@ -51,6 +52,7 @@ envoy_cc_mock(
     name = "http_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         ":conn_pool_mocks",
         ":stream_decoder_mock",
@@ -119,6 +121,7 @@ envoy_cc_mock(
 envoy_cc_test(
     name = "http_mocks_test",
     srcs = ["mocks_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":http_mocks",
         "//envoy/http:header_map_interface",
diff --git a/test/mocks/network/BUILD b/test/mocks/network/BUILD
index 9040f55880..27069b13a1 100644
--- a/test/mocks/network/BUILD
+++ b/test/mocks/network/BUILD
@@ -13,6 +13,7 @@ envoy_cc_mock(
     name = "connection_mocks",
     srcs = ["connection.cc"],
     hdrs = ["connection.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/network:connection_interface",
         "//source/common/network:filter_manager_lib",
@@ -52,6 +53,7 @@ envoy_cc_mock(
     name = "network_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         ":connection_mocks",
         ":io_handle_mocks",
diff --git a/test/mocks/network/connection.h b/test/mocks/network/connection.h
index 9c8b7bcbfe..ba776f5f35 100644
--- a/test/mocks/network/connection.h
+++ b/test/mocks/network/connection.h
@@ -96,7 +96,7 @@ class MockConnectionBase {
               (uint64_t bandwidth_bits_per_sec, std::chrono::microseconds rtt), ());               \
   MOCK_METHOD(absl::optional<uint64_t>, congestionWindowInBytes, (), (const));                     \
   MOCK_METHOD(void, dumpState, (std::ostream&, int), (const));                                     \
-  MOCK_METHOD(ExecutionContext*, executionContext, (), (const));
+  MOCK_METHOD(OptRef<const StreamInfo::StreamInfo>, trackedStream, (), (const));
 
 class MockConnection : public Connection, public MockConnectionBase {
 public:
diff --git a/test/mocks/network/mocks.h b/test/mocks/network/mocks.h
index 483ba8404f..7174b21667 100644
--- a/test/mocks/network/mocks.h
+++ b/test/mocks/network/mocks.h
@@ -411,7 +411,6 @@ class MockConnectionSocket : public ConnectionSocket {
   MOCK_METHOD(absl::optional<std::chrono::milliseconds>, lastRoundTripTime, ());
   MOCK_METHOD(absl::optional<uint64_t>, congestionWindowInBytes, (), (const));
   MOCK_METHOD(void, dumpState, (std::ostream&, int), (const));
-  MOCK_METHOD(ExecutionContext*, executionContext, (), (const));
 
   IoHandlePtr io_handle_;
   std::shared_ptr<Network::ConnectionInfoSetterImpl> connection_info_provider_;
diff --git a/test/mocks/router/BUILD b/test/mocks/router/BUILD
index c3b5718670..17e0b9958b 100644
--- a/test/mocks/router/BUILD
+++ b/test/mocks/router/BUILD
@@ -12,6 +12,7 @@ envoy_cc_mock(
     name = "router_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/event:dispatcher_interface",
         "//envoy/http:stateful_session_interface",
@@ -42,6 +43,7 @@ envoy_cc_mock(
     name = "router_filter_interface",
     srcs = ["router_filter_interface.cc"],
     hdrs = ["router_filter_interface.h"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/router:router_lib",
         "//test/mocks/http:http_mocks",
diff --git a/test/mocks/server/BUILD b/test/mocks/server/BUILD
index 1c88e71a5e..cd13e1f7da 100644
--- a/test/mocks/server/BUILD
+++ b/test/mocks/server/BUILD
@@ -61,6 +61,7 @@ envoy_cc_mock(
     name = "admin_stream_mocks",
     srcs = ["admin_stream.cc"],
     hdrs = ["admin_stream.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/server:admin_interface",
         "//test/mocks/http:http_mocks",
@@ -119,6 +120,7 @@ envoy_cc_mock(
     name = "listener_component_factory_mocks",
     srcs = ["listener_component_factory.cc"],
     hdrs = ["listener_component_factory.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/server:drain_manager_interface",
         "//envoy/server:listener_manager_interface",
@@ -180,6 +182,7 @@ envoy_cc_mock(
     name = "instance_mocks",
     srcs = ["instance.cc"],
     hdrs = ["instance.h"],
+    rbe_pool = "2core",
     deps = [
         ":server_factory_context_mocks",
         ":transport_socket_factory_context_mocks",
@@ -200,6 +203,7 @@ envoy_cc_mock(
     name = "server_factory_context_mocks",
     srcs = ["server_factory_context.cc"],
     hdrs = ["server_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":admin_mocks",
         ":drain_manager_mocks",
@@ -238,6 +242,7 @@ envoy_cc_mock(
     name = "factory_context_mocks",
     srcs = ["factory_context.cc"],
     hdrs = ["factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":drain_manager_mocks",
         ":instance_mocks",
@@ -251,6 +256,7 @@ envoy_cc_mock(
     name = "transport_socket_factory_context_mocks",
     srcs = ["transport_socket_factory_context.cc"],
     hdrs = ["transport_socket_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":server_factory_context_mocks",
         "//envoy/server:tracer_config_interface",
@@ -263,6 +269,7 @@ envoy_cc_mock(
     name = "listener_factory_context_mocks",
     srcs = ["listener_factory_context.cc"],
     hdrs = ["listener_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":factory_context_mocks",
         "//envoy/server:listener_manager_interface",
@@ -273,6 +280,7 @@ envoy_cc_mock(
     name = "health_checker_factory_context_mocks",
     srcs = ["health_checker_factory_context.cc"],
     hdrs = ["health_checker_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":factory_context_mocks",
         "//envoy/server:health_checker_config_interface",
@@ -293,6 +301,7 @@ envoy_cc_mock(
     name = "filter_chain_factory_context_mocks",
     srcs = ["filter_chain_factory_context.cc"],
     hdrs = ["filter_chain_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":factory_context_mocks",
         "//envoy/server:filter_config_interface",
@@ -314,6 +323,7 @@ envoy_cc_mock(
     name = "tracer_factory_context_mocks",
     srcs = ["tracer_factory_context.cc"],
     hdrs = ["tracer_factory_context.h"],
+    rbe_pool = "2core",
     deps = [
         ":instance_mocks",
         ":tracer_factory_mocks",
diff --git a/test/mocks/stream_info/BUILD b/test/mocks/stream_info/BUILD
index 35980bf941..de1335898f 100644
--- a/test/mocks/stream_info/BUILD
+++ b/test/mocks/stream_info/BUILD
@@ -12,6 +12,7 @@ envoy_cc_mock(
     name = "stream_info_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/http:request_id_extension_interface",
         "//envoy/stream_info:stream_info_interface",
diff --git a/test/mocks/tcp/BUILD b/test/mocks/tcp/BUILD
index f61c5af7d0..f8e600d132 100644
--- a/test/mocks/tcp/BUILD
+++ b/test/mocks/tcp/BUILD
@@ -12,6 +12,7 @@ envoy_cc_mock(
     name = "tcp_mocks",
     srcs = ["mocks.cc"],
     hdrs = ["mocks.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/buffer:buffer_interface",
         "//envoy/tcp:conn_pool_interface",
diff --git a/test/mocks/upstream/BUILD b/test/mocks/upstream/BUILD
index 2b92de078c..c8959a66a4 100644
--- a/test/mocks/upstream/BUILD
+++ b/test/mocks/upstream/BUILD
@@ -38,6 +38,7 @@ envoy_cc_mock(
     name = "host_mocks",
     srcs = ["host.cc"],
     hdrs = ["host.h"],
+    rbe_pool = "2core",
     deps = [
         ":cluster_info_mocks",
         "//envoy/upstream:upstream_interface",
@@ -197,6 +198,7 @@ envoy_cc_mock(
     name = "load_balancer_mocks",
     srcs = ["load_balancer.cc"],
     hdrs = ["load_balancer.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:load_balancer_interface",
         "//test/mocks/upstream:host_mocks",
@@ -226,6 +228,7 @@ envoy_cc_mock(
     name = "thread_local_cluster_mocks",
     srcs = ["thread_local_cluster.cc"],
     hdrs = ["thread_local_cluster.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:thread_local_cluster_interface",
         "//test/mocks/http:conn_pool_mocks",
@@ -262,6 +265,7 @@ envoy_cc_mock(
     name = "cluster_manager_mocks",
     srcs = ["cluster_manager.cc"],
     hdrs = ["cluster_manager.h"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:cluster_manager_interface",
         "//test/mocks/config:config_mocks",
diff --git a/test/mocks/upstream/cluster_info.cc b/test/mocks/upstream/cluster_info.cc
index 380c7a7c8b..8177186b0b 100644
--- a/test/mocks/upstream/cluster_info.cc
+++ b/test/mocks/upstream/cluster_info.cc
@@ -96,6 +96,13 @@ MockClusterInfo::MockClusterInfo()
   ON_CALL(*this, extensionProtocolOptions(_)).WillByDefault(Return(extension_protocol_options_));
   ON_CALL(*this, maxResponseHeadersCount())
       .WillByDefault(ReturnPointee(&max_response_headers_count_));
+  ON_CALL(*this, maxResponseHeadersKb()).WillByDefault(Invoke([this]() -> absl::optional<uint16_t> {
+    if (common_http_protocol_options_.has_max_response_headers_kb()) {
+      return common_http_protocol_options_.max_response_headers_kb().value();
+    } else {
+      return absl::nullopt;
+    }
+  }));
   ON_CALL(*this, maxRequestsPerConnection())
       .WillByDefault(ReturnPointee(&max_requests_per_connection_));
   ON_CALL(*this, trafficStats()).WillByDefault(ReturnRef(traffic_stats_));
diff --git a/test/mocks/upstream/cluster_info.h b/test/mocks/upstream/cluster_info.h
index 8f5a72973f..978f9c5826 100644
--- a/test/mocks/upstream/cluster_info.h
+++ b/test/mocks/upstream/cluster_info.h
@@ -128,6 +128,7 @@ class MockClusterInfo : public ClusterInfo {
               (const));
   MOCK_METHOD(bool, maintenanceMode, (), (const));
   MOCK_METHOD(uint32_t, maxResponseHeadersCount, (), (const));
+  MOCK_METHOD(absl::optional<uint16_t>, maxResponseHeadersKb, (), (const));
   MOCK_METHOD(uint64_t, maxRequestsPerConnection, (), (const));
   MOCK_METHOD(const std::string&, name, (), (const));
   MOCK_METHOD(const std::string&, observabilityName, (), (const));
diff --git a/test/mocks/upstream/host.cc b/test/mocks/upstream/host.cc
index 8f643c1b76..b244d14800 100644
--- a/test/mocks/upstream/host.cc
+++ b/test/mocks/upstream/host.cc
@@ -60,6 +60,9 @@ MockHost::MockHost() : socket_factory_(new testing::NiceMock<Network::MockTransp
   ON_CALL(*this, loadMetricStats()).WillByDefault(ReturnRef(load_metric_stats_));
   ON_CALL(*this, warmed()).WillByDefault(Return(true));
   ON_CALL(*this, transportSocketFactory()).WillByDefault(ReturnRef(*socket_factory_));
+  ON_CALL(*this, lbPolicyData()).WillByDefault(Invoke([this]() -> OptRef<HostLbPolicyData> {
+    return makeOptRefFromPtr(lb_policy_data_.get());
+  }));
 }
 
 MockHost::~MockHost() = default;
diff --git a/test/mocks/upstream/host.h b/test/mocks/upstream/host.h
index 46460eaf9e..74c605aaf1 100644
--- a/test/mocks/upstream/host.h
+++ b/test/mocks/upstream/host.h
@@ -210,7 +210,7 @@ class MockHostLight : public Host {
   MOCK_METHOD(bool, warmed, (), (const));
   MOCK_METHOD(absl::optional<MonotonicTime>, lastHcPassTime, (), (const));
   MOCK_METHOD(void, setLbPolicyData, (HostLbPolicyDataPtr lb_policy_data));
-  MOCK_METHOD(const HostLbPolicyDataPtr&, lbPolicyData, (), (const));
+  MOCK_METHOD(OptRef<HostLbPolicyData>, lbPolicyData, (), (const));
 
   bool disable_active_health_check_ = false;
 };
@@ -236,6 +236,7 @@ class MockHost : public MockHostLight {
   testing::NiceMock<Outlier::MockDetectorHostMonitor> outlier_detector_;
   HostStats stats_;
   LoadMetricStatsImpl load_metric_stats_;
+  HostLbPolicyDataPtr lb_policy_data_;
   mutable Stats::TestUtil::TestSymbolTable symbol_table_;
   mutable std::unique_ptr<Stats::StatNameManagedStorage> locality_zone_stat_name_;
 };
diff --git a/test/mocks/upstream/load_balancer_context.h b/test/mocks/upstream/load_balancer_context.h
index 35ec2ffbf2..cb2cfa097b 100644
--- a/test/mocks/upstream/load_balancer_context.h
+++ b/test/mocks/upstream/load_balancer_context.h
@@ -26,7 +26,7 @@ class MockLoadBalancerContext : public LoadBalancerContext {
   MOCK_METHOD(Network::TransportSocketOptionsConstSharedPtr, upstreamTransportSocketOptions, (),
               (const));
   MOCK_METHOD(absl::optional<OverrideHost>, overrideHostToSelect, (), (const));
-  MOCK_METHOD(void, setOrcaLoadReportCallbacks, (OrcaLoadReportCallbacks&));
+  MOCK_METHOD(void, setOrcaLoadReportCallbacks, (std::weak_ptr<OrcaLoadReportCallbacks>));
 
 private:
   HealthyAndDegradedLoad priority_load_;
diff --git a/test/server/BUILD b/test/server/BUILD
index f984efcd48..96dcd8f8e1 100644
--- a/test/server/BUILD
+++ b/test/server/BUILD
@@ -19,6 +19,7 @@ envoy_package()
 envoy_cc_test(
     name = "api_listener_test",
     srcs = ["api_listener_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/formatter:formatter_extension_lib",
@@ -37,6 +38,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "backtrace_test",
     srcs = ["backtrace_test.cc"],
+    rbe_pool = "2core",
     tags = ["backtrace"],
     deps = [
         "//source/server:backtrace_lib",
@@ -50,6 +52,7 @@ envoy_cc_test(
     data = [
         "//test/config/integration/certs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/event:dispatcher_lib",
@@ -80,6 +83,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "connection_handler_test",
     srcs = ["connection_handler_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/config:utility_lib",
@@ -103,6 +107,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "active_tcp_listener_test",
     srcs = ["active_tcp_listener_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:utility_lib",
         "//source/common/config:utility_lib",
@@ -119,6 +124,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "active_udp_listener_test",
     srcs = ["active_udp_listener_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/network:listen_socket_lib",
         "//source/common/network:socket_option_factory_lib",
@@ -133,6 +139,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "drain_manager_impl_test",
     srcs = ["drain_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/server:drain_manager_lib",
         "//test/mocks/event:event_mocks",
@@ -144,6 +151,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "filter_config_test",
     srcs = ["filter_config_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/server:filter_config_interface",
         "//source/extensions/filters/http/common:pass_through_filter_lib",
@@ -162,6 +170,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "hot_restart_impl_test",
     srcs = envoy_select_hot_restart(["hot_restart_impl_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":hot_restart_udp_forwarding_test_helper",
         ":utility_lib",
@@ -177,6 +186,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hot_restarting_child_test",
     srcs = envoy_select_hot_restart(["hot_restarting_child_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":hot_restart_udp_forwarding_test_helper",
         ":utility_lib",
@@ -193,6 +203,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hot_restarting_parent_test",
     srcs = envoy_select_hot_restart(["hot_restarting_parent_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "//source/common/stats:stats_lib",
@@ -206,6 +217,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "hot_restarting_base_test",
     srcs = envoy_select_hot_restart(["hot_restarting_base_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/server:hot_restart_lib",
         "//source/server:hot_restarting_base",
@@ -219,6 +231,7 @@ envoy_cc_test(
     name = "guarddog_impl_test",
     size = "small",
     srcs = ["guarddog_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":guarddog_test_interlock",
         "//envoy/common:time_interface",
@@ -248,6 +261,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "options_impl_test",
     srcs = ["options_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/config:typed_config_interface",
         "//envoy/server:filter_config_interface",
@@ -271,6 +285,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "overload_manager_impl_test",
     srcs = ["overload_manager_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/registry",
         "//source/common/stats:isolated_store_lib",
@@ -291,6 +306,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "null_overload_manager_test",
     srcs = ["null_overload_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/server:null_overload_manager_lib",
         "//source/server:overload_manager_lib",
@@ -304,6 +320,7 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["server_fuzz_test.cc"],
     corpus = "server_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/thread_local:thread_local_lib",
         "//source/server:server_lib",
@@ -342,6 +359,7 @@ envoy_cc_test(
         ":server_test_data",
         ":static_validation_test_data",
     ],
+    rbe_pool = "2core",
     deps = [
         "//source/common/version:version_lib",
         "//source/extensions/access_loggers/file:config",
@@ -389,6 +407,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "worker_impl_test",
     srcs = ["worker_impl_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/api:api_lib",
         "//source/common/event:dispatcher_lib",
@@ -406,6 +425,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "server_stats_flush_benchmark",
     srcs = ["server_stats_flush_benchmark_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/stats:stats_interface",
         "//source/common/stats:thread_local_store_lib",
@@ -424,6 +444,7 @@ envoy_benchmark_test(
 envoy_cc_test(
     name = "utils_test",
     srcs = envoy_select_admin_functionality(["utils_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/server:utils_lib",
         "//test/mocks/server:options_mocks",
diff --git a/test/server/admin/BUILD b/test/server/admin/BUILD
index 73023b39eb..f1f4fcd283 100644
--- a/test/server/admin/BUILD
+++ b/test/server/admin/BUILD
@@ -15,6 +15,7 @@ envoy_package()
 envoy_cc_test(
     name = "admin_html_util_test",
     srcs = ["admin_html_util_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/server/admin:admin_html_util",
         "//test/test_common:utility_lib",
@@ -24,6 +25,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "admin_factory_context_test",
     srcs = ["admin_factory_context_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/listener_manager:listener_info_lib",
         "//source/server/admin:admin_factory_context",
@@ -35,6 +37,7 @@ envoy_cc_test_library(
     name = "admin_instance_lib",
     srcs = envoy_select_admin_functionality(["admin_instance.cc"]),
     hdrs = envoy_select_admin_functionality(["admin_instance.h"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/formatter:formatter_extension_lib",
         "//source/server:configuration_lib",
@@ -50,6 +53,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "admin_test",
     srcs = envoy_select_admin_functionality(["admin_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//envoy/json:json_object_interface",
@@ -74,6 +78,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "admin_filter_test",
     srcs = envoy_select_admin_functionality(["admin_filter_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/server/admin:admin_lib",
         "//test/mocks/server:instance_mocks",
@@ -84,6 +89,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "admin_html_test",
     srcs = envoy_select_admin_html(["admin_html_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//source/server/admin:admin_lib",
@@ -93,6 +99,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stats_handler_test",
     srcs = envoy_select_admin_functionality(["stats_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//source/common/common:regex_lib",
@@ -111,6 +118,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "stats_params_test",
     srcs = envoy_select_admin_functionality(["stats_params_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/server/admin:stats_params_lib",
@@ -122,6 +130,7 @@ envoy_cc_test(
     srcs = envoy_select_admin_functionality(["stats_render_test.cc"]) + envoy_select_admin_html([
         "stats_html_render_test.cc",
     ]),
+    rbe_pool = "2core",
     deps = [
         ":stats_render_test_base",
         "//source/server/admin:admin_lib",
@@ -145,6 +154,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "stats_request_test",
     srcs = envoy_select_admin_functionality(["stats_request_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:thread_local_store_lib",
         "//source/server/admin:stats_request_lib",
@@ -160,6 +170,7 @@ envoy_cc_test(
 envoy_cc_benchmark_binary(
     name = "stats_handler_speed_test",
     srcs = envoy_select_admin_functionality(["stats_handler_speed_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/buffer:buffer_lib",
         "//source/common/http:header_map_lib",
@@ -173,6 +184,7 @@ envoy_cc_benchmark_binary(
 envoy_cc_test(
     name = "utils_test",
     srcs = envoy_select_admin_functionality(["utils_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/server/admin:utils_lib",
     ],
@@ -181,12 +193,14 @@ envoy_cc_test(
 envoy_cc_test(
     name = "runtime_handler_test",
     srcs = envoy_select_admin_functionality(["runtime_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [":admin_instance_lib"],
 )
 
 envoy_cc_test(
     name = "prometheus_stats_test",
     srcs = envoy_select_admin_functionality(["prometheus_stats_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/stats:tag_producer_lib",
         "//source/common/stats:thread_local_store_lib",
@@ -200,6 +214,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "logs_handler_test",
     srcs = envoy_select_admin_functionality(["logs_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//source/common/common:minimal_logger_lib",
@@ -209,6 +224,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "profiling_handler_test",
     srcs = envoy_select_admin_functionality(["profiling_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//test/test_common:logging_lib",
@@ -218,6 +234,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "server_info_handler_test",
     srcs = envoy_select_admin_functionality(["server_info_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//source/common/tls:context_config_lib",
@@ -230,6 +247,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "clusters_handler_test",
     srcs = envoy_select_admin_functionality(["clusters_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//test/common/upstream:utility_lib",
@@ -241,6 +259,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_dump_handler_test",
     srcs = envoy_select_admin_functionality(["config_dump_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
         "//test/integration/filters:test_listener_filter_lib",
@@ -251,6 +270,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "init_dump_handler_test",
     srcs = envoy_select_admin_functionality(["init_dump_handler_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         ":admin_instance_lib",
     ],
@@ -259,6 +279,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "config_tracker_impl_test",
     srcs = envoy_select_admin_functionality(["config_tracker_impl_test.cc"]),
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:matchers_lib",
         "//source/server/admin:config_tracker_lib",
diff --git a/test/server/config_validation/BUILD b/test/server/config_validation/BUILD
index ae31695867..6de2607f10 100644
--- a/test/server/config_validation/BUILD
+++ b/test/server/config_validation/BUILD
@@ -9,6 +9,7 @@ envoy_package()
 envoy_cc_test(
     name = "cluster_manager_test",
     srcs = ["cluster_manager_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//envoy/upstream:resource_manager_interface",
         "//envoy/upstream:upstream_interface",
@@ -49,6 +50,7 @@ envoy_cc_test(
         "//test/config_test:example_configs_test_setup.sh",
     ],
     env = {"EXAMPLE_CONFIGS_TAR_PATH": "envoy/configs/example_configs.tar"},
+    rbe_pool = "2core",
     deps = [
         "//source/extensions/access_loggers/stream:config",
         "//source/extensions/clusters/logical_dns:logical_dns_cluster_lib",
@@ -74,6 +76,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "dispatcher_test",
     srcs = ["dispatcher_test.cc"],
+    rbe_pool = "2core",
     deps = [
         "//source/common/event:libevent_lib",
         "//source/common/stats:isolated_store_lib",
@@ -90,6 +93,7 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["config_fuzz_test.cc"],
     corpus = "//test/server:server_fuzz_test_corpus",
+    rbe_pool = "2core",
     deps = [
         "//source/common/common:thread_lib",
         "//source/server/config_validation:server_lib",
@@ -131,6 +135,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "xds_verifier_test",
     srcs = ["xds_verifier_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":xds_verifier_lib",
         "//test/config:utility_lib",
@@ -141,6 +146,7 @@ envoy_cc_test_library(
     name = "xds_fuzz_lib",
     srcs = ["xds_fuzz.cc"],
     hdrs = ["xds_fuzz.h"],
+    rbe_pool = "2core",
     deps = [
         ":xds_fuzz_proto_cc_proto",
         ":xds_verifier_lib",
@@ -161,6 +167,7 @@ envoy_cc_fuzz_test(
     size = "large",
     srcs = ["xds_fuzz_test.cc"],
     corpus = "xds_corpus",
+    rbe_pool = "2core",
     deps = [
         ":xds_fuzz_lib",
         "//source/common/protobuf:utility_lib",
diff --git a/test/test_common/BUILD b/test/test_common/BUILD
index 4cc616a430..aa35f53d2b 100644
--- a/test/test_common/BUILD
+++ b/test/test_common/BUILD
@@ -68,6 +68,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "network_utility_test",
     srcs = ["network_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":environment_lib",
         ":network_utility_lib",
@@ -205,6 +206,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "utility_test",
     srcs = ["utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":utility_lib",
         "@envoy_api//envoy/service/discovery/v3:pkg_cc_proto",
@@ -242,6 +244,7 @@ envoy_cc_library(
 envoy_cc_test(
     name = "global_test",
     srcs = ["global_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":global_lib",
     ],
@@ -309,6 +312,7 @@ envoy_cc_test_library(
 envoy_cc_test(
     name = "status_utility_test",
     srcs = ["status_utility_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":status_utility_lib",
     ],
@@ -317,6 +321,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "simulated_time_system_test",
     srcs = ["simulated_time_system_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":simulated_time_system_lib",
         ":utility_lib",
@@ -329,6 +334,7 @@ envoy_cc_test(
 envoy_cc_test(
     name = "test_time_system_test",
     srcs = ["test_time_system_test.cc"],
+    rbe_pool = "2core",
     deps = [
         ":simulated_time_system_lib",
         ":test_time_lib",
diff --git a/test/tools/config_load_check/BUILD b/test/tools/config_load_check/BUILD
index 68e744520f..23d1e63513 100644
--- a/test/tools/config_load_check/BUILD
+++ b/test/tools/config_load_check/BUILD
@@ -20,6 +20,7 @@ envoy_cc_test_library(
 
 envoy_cc_test_binary(
     name = "config_load_check_tool",
+    rbe_pool = "2core",
     deps = [
         ":config_load_check_lib",
         "//source/common/common:minimal_logger_lib",
diff --git a/test/tools/router_check/BUILD b/test/tools/router_check/BUILD
index b09a660e6d..fb8ddde873 100644
--- a/test/tools/router_check/BUILD
+++ b/test/tools/router_check/BUILD
@@ -17,6 +17,7 @@ envoy_cc_test_binary(
     name = "router_check_tool",
     srcs = ["router_check.cc"],
     linkstatic = envoy_select_linkstatic(),
+    rbe_pool = "2core",
     deps = [":router_check_main_lib"] + select({
         "//bazel:coverage_build": [],
         "//bazel:windows_x86_64": envoy_all_extensions(WINDOWS_SKIP_TARGETS),
@@ -36,6 +37,7 @@ envoy_cc_test_library(
         "router.h",
     ],
     copts = ["-DHAVE_LONG_LONG"],
+    rbe_pool = "2core",
     deps = [
         ":validation_proto_cc_proto",
         "//source/common/common:random_generator_lib",
diff --git a/test/tools/router_check/test/BUILD b/test/tools/router_check/test/BUILD
index 16ee356e68..d32e57e44d 100644
--- a/test/tools/router_check/test/BUILD
+++ b/test/tools/router_check/test/BUILD
@@ -17,6 +17,7 @@ envoy_sh_test(
     data = [
         ":configs",
     ],
+    rbe_pool = "2core",
     tags = ["nocoverage"],
 )
 
@@ -26,6 +27,7 @@ envoy_cc_test(
     data = [
         ":configs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//test/tools/router_check:router_check_main_lib",
     ],
diff --git a/test/tools/schema_validator/BUILD b/test/tools/schema_validator/BUILD
index ed852bdd0b..d89b38efd2 100644
--- a/test/tools/schema_validator/BUILD
+++ b/test/tools/schema_validator/BUILD
@@ -14,6 +14,7 @@ envoy_package()
 envoy_cc_test_binary(
     name = "schema_validator_tool",
     srcs = ["schema_validator.cc"],
+    rbe_pool = "2core",
     deps = [":schema_validator_lib"] + select({
         "//bazel:windows_x86_64": envoy_all_extensions(WINDOWS_SKIP_TARGETS),
         "//bazel:linux_ppc": envoy_all_extensions(PPC_SKIP_TARGETS),
diff --git a/test/tools/schema_validator/test/BUILD b/test/tools/schema_validator/test/BUILD
index dcbf5e7ccc..7e359a4640 100644
--- a/test/tools/schema_validator/test/BUILD
+++ b/test/tools/schema_validator/test/BUILD
@@ -14,6 +14,7 @@ envoy_cc_test(
     data = [
         ":configs",
     ],
+    rbe_pool = "2core",
     deps = [
         "//test/tools/schema_validator:schema_validator_lib",
     ],
diff --git a/test/tools/type_whisperer/BUILD b/test/tools/type_whisperer/BUILD
index 9e23abf89d..d889e4a61b 100644
--- a/test/tools/type_whisperer/BUILD
+++ b/test/tools/type_whisperer/BUILD
@@ -7,7 +7,11 @@ envoy_package()
 envoy_cc_test(
     name = "api_type_db_test",
     srcs = ["api_type_db_test.cc"],
+    rbe_pool = "2core",
     # MSVC does not allow strings over a certain length, see error C2026
-    tags = ["skip_on_windows"],
+    tags = [
+        "no-remote-exec",
+        "skip_on_windows",
+    ],
     deps = ["//tools/type_whisperer:api_type_db_lib"],
 )
diff --git a/tools/base/requirements.txt b/tools/base/requirements.txt
index 2dd1c2abd7..ed54220147 100644
--- a/tools/base/requirements.txt
+++ b/tools/base/requirements.txt
@@ -92,98 +92,98 @@ aiohappyeyeballs==2.4.0 \
     --hash=sha256:55a1714f084e63d49639800f95716da97a1f173d46a16dfcfda0016abb93b6b2 \
     --hash=sha256:7ce92076e249169a13c2f49320d1967425eaf1f407522d707d59cac7628d62bd
     # via aiohttp
-aiohttp==3.10.5 \
-    --hash=sha256:02594361128f780eecc2a29939d9dfc870e17b45178a867bf61a11b2a4367277 \
-    --hash=sha256:03f2645adbe17f274444953bdea69f8327e9d278d961d85657cb0d06864814c1 \
-    --hash=sha256:074d1bff0163e107e97bd48cad9f928fa5a3eb4b9d33366137ffce08a63e37fe \
-    --hash=sha256:0912b8a8fadeb32ff67a3ed44249448c20148397c1ed905d5dac185b4ca547bb \
-    --hash=sha256:0d277cfb304118079e7044aad0b76685d30ecb86f83a0711fc5fb257ffe832ca \
-    --hash=sha256:0d93400c18596b7dc4794d48a63fb361b01a0d8eb39f28800dc900c8fbdaca91 \
-    --hash=sha256:123dd5b16b75b2962d0fff566effb7a065e33cd4538c1692fb31c3bda2bfb972 \
-    --hash=sha256:17e997105bd1a260850272bfb50e2a328e029c941c2708170d9d978d5a30ad9a \
-    --hash=sha256:18a01eba2574fb9edd5f6e5fb25f66e6ce061da5dab5db75e13fe1558142e0a3 \
-    --hash=sha256:1923a5c44061bffd5eebeef58cecf68096e35003907d8201a4d0d6f6e387ccaa \
-    --hash=sha256:1942244f00baaacaa8155eca94dbd9e8cc7017deb69b75ef67c78e89fdad3c77 \
-    --hash=sha256:1b2c16a919d936ca87a3c5f0e43af12a89a3ce7ccbce59a2d6784caba945b68b \
-    --hash=sha256:1c19de68896747a2aa6257ae4cf6ef59d73917a36a35ee9d0a6f48cff0f94db8 \
-    --hash=sha256:1e72589da4c90337837fdfe2026ae1952c0f4a6e793adbbfbdd40efed7c63599 \
-    --hash=sha256:22c0a23a3b3138a6bf76fc553789cb1a703836da86b0f306b6f0dc1617398abc \
-    --hash=sha256:2c634a3207a5445be65536d38c13791904fda0748b9eabf908d3fe86a52941cf \
-    --hash=sha256:2d21ac12dc943c68135ff858c3a989f2194a709e6e10b4c8977d7fcd67dfd511 \
-    --hash=sha256:2f1f1c75c395991ce9c94d3e4aa96e5c59c8356a15b1c9231e783865e2772699 \
-    --hash=sha256:305be5ff2081fa1d283a76113b8df7a14c10d75602a38d9f012935df20731487 \
-    --hash=sha256:33e6bc4bab477c772a541f76cd91e11ccb6d2efa2b8d7d7883591dfb523e5987 \
-    --hash=sha256:349ef8a73a7c5665cca65c88ab24abe75447e28aa3bc4c93ea5093474dfdf0ff \
-    --hash=sha256:380f926b51b92d02a34119d072f178d80bbda334d1a7e10fa22d467a66e494db \
-    --hash=sha256:38172a70005252b6893088c0f5e8a47d173df7cc2b2bd88650957eb84fcf5022 \
-    --hash=sha256:391cc3a9c1527e424c6865e087897e766a917f15dddb360174a70467572ac6ce \
-    --hash=sha256:3a1c32a19ee6bbde02f1cb189e13a71b321256cc1d431196a9f824050b160d5a \
-    --hash=sha256:4120d7fefa1e2d8fb6f650b11489710091788de554e2b6f8347c7a20ceb003f5 \
-    --hash=sha256:424ae21498790e12eb759040bbb504e5e280cab64693d14775c54269fd1d2bb7 \
-    --hash=sha256:44b324a6b8376a23e6ba25d368726ee3bc281e6ab306db80b5819999c737d820 \
-    --hash=sha256:4790f0e15f00058f7599dab2b206d3049d7ac464dc2e5eae0e93fa18aee9e7bf \
-    --hash=sha256:4aff049b5e629ef9b3e9e617fa6e2dfeda1bf87e01bcfecaf3949af9e210105e \
-    --hash=sha256:4b38b1570242fbab8d86a84128fb5b5234a2f70c2e32f3070143a6d94bc854cf \
-    --hash=sha256:4d46c7b4173415d8e583045fbc4daa48b40e31b19ce595b8d92cf639396c15d5 \
-    --hash=sha256:4f1c9866ccf48a6df2b06823e6ae80573529f2af3a0992ec4fe75b1a510df8a6 \
-    --hash=sha256:4f7acae3cf1a2a2361ec4c8e787eaaa86a94171d2417aae53c0cca6ca3118ff6 \
-    --hash=sha256:54d9ddea424cd19d3ff6128601a4a4d23d54a421f9b4c0fff740505813739a91 \
-    --hash=sha256:58718e181c56a3c02d25b09d4115eb02aafe1a732ce5714ab70326d9776457c3 \
-    --hash=sha256:5ede29d91a40ba22ac1b922ef510aab871652f6c88ef60b9dcdf773c6d32ad7a \
-    --hash=sha256:61645818edd40cc6f455b851277a21bf420ce347baa0b86eaa41d51ef58ba23d \
-    --hash=sha256:66bf9234e08fe561dccd62083bf67400bdbf1c67ba9efdc3dac03650e97c6088 \
-    --hash=sha256:673f988370f5954df96cc31fd99c7312a3af0a97f09e407399f61583f30da9bc \
-    --hash=sha256:676f94c5480d8eefd97c0c7e3953315e4d8c2b71f3b49539beb2aa676c58272f \
-    --hash=sha256:6c225286f2b13bab5987425558baa5cbdb2bc925b2998038fa028245ef421e75 \
-    --hash=sha256:7384d0b87d4635ec38db9263e6a3f1eb609e2e06087f0aa7f63b76833737b471 \
-    --hash=sha256:7e2fe37ac654032db1f3499fe56e77190282534810e2a8e833141a021faaab0e \
-    --hash=sha256:7f2bfc0032a00405d4af2ba27f3c429e851d04fad1e5ceee4080a1c570476697 \
-    --hash=sha256:7f6b639c36734eaa80a6c152a238242bedcee9b953f23bb887e9102976343092 \
-    --hash=sha256:814375093edae5f1cb31e3407997cf3eacefb9010f96df10d64829362ae2df69 \
-    --hash=sha256:8224f98be68a84b19f48e0bdc14224b5a71339aff3a27df69989fa47d01296f3 \
-    --hash=sha256:898715cf566ec2869d5cb4d5fb4be408964704c46c96b4be267442d265390f32 \
-    --hash=sha256:8989f46f3d7ef79585e98fa991e6ded55d2f48ae56d2c9fa5e491a6e4effb589 \
-    --hash=sha256:8ba01ebc6175e1e6b7275c907a3a36be48a2d487549b656aa90c8a910d9f3178 \
-    --hash=sha256:8c5c6fa16412b35999320f5c9690c0f554392dc222c04e559217e0f9ae244b92 \
-    --hash=sha256:8c6a4e5e40156d72a40241a25cc226051c0a8d816610097a8e8f517aeacd59a2 \
-    --hash=sha256:8eaf44ccbc4e35762683078b72bf293f476561d8b68ec8a64f98cf32811c323e \
-    --hash=sha256:8fb4fc029e135859f533025bc82047334e24b0d489e75513144f25408ecaf058 \
-    --hash=sha256:9093a81e18c45227eebe4c16124ebf3e0d893830c6aca7cc310bfca8fe59d857 \
-    --hash=sha256:94c4381ffba9cc508b37d2e536b418d5ea9cfdc2848b9a7fea6aebad4ec6aac1 \
-    --hash=sha256:94fac7c6e77ccb1ca91e9eb4cb0ac0270b9fb9b289738654120ba8cebb1189c6 \
-    --hash=sha256:95c4dc6f61d610bc0ee1edc6f29d993f10febfe5b76bb470b486d90bbece6b22 \
-    --hash=sha256:975218eee0e6d24eb336d0328c768ebc5d617609affaca5dbbd6dd1984f16ed0 \
-    --hash=sha256:ad146dae5977c4dd435eb31373b3fe9b0b1bf26858c6fc452bf6af394067e10b \
-    --hash=sha256:afe16a84498441d05e9189a15900640a2d2b5e76cf4efe8cbb088ab4f112ee57 \
-    --hash=sha256:b1c43eb1ab7cbf411b8e387dc169acb31f0ca0d8c09ba63f9eac67829585b44f \
-    --hash=sha256:b90078989ef3fc45cf9221d3859acd1108af7560c52397ff4ace8ad7052a132e \
-    --hash=sha256:b98e698dc34966e5976e10bbca6d26d6724e6bdea853c7c10162a3235aba6e16 \
-    --hash=sha256:ba5a8b74c2a8af7d862399cdedce1533642fa727def0b8c3e3e02fcb52dca1b1 \
-    --hash=sha256:c31ad0c0c507894e3eaa843415841995bf8de4d6b2d24c6e33099f4bc9fc0d4f \
-    --hash=sha256:c3b9162bab7e42f21243effc822652dc5bb5e8ff42a4eb62fe7782bcbcdfacf6 \
-    --hash=sha256:c58c6837a2c2a7cf3133983e64173aec11f9c2cd8e87ec2fdc16ce727bcf1a04 \
-    --hash=sha256:c83f7a107abb89a227d6c454c613e7606c12a42b9a4ca9c5d7dad25d47c776ae \
-    --hash=sha256:cde98f323d6bf161041e7627a5fd763f9fd829bcfcd089804a5fdce7bb6e1b7d \
-    --hash=sha256:ce91db90dbf37bb6fa0997f26574107e1b9d5ff939315247b7e615baa8ec313b \
-    --hash=sha256:d00f3c5e0d764a5c9aa5a62d99728c56d455310bcc288a79cab10157b3af426f \
-    --hash=sha256:d17920f18e6ee090bdd3d0bfffd769d9f2cb4c8ffde3eb203777a3895c128862 \
-    --hash=sha256:d55f011da0a843c3d3df2c2cf4e537b8070a419f891c930245f05d329c4b0689 \
-    --hash=sha256:d742c36ed44f2798c8d3f4bc511f479b9ceef2b93f348671184139e7d708042c \
-    --hash=sha256:d9a487ef090aea982d748b1b0d74fe7c3950b109df967630a20584f9a99c0683 \
-    --hash=sha256:d9ef084e3dc690ad50137cc05831c52b6ca428096e6deb3c43e95827f531d5ef \
-    --hash=sha256:da452c2c322e9ce0cfef392e469a26d63d42860f829026a63374fde6b5c5876f \
-    --hash=sha256:dc4826823121783dccc0871e3f405417ac116055bf184ac04c36f98b75aacd12 \
-    --hash=sha256:de7a5299827253023c55ea549444e058c0eb496931fa05d693b95140a947cb73 \
-    --hash=sha256:e04a1f2a65ad2f93aa20f9ff9f1b672bf912413e5547f60749fa2ef8a644e061 \
-    --hash=sha256:e1ca1ef5ba129718a8fc827b0867f6aa4e893c56eb00003b7367f8a733a9b072 \
-    --hash=sha256:ee40b40aa753d844162dcc80d0fe256b87cba48ca0054f64e68000453caead11 \
-    --hash=sha256:f071854b47d39591ce9a17981c46790acb30518e2f83dfca8db2dfa091178691 \
-    --hash=sha256:f29930bc2921cef955ba39a3ff87d2c4398a0394ae217f41cb02d5c26c8b1b77 \
-    --hash=sha256:f489a2c9e6455d87eabf907ac0b7d230a9786be43fbe884ad184ddf9e9c1e385 \
-    --hash=sha256:f5bf3ead3cb66ab990ee2561373b009db5bc0e857549b6c9ba84b20bc462e172 \
-    --hash=sha256:f6f18898ace4bcd2d41a122916475344a87f1dfdec626ecde9ee802a711bc569 \
-    --hash=sha256:f8112fb501b1e0567a1251a2fd0747baae60a4ab325a871e975b7bb67e59221f \
-    --hash=sha256:fd31f176429cecbc1ba499d4aba31aaccfea488f418d60376b911269d3b883c5
+aiohttp==3.10.6 \
+    --hash=sha256:02108326574ff60267b7b35b17ac5c0bbd0008ccb942ce4c48b657bb90f0b8aa \
+    --hash=sha256:029a019627b37fa9eac5c75cc54a6bb722c4ebbf5a54d8c8c0fb4dd8facf2702 \
+    --hash=sha256:03fa40d1450ee5196e843315ddf74a51afc7e83d489dbfc380eecefea74158b1 \
+    --hash=sha256:0749c4d5a08a802dd66ecdf59b2df4d76b900004017468a7bb736c3b5a3dd902 \
+    --hash=sha256:0754690a3a26e819173a34093798c155bafb21c3c640bff13be1afa1e9d421f9 \
+    --hash=sha256:0a75d5c9fb4f06c41d029ae70ad943c3a844c40c0a769d12be4b99b04f473d3d \
+    --hash=sha256:0b82c8ebed66ce182893e7c0b6b60ba2ace45b1df104feb52380edae266a4850 \
+    --hash=sha256:0be3115753baf8b4153e64f9aa7bf6c0c64af57979aa900c31f496301b374570 \
+    --hash=sha256:14477c4e52e2f17437b99893fd220ffe7d7ee41df5ebf931a92b8ca82e6fd094 \
+    --hash=sha256:164ecd32e65467d86843dbb121a6666c3deb23b460e3f8aefdcaacae79eb718a \
+    --hash=sha256:1cb045ec5961f51af3e2c08cd6fe523f07cc6e345033adee711c49b7b91bb954 \
+    --hash=sha256:1e52e59ed5f4cc3a3acfe2a610f8891f216f486de54d95d6600a2c9ba1581f4d \
+    --hash=sha256:217791c6a399cc4f2e6577bb44344cba1f5714a2aebf6a0bea04cfa956658284 \
+    --hash=sha256:25d92f794f1332f656e3765841fc2b7ad5c26c3f3d01e8949eeb3495691cf9f4 \
+    --hash=sha256:2708baccdc62f4b1251e59c2aac725936a900081f079b88843dabcab0feeeb27 \
+    --hash=sha256:27cf19a38506e2e9f12fc17e55f118f04897b0a78537055d93a9de4bf3022e3d \
+    --hash=sha256:289fa8a20018d0d5aa9e4b35d899bd51bcb80f0d5f365d9a23e30dac3b79159b \
+    --hash=sha256:2cd5290ab66cfca2f90045db2cc6434c1f4f9fbf97c9f1c316e785033782e7d2 \
+    --hash=sha256:2dd56e3c43660ed3bea67fd4c5025f1ac1f9ecf6f0b991a6e5efe2e678c490c5 \
+    --hash=sha256:3427031064b0d5c95647e6369c4aa3c556402f324a3e18107cb09517abe5f962 \
+    --hash=sha256:3468b39f977a11271517c6925b226720e148311039a380cc9117b1e2258a721f \
+    --hash=sha256:370e2d47575c53c817ee42a18acc34aad8da4dbdaac0a6c836d58878955f1477 \
+    --hash=sha256:3d2665c5df629eb2f981dab244c01bfa6cdc185f4ffa026639286c4d56fafb54 \
+    --hash=sha256:3e15e33bfc73fa97c228f72e05e8795e163a693fd5323549f49367c76a6e5883 \
+    --hash=sha256:3fb4216e3ec0dbc01db5ba802f02ed78ad8f07121be54eb9e918448cc3f61b7c \
+    --hash=sha256:40271a2a375812967401c9ca8077de9368e09a43a964f4dce0ff603301ec9358 \
+    --hash=sha256:438c5863feb761f7ca3270d48c292c334814459f61cc12bab5ba5b702d7c9e56 \
+    --hash=sha256:4407a80bca3e694f2d2a523058e20e1f9f98a416619e04f6dc09dc910352ac8b \
+    --hash=sha256:444d1704e2af6b30766debed9be8a795958029e552fe77551355badb1944012c \
+    --hash=sha256:4611db8c907f90fe86be112efdc2398cd7b4c8eeded5a4f0314b70fdea8feab0 \
+    --hash=sha256:473961b3252f3b949bb84873d6e268fb6d8aa0ccc6eb7404fa58c76a326bb8e1 \
+    --hash=sha256:4752df44df48fd42b80f51d6a97553b482cda1274d9dc5df214a3a1aa5d8f018 \
+    --hash=sha256:47647c8af04a70e07a2462931b0eba63146a13affa697afb4ecbab9d03a480ce \
+    --hash=sha256:482f74057ea13d387a7549d7a7ecb60e45146d15f3e58a2d93a0ad2d5a8457cd \
+    --hash=sha256:4bef1480ee50f75abcfcb4b11c12de1005968ca9d0172aec4a5057ba9f2b644f \
+    --hash=sha256:4fabdcdc781a36b8fd7b2ca9dea8172f29a99e11d00ca0f83ffeb50958da84a1 \
+    --hash=sha256:5582de171f0898139cf51dd9fcdc79b848e28d9abd68e837f0803fc9f30807b1 \
+    --hash=sha256:58c5d7318a136a3874c78717dd6de57519bc64f6363c5827c2b1cb775bea71dd \
+    --hash=sha256:5db26bbca8e7968c4c977a0c640e0b9ce7224e1f4dcafa57870dc6ee28e27de6 \
+    --hash=sha256:614fc21e86adc28e4165a6391f851a6da6e9cbd7bb232d0df7718b453a89ee98 \
+    --hash=sha256:6419728b08fb6380c66a470d2319cafcec554c81780e2114b7e150329b9a9a7f \
+    --hash=sha256:669c0efe7e99f6d94d63274c06344bd0e9c8daf184ce5602a29bc39e00a18720 \
+    --hash=sha256:66bc81361131763660b969132a22edce2c4d184978ba39614e8f8f95db5c95f8 \
+    --hash=sha256:671745ea7db19693ce867359d503772177f0b20fa8f6ee1e74e00449f4c4151d \
+    --hash=sha256:682836fc672972cc3101cc9e30d49c5f7e8f1d010478d46119fe725a4545acfd \
+    --hash=sha256:6a504d7cdb431a777d05a124fd0b21efb94498efa743103ea01b1e3136d2e4fb \
+    --hash=sha256:6a86610174de8a85a920e956e2d4f9945e7da89f29a00e95ac62a4a414c4ef4e \
+    --hash=sha256:6b50b367308ca8c12e0b50cba5773bc9abe64c428d3fd2bbf5cd25aab37c77bf \
+    --hash=sha256:7475da7a5e2ccf1a1c86c8fee241e277f4874c96564d06f726d8df8e77683ef7 \
+    --hash=sha256:7641920bdcc7cd2d3ddfb8bb9133a6c9536b09dbd49490b79e125180b2d25b93 \
+    --hash=sha256:79a9f42efcc2681790595ab3d03c0e52d01edc23a0973ea09f0dc8d295e12b8e \
+    --hash=sha256:7ea35d849cdd4a9268f910bff4497baebbc1aa3f2f625fd8ccd9ac99c860c621 \
+    --hash=sha256:8198b7c002aae2b40b2d16bfe724b9a90bcbc9b78b2566fc96131ef4e382574d \
+    --hash=sha256:81b292f37969f9cc54f4643f0be7dacabf3612b3b4a65413661cf6c350226787 \
+    --hash=sha256:844d48ff9173d0b941abed8b2ea6a412f82b56d9ab1edb918c74000c15839362 \
+    --hash=sha256:8617c96a20dd57e7e9d398ff9d04f3d11c4d28b1767273a5b1a018ada5a654d3 \
+    --hash=sha256:8a637d387db6fdad95e293fab5433b775fd104ae6348d2388beaaa60d08b38c4 \
+    --hash=sha256:92351aa5363fc3c1f872ca763f86730ced32b01607f0c9662b1fa711087968d0 \
+    --hash=sha256:9843d683b8756971797be171ead21511d2215a2d6e3c899c6e3107fbbe826791 \
+    --hash=sha256:995ab1a238fd0d19dc65f2d222e5eb064e409665c6426a3e51d5101c1979ee84 \
+    --hash=sha256:9bd6b2033993d5ae80883bb29b83fb2b432270bbe067c2f53cc73bb57c46065f \
+    --hash=sha256:9d26da22a793dfd424be1050712a70c0afd96345245c29aced1e35dbace03413 \
+    --hash=sha256:a976ef488f26e224079deb3d424f29144c6d5ba4ded313198169a8af8f47fb82 \
+    --hash=sha256:a9f196c970db2dcde4f24317e06615363349dc357cf4d7a3b0716c20ac6d7bcd \
+    --hash=sha256:b169f8e755e541b72e714b89a831b315bbe70db44e33fead28516c9e13d5f931 \
+    --hash=sha256:b504c08c45623bf5c7ca41be380156d925f00199b3970efd758aef4a77645feb \
+    --hash=sha256:ba18573bb1de1063d222f41de64a0d3741223982dcea863b3f74646faf618ec7 \
+    --hash=sha256:ba3662d41abe2eab0eeec7ee56f33ef4e0b34858f38abf24377687f9e1fb00a5 \
+    --hash=sha256:bd294dcdc1afdc510bb51d35444003f14e327572877d016d576ac3b9a5888a27 \
+    --hash=sha256:bdbeff1b062751c2a2a55b171f7050fb7073633c699299d042e962aacdbe1a07 \
+    --hash=sha256:bf861da9a43d282d6dd9dcd64c23a0fccf2c5aa5cd7c32024513c8c79fb69de3 \
+    --hash=sha256:c82a94ddec996413a905f622f3da02c4359952aab8d817c01cf9915419525e95 \
+    --hash=sha256:c91781d969fbced1993537f45efe1213bd6fccb4b37bfae2a026e20d6fbed206 \
+    --hash=sha256:c9721cdd83a994225352ca84cd537760d41a9da3c0eacb3ff534747ab8fba6d0 \
+    --hash=sha256:cca776a440795db437d82c07455761c85bbcf3956221c3c23b8c93176c278ce7 \
+    --hash=sha256:cf8b8560aa965f87bf9c13bf9fed7025993a155ca0ce8422da74bf46d18c2f5f \
+    --hash=sha256:d2578ef941be0c2ba58f6f421a703527d08427237ed45ecb091fed6f83305336 \
+    --hash=sha256:d2b3935a22c9e41a8000d90588bed96cf395ef572dbb409be44c6219c61d900d \
+    --hash=sha256:d4dfa5ad4bce9ca30a76117fbaa1c1decf41ebb6c18a4e098df44298941566f9 \
+    --hash=sha256:d7f408c43f5e75ea1edc152fb375e8f46ef916f545fb66d4aebcbcfad05e2796 \
+    --hash=sha256:dc1a16f3fc1944c61290d33c88dc3f09ba62d159b284c38c5331868425aca426 \
+    --hash=sha256:e0009258e97502936d3bd5bf2ced15769629097d0abb81e6495fba1047824fe0 \
+    --hash=sha256:e05b39158f2af0e2438cc2075cfc271f4ace0c3cc4a81ec95b27a0432e161951 \
+    --hash=sha256:e1f80cd17d81a404b6e70ef22bfe1870bafc511728397634ad5f5efc8698df56 \
+    --hash=sha256:e2e7d5591ea868d5ec82b90bbeb366a198715672841d46281b623e23079593db \
+    --hash=sha256:f3af26f86863fad12e25395805bb0babbd49d512806af91ec9708a272b696248 \
+    --hash=sha256:f52e54fd776ad0da1006708762213b079b154644db54bcfc62f06eaa5b896402 \
+    --hash=sha256:f8b8e49fe02f744d38352daca1dbef462c3874900bd8166516f6ea8e82b5aacf \
+    --hash=sha256:fb138fbf9f53928e779650f5ed26d0ea1ed8b2cab67f0ea5d63afa09fdc07593 \
+    --hash=sha256:fe517113fe4d35d9072b826c3e147d63c5f808ca8167d450b4f96c520c8a1d8d \
+    --hash=sha256:ff99ae06eef85c7a565854826114ced72765832ee16c7e3e766c5e4c5b98d20e
     # via
     #   -r requirements.in
     #   aio-api-github
diff --git a/tools/code_format/config.yaml b/tools/code_format/config.yaml
index 5b1d73eda6..3d117d0f63 100644
--- a/tools/code_format/config.yaml
+++ b/tools/code_format/config.yaml
@@ -221,7 +221,6 @@ paths:
     - source/extensions/http/custom_response
     - source/extensions/http/early_header_mutation
     - source/extensions/http/injected_credentials
-    - source/extensions/http/original_ip_detection
     - source/extensions/http/stateful_session
     - source/extensions/io_socket/user_space
     - source/extensions/key_value